Protection needs analysis
A protection needs analysis determines whether a compromise of the information in an IT object would have consequences that call for more than basic protection. It examines each information group of the object for confidentiality, availability, integrity and accountability. In the federal administration, data protection is added: the data protection officer assesses it. The analysis concludes that the need for protection is increased or not increased. HERMES requires it for every IT project as early as the initiation phase. An increased need obliges the project to design an ISDP concept (information security and data protection) with an in-depth risk analysis. In German the technique is called Schutzbedarfsanalyse, which the federal administration shortens to Schuban.
Goal
The protection needs analysis decides whether IT baseline protection is enough for an IT object of protection. HERMES also calls it the ISDP analysis. Art. 16 of the Information Security Act (ISA) requires every authority subject to the Act to run a security procedure that assesses the need for protection (para. 2 let. a). The analysis comes before the object goes into operation, whatever the project method.
In HERMES 2022, the task Analyze protection needs produces the analysis. It belongs to the Project foundations module and runs in the initiation phase. HERMES sets the rule: "A protection needs analysis must be conducted for each IT project." If the analysis shows that increased protection is necessary, the project designs an ISDP concept with an in-depth risk analysis during solution development.
The analysis runs in parallel with the study. The study builds the findings of the analysis into the evaluation of the options. The execution order also rests on the protection needs analysis. In the concept phase, the tender documentation lists it among its inputs.
The deliverable is the analysis document. In the federal administration it follows the Excel template P041-Hi01. The template holds the description of the object, the inventory of information groups and the consequences of a compromise for each security objective. It ends with the need for protection, the security level and the next steps of the security procedure.
Usage
When to use it
- IT project run under HERMES: the analysis accompanies the study in initiation and feeds the execution order and the call for tenders.
- Unit subject to the ISA: the security procedure requires an assessment of each object's need for protection before it goes into operation.
- Personal data processed by the object: the team runs the preliminary risk assessment with the data protection officer; a high risk leads to an increased need.
- External company that takes part in development or operation: the analysis shows whether an industrial security procedure must be started.
- Major change to an object in operation: a new information group or a new external access calls for a revised analysis.
- Organisation without its own method: the federal P041 guidelines also address companies.
When not to use it
- Assessing threats or choosing measures: the analysis ignores the threat; run the risk analysis of the ISDP concept.
- Classifying a document: classification follows the organisation's classification catalogue; the analysis covers a whole IT object.
- Measuring the risk to people's rights: run the preliminary risk assessment, then the data protection impact assessment (DPIA) under Art. 22 of the Federal Act on Data Protection (FADP).
Description
HERMES and the requirements of the core organisation
HERMES 2022 names the task, its inputs, its activities and its outcome. It sets neither the security objectives nor the levels. The content of the outcome "is based on the requirements of the core organization". In HERMES, the core organisation is the line organisation responsible for the project: a federal office, a cantonal administration, a company.
The task starts at the milestone Project initiation release. It draws on the project initiation order and the stakeholder list. HERMES gives it these activities:
- analyse information security and protection needs;
- perform a risk analysis;
- review the information security and data protection requirements, then assess their impact on the study, the project execution and the envisaged solution;
- coordinate the analysis with the controlling and compliance bodies.
HERMES assigns the task to the ISDP manager and involves the project manager in the outcome. It does not name the business analyst among the participants. The team still gains from involving one: the business analyst knows the object's business processes, the information that flows through the object and the people who access it.
In the federal administration, the requirements are those of the security procedure. The State Secretariat for Security Policy (SEPOS) bases it on Art. 16 ISA and Art. 27 to 29 of the Information Security Ordinance (ISO). The Federal Office for Cyber Security (FOCS) published the method on 14 October 2024 in the Guidelines for protection needs assessment (P041). SEPOS distributes the guidelines with the Excel template P041-Hi01. The guidelines set five security objectives: confidentiality, integrity, availability, accountability and data protection.
The federal procedure gives the HERMES activity "perform a risk analysis" its content. In that activity, the protection needs analysis only establishes whether a risk exists that should be prevented. The analysis is therefore itself the deliverable of that activity. The in-depth risk analysis belongs to the ISDP concept.
Cantons set their own rules. Basel-Landschaft uses four objectives: confidentiality, availability, integrity and accountability. Its levels vary by objective. Availability has four, from "normal" (restart within 72 hours) to "extremely high" (restart within 30 minutes). Integrity and accountability have two. Before the first session, the analyst checks which requirements apply to the project.
