S 2.111 Keeping manuals at hand

Initiation responsibility: Head of IT Section, IT Security Management

Implementation responsibility: Head of IT Section, IT Security Management

When procuring information technology - regardless of whether it is hardware or software - the related manuals and technical reference literature must also be procured in sufficient numbers.

In an increasing number of cases, physical documentation related to IT products now only consists of an installation guide and introductory text, the rest being replaced by online help systems. The scope of this documentation proves inadequate and limited, particularly on the occurrence of errors which need to be evaluated. Steps must be taken to ensure that the required manuals, technical reference literature and error catalogues are procured with the IT system. In this context, it is not necessary to refer exclusively to literature provided by the manufacturer of the IT system.

All manuals concerning an IT application must remain available at all times in the application's environment. For example, manuals concerning a server operating system must be stored in the immediate vicinity of the server, not in a library which might be locked. Access to this literature must be ensured as part of contingency planning (refer to S 6.3 Development of an Emergency Procedure Manual).

Additional controls:

• Which manuals are available concerning the IT products in use?

• Where are these manuals stored? Are they available at all times?