Sample · Volume 4

Purpose and structure

This handbook is written for the people who run small and medium-sized businesses that have no IT department and no security officer — the workshop with six employees, the law firm with two partners and an assistant, the medical practice, the agency, the retailer, the one-person business. The computers run, e-mail works, an IT contractor comes when something breaks. And at some point somebody asks a question nobody in the house can answer: the insurer in a questionnaire, the major customer in a supplier survey, the tax adviser after a computer failure, or — on the worst day — the staff, when nothing opens in the morning.

It answers four questions in this order: What has to be in place in a business before AI, cloud services or a major customer can even be a topic? Who asks about it, and why does everyone ask the same things? What of it is an obligation, and what is a recommendation? And how do you do it — with the means a business without an IT department has?

The order is deliberate. This handbook is the only one in the series that mostly describes practical work rather than the legal position. It therefore says "do it like this" in many places — and under each of those places it says what the recommendation rests on: a recommendation of the German Federal Office for Information Security, of the European Union Agency for Cybersecurity, of the Austrian computer emergency response team, of the Chamber of Commerce, of the Federal Criminal Police Office, or on what audit checklists and insurers ask. A recommendation is not a command. Where a legal act requires something, that is stated separately, with a reference, and there are few such places.

Structure

The handbook is divided into four parts. Part I explains what this is about: why basic protection comes before any use of AI, what the audit checklists and insurers ask and why they resemble one another, and what of it is an obligation. Part II sets out the four things to get right — access, backups, devices and updates, e-mail — and with them the question of who in the business is responsible. Part III describes the emergency: the first hour and the first day, the reporting channels and points of contact in Austria and in the Union, and what a business may demand of its IT contractor. Part IV contains a self-assessment, the collected uncertainties, the glossary and the list of sources.

Every section in Parts II and III ends with a box headed "How you can tell that it has been done". That is the sentence you can write into a questionnaire when it is true.

Scope

The practical work is the same everywhere; the points of contact are not. Wherever this handbook names an authority, a telephone number or a deadline, Austria is the example and is marked as such. For businesses in other member states of the European Union: the General Data Protection Regulation applies there just the same, the national computer emergency response team can be found through the Union agency's map (Section 11.6), and the recommendations of the German Federal Office are drawn on as an example of official recommendations, not as a German rule. Switzerland is not covered by this handbook.

Handling of sources

Every recommendation, every figure and every legal statement is supported by a source and a date of access. Source lines stand directly beneath the respective statement; the full list is in Section 16. Verbatim quotations are set as such and carry their reference.

Where a statement could not be substantiated, this is expressly noted — as not ascertainable, with the reason, not as an estimate. Those places are collected in Section 14. Two limitations concern the whole handbook and are therefore stated here: First, the pages of the authorities, chambers and audit bodies could mostly be read for this handbook only in the excerpts a search engine returns; the content is thereby substantiated, the wording character for character is not, and wherever the handbook nevertheless quotes, it says that it quotes from an excerpt. Second, the legal texts of the Union were read from copies of the Official Journal that are not official; reading against the official text is still outstanding.

A distinction is drawn throughout between what a law requires, what an authority recommends, and what an audit checklist or an insurer asks. A questionnaire is a matter of contract. It is not a law.