The IT object of protection
The analysis covers an IT object of protection. The P041 guidelines define it as a set of IT resources and the data they store, process and transmit. These elements serve a common purpose: a specialised application that supports a business process is the typical example. A platform that provides services to other objects is itself an object of protection. The guidelines cite the eIAM system, virtualised server infrastructures and software as a service (SaaS) offerings.
Each object gets its own analysis. A project that delivers an application and an exchange platform therefore produces two. A single piece of information or a document type is not an object: the P041-Hi01 template holds that no need for protection can be derived from it.
Consequences, never the threat
The analysis assesses the possible consequences of a compromise. It takes no account of the threat that could cause it. The P041 guidelines give the example of data loss: whether it comes from a missing backup, a cyberattack or a malicious employee, the data are lost.
This rule protects the analysis from circular reasoning. A participant who answers "we have backups" to the availability question describes a measure. The measure belongs to the ISDP concept, which the analysis must justify. The facilitator brings the discussion back to the consequence: what happens if the information is missing.
Running the analysis
The procedure in the P041 guidelines draws on Mozilla's Rapid Risk Assessment.
- Describe the object. The description gives the object's purpose and the business processes it supports. It names the service recipients, the service providers and the people with an assigned role, for example the IT security officer of the organisational unit (ITSOO). It sketches the technical configuration and the network integration. It lists the access rights of persons, groups, roles and processes. It states the geographic setting: in which countries the information is stored and from where it is accessed. The guidelines allow the description to be completed during the project.
- Draw up the information inventory. The inventory contains all the information that the object creates, stores, processes or transmits. It also contains the information that the object needs. The team groups the information that has the same consequences. The P041-Hi01 template (version 5.1.1) accepts at most ten groups. Each group receives a description, its current or required classification under Art. 18 to 20 ISO (INTERNAL, CONFIDENTIAL, SECRET) and an indication of the personal data it contains. For a classified group, the guidelines also ask for the group of authorised persons.
- Describe the consequences. For each group, the team answers the question that the guidelines ask for each objective. It describes the consequences for the organisation and for the other persons or organisations affected.
- Apply the criteria. The team examines whether the consequences lead to compromised information security or a financial loss under the criteria of Art. 28 ISO. It examines whether an act or an ordinance justifies or requires increased protection, for example the Therapeutic Products Act or business secrecy. The data protection officer states whether they see a high risk to the fundamental rights of the data subjects (Art. 22 para. 1 FADP). The P041-Hi01 template recommends keeping the officer's preliminary risk assessment with the analysis. Finally, the organisation judges whether the consequences are unacceptable to it. For this last criterion, the guidelines advise a business impact analysis with criteria specific to the business processes.
- Record the requirements. The team notes the availability requirements (service hours, maintenance). It states whether the object needs a business continuity plan regardless of its security level. It states whether a certification under Art. 23 ISO is required. It flags the external subcontractors that process personal data and any access to these data granted to cantons, foreign authorities or private persons. These answers also serve to decide whether an industrial security procedure is required.
- Conclude. For each objective, the team concludes that the need for protection is increased or not increased. It assigns a security level to the object.
- Have the analysis reviewed and approved. The ITSOO checks that the consequences are plausible and that the assessment is comprehensible and well founded. The data protection adviser takes part when the object processes personal data. In a project, the guidelines consider it sensible for the project sponsor or the business process owner to approve the analysis. Departments and offices decide who signs and in what form. The object and its need for protection enter the asset inventory.
| Objective | Question |
|---|---|
| Confidentiality | "What would happen if the information were disclosed or intercepted by intelligence services or similar organisations?" |
| Availability | "What would happen if the information were unavailable for an extended period of time?" |
| Integrity | "What would happen if the information were to be modified without authorisation?" |
| Accountability | "What would happen if it were not entirely clear who modified information after it was originally entered?" |
| Data protection | No question of its own. The data protection officer assesses the risk to people's fundamental rights (Art. 22 FADP). In the federal administration, the officer uses the preliminary risk assessment tool of the Federal Office of Justice. |
Need for protection and security level
The analysis produces two separate results. The need for protection is stated for each objective: increased or not increased. The security level is assigned to the whole object. According to the P041 guidelines, Art. 17 ISA places the object at basic protection by default. One impact under Art. 28 ISO or one classification is enough to move it to high or very high protection.
| Security level | Impact under Art. 28 ISO | Classification of the information |
|---|---|---|
| Basic protection | No significant or serious impact | Unclassified or INTERNAL |
| High protection | At least one significant impact (para. 1) | CONFIDENTIAL |
| Very high protection | At least one serious impact (para. 2) | SECRET |
Only IT resources receive a security level. It follows solely from the criteria of Art. 28 ISO and from the classification. A high or very high security level always leads to an increased need for protection. A specific legal requirement, a high data protection risk or unacceptable consequences lead to an increased need without changing the security level. An object can therefore stay at basic protection with an increased need.
