Speaker: Andreas Hensel

A contract from the German public sector or the defence industry – and the paperwork says VS-NUR FÜR DEN DIENSTGEBRAUCH, Germany's lowest classification level. Many companies sign at this point without knowing what they have taken on. They run an ISMS, they are ISO 27001 certified, they encrypt – and they are still not fit for classified work. A marathon runner is not a boxer, however well trained both may be.
This short talk translates the requirements of Annex 4 of the German Classified Information Handbook (Geheimschutzhandbuch, GHB) into an image everyone understands: fitness training. Abstract rules become a training plan, control catalogues become core exercises, audits become the fitness test. The metaphor carries the central argument: complianc ...