Skip to content

Workflow with VIVA#

The options for IT documentation are already diverse in i-doit and can be adapted to the specifications and needs of the respective (organizational) environment. The VIVA add-on is no exception: Even though the underlying standards of IT-Grundschutz provide many specifications, they are open to interpretation in numerous places. VIVA attempts to do justice to this. Despite all this, some work sequences have become established in practice and are described in more detail in this chapter. The example makes no claim to be complete or binding. Further (intermediate) steps such as adaptation of the documentation are probably necessary.

The goal of this workflow is to create a solid documentation basis to later support auditing and certification according to ISO 27001 based on IT-Grundschutz.

  1. Preparing the VIVA installation: i-doit's IT documentation contains objects (including location and software assignment as well as port connections, if possible) that are modeled as services and are to be covered by IT-Grundschutz.
  2. Manage IT-Grundschutz catalogs
    1. Import IT-Grundschutz catalogs EL 15 from 2016
    2. Adapt building blocks, measures and hazards (optional)
  3. Model information federation with target groups and objects
    1. Create information federation
    2. Run IT service wizard (layer 5 applications); then:
    3. Application wizard (layer 3 IT systems)
    4. IT system wizard (layer 2 infrastructure)
    5. IT system wizard (layer 4 networks)
  4. Determine protection requirements
    1. Adapt protection requirement categories
    2. Determine protection needs of target groups in layer 5 Applications; then run wizards:
    3. Protection Needs Wizard (Layer 3 IT Systems)
    4. Protection requirement wizards (layer 2 infrastructure)
  5. Assign modules and implement measures
    1. Assign the necessary modules for each target group
    2. Document the implementation of measures for each target group
    3. Answer test questions
  6. Perform risk analysis
    1. Perform supplementary safety analysis
    2. Perform risk analysis if necessary
  7. Create audit
    1. Review reports and repeat steps 2-5, if necessary, until reports no longer provide unavoidable negative results
    2. Store information on reference documents A.0 and A.1
    3. Create audits
    4. Post-process output