Need for protection and security level
The security level follows Art. 28 ISO and the classification. The need for protection follows the security level and three other criteria.
The criteria of Art. 28 ISO target harm at the scale of the Confederation: the Federal Council's capacity to act, the security of the population, the operation of critical infrastructures. The P041-Hi01 template estimates the extent of damage in three bands: under CHF 50 million, CHF 50 to 500 million and over CHF 500 million. It links the middle band to Art. 28 para. 1 ISO and the top band to para. 2. According to the template, these amounts come from the Confederation's risk management. They are a relevant criterion for an increased need only for a small number of objects.
After the analysis
Without an increased need, the organisation faces no extraordinary risk and runs no extended risk analysis. The organisation implements the requirements of IT baseline protection (Si001) for the object. These requirements apply to every object of protection, whatever the result.
With an increased need, the organisation reduces the significant or serious consequences to an acceptable level through technical and organisational measures. It applies the P042 directives in an ISDP concept, which includes a risk analysis. HERMES has this concept designed during solution development. Its inputs are the study, the protection needs analysis, the organisational requirements and the solution requirements.
What follows a protection needs analysis
Every object receives IT baseline protection. An increased need adds the risk analysis and the ISDP concept.
Further obligations can follow. An industrial security procedure is required when an external company receives information classified CONFIDENTIAL or SECRET. It is also required when an external company works on an object at high or very high protection. This procedure follows the Industrial Security Procedure Ordinance (ISPO). An object that processes personal data can require a record of processing activities (Art. 12 FADP) and processing regulations. For federal bodies, these regulations follow Art. 6 of the Data Protection Ordinance (DPO).
The P041-Hi01 template calls the analysis a living document. The P041 guidelines ask for a first version to be completed early, then kept up to date at all times. SEPOS asks for the security procedure to be repeated at every major change to the object. It also asks for a check of its currency and effectiveness at least once a year.
Pitfalls
Assessing the threat. A team that weights the consequences by the likelihood of an attack underrates the object. Nor does it need to list the common threats: according to the P041-Hi01 template, IT baseline protection handles the risks common to all IT resources.
Analysing a document. An analysis per document type multiplies the files and yields no security level. The object aggregates the information and the IT resources that process it.
Confusing classification with need for protection. An unclassified object can fall under high protection. The classification of the whole object can exceed that of each of its groups. A team that reads "unclassified" and stops misses the other four objectives.
Ignoring the context. The Basel-Landschaft guide gives the example of an address. Under that canton's classification levels, it is "confidential" as a rule and "strictly confidential" when the person is in a witness protection programme. The same field's need for protection varies with the process that uses it.
Arriving too late. The study evaluates the options with the findings of the analysis. An analysis written after the solution is chosen can only justify that choice.
Inventorying too finely. An inventory of forty lines dilutes the judgement.
AI considerations
An AI assistant speeds up the description and the inventory. From the specification, the process models and the data model, it proposes a first list of information groups. It flags the groups that contain personal data or sensitive personal data under the FADP. For each group it drafts an answer to the questions in the guidelines. It spots inconsistencies: a group of health data without the data protection officer's opinion, a security level incompatible with the classification of a group. In a bilingual administration, it produces the German or French version that the team reviews.
Only the organisation judges the consequences. A language model does not know what a three-day outage would cost the process. The ITSOO answers for the plausibility of the assessment. The document itself describes the architecture, the network and the access rights of a system: it is of value to an attacker. It goes only to an AI service that the organisation has authorised for that classification level. Information classified CONFIDENTIAL or SECRET does not leave the resources intended for it.
