Contents
Part I · What this is about
- 1Why basic protection comes before AIThe five points that Volume 1 puts before any use of AI, and why a business without them builds on sand with every other question.
- 2What audit checklists ask — and why they resemble one anotherThe CyberRisikoCheck, the Austrian label, the insurers' policyholder duties and the questionnaires of major customers ask the same six things. Whoever knows them need not read every checklist afresh.
- 3What is an obligation and what is a recommendationThe one security obligation that affects almost every business, the duty to notify after an incident, the retention period — and why NIS2 is not an obligation for the reader of this handbook.
Part II · The four things to get right
- 4Access I: passwords and the password managerOne password per service, long rather than complicated, no forced change, one password manager for everyone — and what the Federal Office recommends on this.
- 5Access II: second factor, administrative rights, who leavesWhy the password alone is not enough for the mailbox, which second factor is fit for purpose, why nobody should read e-mail with administrative rights, and what happens on a person's last working day.
- 6Backups: what, where, how often — and the one test almost nobody doesWhy a copy in the same place is not a backup, what the Federal Office says about the separate copy, how often to back up, how long to keep states, and why a backup never restored is an assumption.
- 7Devices and updatesUpdates immediately, replace devices without manufacturer support, encrypt laptops and phones, leave protection programs switched on, do not forget router and Wi-Fi — and a list of which devices the business has at all.
- 8E-mail and fraudHow to recognise a forged message, why spelling mistakes are no longer a sign, what CEO fraud is, and the one rule that helps against all payment frauds — the call-back.
- 9Responsibility, rules, trainingOne person who knows; a deputy; one sheet with the rules; one conversation a year; and a folder in which it says what was done when.
Part III · When it happens, and who helps
- 10The emergency: the first hour and the first dayDisconnect, do not delete, call, write down; why ransom is no solution; and what is on the emergency card that should be printed now, not afterwards.
- 11Reporting channels and points of contactWho helps in Austria and who is responsible for what — hotline, computer emergency response team, reporting office, police, data protection authority —, what of it is an obligation and what an offer, and where businesses in other member states find their bodies.
- 12Contractors: what you may demand of an IT providerThe contractor replaces the IT department — not the responsibility. Eight questions before the contract, six commitments in the contract, and what you have shown to you once a year.
Part IV · Appendix
- 13Self-assessmentTwenty statements in five fields of action. The assessment shows which questions of an audit checklist you can answer today with "we have that, like this" and which not yet. Takes about fifteen minutes.
- 14UncertaintiesWhat could not be read, substantiated or clarified for this handbook — with the reason and with the date on which it was last searched for. None of it is silently smoothed over.
- 15GlossaryTerms that occur in this handbook and that Volume 1 does not carry. The terms from Volume 1 are adopted, not explained afresh.
- 16List of sourcesAll sources of this handbook with publisher, title, version, means of access and date of access. Where only an excerpt or a copy was read, it says so.