Mapping to ISO/IEC 27001:2022 and BSI IT-Grundschutz
If you run an information security management system under ISO/IEC 27001 or under BSI IT-Grundschutz, you map each control to its implementation and its evidence. The tables show which features of WKL Database Gateway Manager contribute to which control, what evidence they produce and what stays with you. They replace neither your statement of applicability nor your IT-Grundschutz check.
The controls are named with number and title from ISO/IEC 27001:2022, Annex A; the European edition EN ISO/IEC 27001 uses the same numbers. The BSI modules come from the IT-Grundschutz-Kompendium, Edition 2023.
ISO/IEC 27001:2022, Annex A
| Control | What the app contributes | Evidence | What stays with you |
|---|---|---|---|
| A.5.15 Access control | rules per person and object (table, view, method); sign-in policy per network and sign-in method | report Rechteübersicht (Rights overview) | access control policy; permissions in the databases |
| A.5.16 Identity management | people with Windows account, SQL login and keys in one place; import for many people | report Rechteübersicht; work list Ohne Zugang (No access) | life cycle of identities in Active Directory and SQL Server |
| A.5.17 Authentication information | keys only as a one-time link and as a SHA-256 hash in the store; expiry date; reissue instead of reuse | tab Schlüssel (Keys) per person; report Rechteübersicht | rules for passing the links on to the people |
| A.5.18 Access rights | grant, change and revoke rights; many people at once; work lists Ohne Regel (No rule) and Ohne Zugang | reports Verwaltungsänderungen (Administration changes) and Austritte und Sperren (Departures and locks) | regular review of rights by those responsible |
| A.5.19 Information security in supplier relationships | manufacturer information, point of contact for vulnerabilities, support period | Supplier fact sheet | assessment and selection of the supplier |
| A.5.20 Addressing information security within supplier agreements | the manufacturer's obligations under the Cyber Resilience Act | Product and security information under CRA Annex II | contract with the supplier or distribution partner |
| A.5.21 Managing information security in the ICT supply chain | components of the delivery with their manufacturer; software bills of materials when the delivery contains them | Supplier fact sheet, section “Integrity and composition” | assessment of the components, for example against known vulnerabilities |
| A.5.22 Monitoring, review and change management of supplier services | changes of each version in the changelog; the manufacturer's security advisories | Changelog; SECURITY.md | reviewing new versions before putting them in place |
| A.8.2 Privileged access rights | the right to administer as a rule of its own with the resource admin; the data service always requires a second factor for it | report Rechteübersicht (who has admin); report Verwaltungsänderungen (what they did) | few administrators; rights on the server and on the store file |
| A.8.5 Secure authentication | second factor (TOTP); sign-in policy, for example “from outside only with a code”; lockout after failed attempts by the data service | report MFA-Abdeckung (MFA coverage) | deciding where a code is required |
| A.8.8 Management of technical vulnerabilities | the manufacturer's coordinated vulnerability disclosure and free fix releases | SECURITY.md | putting new versions in place; updating Access and Windows |
| A.8.15 Logging | change log with actor and values before and after; audit of every access | tabs Änderungsprotokoll (Change log) and Audit; period reports | retention and protection of the logs; the change log isn't tamper-proof |
| A.8.16 Monitoring activities | area Anmeldungen (Sign-ins) with refusals and origin; card Abgewiesene Anfragen (Rejected requests) on the overview | area Anmeldungen, tab Audit | who looks how often and how anomalies are handled |
BSI IT-Grundschutz
| Module | What the app contributes | Evidence | What stays with you |
|---|---|---|---|
| ORP.4 Identity and access management | people, keys, rules and assignments in one place; leaving with Person sperren … (Lock person); keys with expiry date | reports Rechteübersicht and Austritte und Sperren | processes for joiners, movers and leavers; directory service and databases |
| OPS.1.1.3 Patch and change management | new versions only through the delivery folder that you fill; going back to the previous version is possible | Put a new version in place | procedure and deadlines for putting versions in place |
| OPS.1.1.5 Logging | change log and audit of the data service, readable in the app; all times in UTC | tabs Änderungsprotokoll and Audit; period reports | logging concept, retention, evaluation |
| DER.2.1 Security Incident Handling | lock a person or key at once; end sessions; block an origin; logs to trace what happened | reports Austritte und Sperren and Verwaltungsänderungen; tab Audit | incident process, reporting channels, reporting to the authority |
Related topics
en/wiki/data-conectivity/database-gateway/admin/security-and-evidence/iso-27001-and-grundschutz.txt · Last modified: by Wolfgang van der Stille