Examples
The analysis below shows an increased need for protection for an object that stays at the basic protection level. The columns hold three information groups; the rows follow the P041-Hi01 template.
| Item | Holiday and flexitime balances | Medical certificates | Attendance schedule |
|---|---|---|---|
| Classification | Unclassified | Unclassified | Unclassified |
| Personal data | Yes | Yes, health data (sensitive under the FADP) | Yes |
| Disclosure | Breach of employees' privacy | Incapacities for work, their rate and their duration known to colleagues | Absences known outside the office |
| Extended unavailability | Entries postponed by a few days | Absence monitoring delayed | Scheduling on paper |
| Unauthorised modification | Wrong balance until the next statement | Absence wrongly excused | Wrong schedule for one week |
| Author of a modification unknown | Dispute with an employee without proof | Dispute without proof | Negligible consequence |
| Criteria of Art. 28 ISO | No consequence meets the criteria | ||
| Specific legal requirement | None | ||
| Preliminary risk assessment (data protection) | High risk for the medical certificates | ||
| Consequences unacceptable to the office | None | ||
| Security level | Basic protection | ||
| Need for protection | Not increased for confidentiality, availability, integrity and accountability. Increased for data protection. | ||
| Next steps | IT baseline protection (Si001): yes. ISDP concept with risk analysis (P042): yes. DPIA: yes. Industrial security procedure: no. | ||
The security level stays at basic protection because no consequence reaches the thresholds of Art. 28 ISO. The ISDP concept comes from the need-for-protection row: the data protection officer sees a high risk in the medical certificates. A team that reads only the security level stops at basic protection and misses the obligation.
Visualisations
A first diagram shows what follows the analysis: every object receives IT baseline protection. Only an increased need opens the risk analysis and the ISDP concept. A second diagram separates the two results. The security level follows from Art. 28 ISO and the classification. A high or very high level leads to an increased need. The other criteria lead to an increased need without changing the level. The questions per objective, the levels and the analysis in the example are rows and columns, hence tables.
Cost
| Phase | Level | Rationale |
|---|---|---|
| Preparation | Low | The template exists. The team gathers the object description, an architecture sketch and the names of the ITSOO and the data protection officer. |
| Execution | Medium | One or two two-hour workshops with the process owner, the ISDP manager and the project manager, then the review by the ITSOO. The preliminary risk assessment is added when the object processes personal data. |
| Documentation | Medium | The completed template is the documentation. It is updated at every major change to the object, during the project and then in operation. The security procedure it belongs to is checked at least once a year. |
Tooling
The Excel template P041-Hi01 (version 5.1.1, in French, German and English) runs the federal analysis tab by tab: cover sheet, information inventory, impact assessment, need for protection, business requirements and assessment. It computes the security level and the next steps from the answers. SEPOS publishes it free of charge with the P041 guidelines. The HERMES Online outcome page links to it.
The department's classification catalogue provides the classification of each information group. The preliminary risk assessment tool of the Federal Office of Justice assesses the risk to people's rights.
On the same page, SEPOS publishes the templates for the rest of the procedure: the IT baseline protection checklist (Si001-Hi01), the ISDP concept template (P042-Hi01) and the risk analysis spreadsheet (P042-Hi02).
Outside the federal administration, a spreadsheet built on the organisation's objectives and levels is enough. Several cantons publish their own explanations, for example Basel-Landschaft. The organisation keeps the asset inventory in its information security management tool or its configuration database.
Sources
- Swiss Confederation, Federal Chancellery, HERMES 2022, Project Management reference manual, outcome 4.4.1.45 Protection needs analysis: the definition of the outcome. HERMES also calls the outcome the ISDP analysis and bases its content on the requirements of the core organisation.
- Swiss Confederation, Federal Chancellery, HERMES 2022, Project Management reference manual, task 5.4.3.42 Analyze protection needs: the rule of one analysis per IT project, the inputs, the activities and the ISDP concept that an increased need requires. In the same manual, task 5.4.3.45 Prepare study uses the findings of the analysis. The manual assigns the task to the ISDP manager (§6.4.3.6).
- Federal Office for Cyber Security (FOCS), Guidelines for protection needs assessment (P041), version 1.0, 14 October 2024: the IT object of protection, the rule of consequences without the threat, the two steps, the criteria, the security levels and the rest of the procedure. The articles of the ISA, the ISO, the FADP and the DPO are cited as the guidelines give them.
- State Secretariat for Security Policy (SEPOS), Sicherheitsverfahren (in German): the legal basis of the procedure, its renewal and annual review, the Excel template P041-Hi01 (version 5.1.1) and its FAQ, IT baseline protection Si001 and the P042 templates for the ISDP concept.
- Canton of Basel-Landschaft, Aufsichtsstelle Datenschutz, Erläuterungen und Beispiele Schutzbedarfsanalyse, V 1.9, 15.8.2024 (in German): the canton's four security objectives, their levels and the address example.