Sample · Part I · Sections 1 – 3 · What this is about

Why basic protection comes before AI

Anyone who looks into the use of artificial intelligence in a business quickly runs into an order that is not negotiable: first the foundation of the information technology, then the risks that new tools bring with them. Volume 1 of this series said so in one sentence and set it out in five points. This handbook is the execution of those five points at the depth a business without an IT department needs in order to implement them itself — or to check whether its contractor has implemented them.

1.1 The five points from Volume 1

Volume 1 states in Section 12, "Information security", that "the sequence is dictated by the subject matter: first the basic foundation of information technology, then the AI-specific risks. Not as a substitute." Before any AI-specific measure, five points are to be put in order, which are "unspectacular" and cover "the predominant part of the incidents which actually occur":

Data backup, held separately from the network, with restoration successfully tested at least once. — Up-to-date software on all devices — operating systems, browsers, servers, including rarely used devices. — Accounts: accounts tied to individuals, two-factor login, immediate blocking upon departure. — Responsibility: a person designated by name as responsible, even where external support is called in. — Emergency arrangement: established contact points for the event of an outage.

These five points are the structure of Parts II and III of this handbook: access (Sections 4 and 5), backups (6), current software and devices (7), responsibility (9), emergency (10 and 11). To these is added a point that Volume 1 lists among the AI-specific risks but which affects every business whether it uses AI or not: e-mail and fraud (8).

1.2 What "foundation" means in practice

A business that has not put these five points in order can answer every other question only with assumptions. Three examples, all invented:

A tax advisory firm with four employees has for years run a mailbox whose password also opens the accounting service. The password becomes known at an unrelated service where an employee had used it as well. Nobody in the house notices that somebody is logging in; the login looks like her own. Whether client data has leaked in the process the firm cannot say afterwards — and that is exactly the question the data protection authority asks (Section 11.2).

A plumbing business has for years backed up every night to a hard disk hanging off the server. One morning all files are encrypted, the backup too, because it was connected at the moment of encryption. The backup existed, but it was not separate (Section 6.3).

An agency with nine employees has an emergency arrangement: "In case of problems, call the IT contractor." On the Saturday it happens, the IT contractor's phone is off, and nobody knows the second number, the customer portal of the cloud service or the router's credentials. The business stands still until Monday (Section 10).

None of these examples needs artificial intelligence to happen. None is prevented by an AI policy. All three are prevented or caught by the five points. That is the reason for the order.

1.3 Why businesses without an IT department in particular are meant

In June 2021 the European Union Agency for Cybersecurity published a report on the situation of small and medium-sized enterprises and, alongside it, a guide with twelve steps. According to the report, the enterprises interviewed named as the most common incidents attacks with ransomware, stolen laptops, phishing and so-called CEO fraud — four things against which no expensive technology is needed, but the four things this handbook is about.

For the same reason the German Federal Office for Information Security, together with an association of medium-sized businesses, developed an audit procedure that is expressly aimed at "small and micro-enterprises with up to about 50 employees without an IT department of their own" — the CyberRisikoCheck under DIN SPEC 27076, which Volume 1 already names and which Section 2 of this handbook describes. That such procedures exist is the authorities' admission that the big standards were not made for these businesses.

1.4 What distinguishes this handbook from a standard

There are standards for information security, and for some businesses they are the right way: the international standard ISO/IEC 27001 for a management system, in Germany the Federal Office's IT-Grundschutz and the guideline VdS 10000 for small and medium-sized enterprises, in Austria the cyber risk rating scheme. This handbook introduces none of them. It names them where they occur as the origin of a recommendation or as evidence towards a customer, and then says what they are. Whoever needs a certificate because a major customer demands one will find in Volume 3 of this series what the customer means by it and whether a supplier statement suffices.

What this handbook does instead: it describes four things to get right in such a way that a business can implement them without a standard, without a consultant and without a new product, and for each of them it says what an auditor, an insurer or a customer will later want to see. That is less than a standard. For most of the businesses that read this handbook, though, it is the part that is missing.