Defines the requirements for audits and reviews with the aim of improving information security in an institution, avoiding undesirable developments and optimising security measures and processes. In Edition 2023 the Baustein carries 28 requirement numbers, 27 of them live: 4 Basis requirements (B, MUSS, to be fulfilled first and without exception), 23 Standard requirements (S, SOLLTE) and 0 requirements for elevated protection needs (H), with 1 number withdrawn (ENTFALLEN) and kept for stable numbering. It is applied to the information domain as a whole (overarching aspects) in modelling order R3. The requirements property on this node lists every requirement by number, title, level and responsible role, so a requirement is cited as DER.3.1.A<n>.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.