01.1 	Release of an Information Security Management System (ISMS)			
01.2 	IS Risk Management			
01.3 	Effectiveness of the ISMS			
05.1 	Information Security Policy			
06.1 	Assigning responsibility for information security			
06.2 	Information Security in projects			
06.3 	Mobile devices			
06.3.a (new)	Teleworking			
06.4 	Roles and responsibilities for external IT service providers			
07.1 	"Contractual information security obligation
of employees"			
07.1.a (new)	Qualification of employee(s)			
07.2 	Awareness and training of employees			
08.1 	Inventory of assets			
08.2 	Classification of information			
08.3 	Storage of information on mobile data storage devices			
08.4 	Removal of externally stored information assets			
09.1 	Access to networks and network services			
09.2 	User registration			
09.2.a (new)	Handling of identification means			
09.3 	Privileged user accounts			
09.4 	Confidentiality of authentication data			
09.5 	Access to information and applications			
09.6 	Separation of information in shared environments			
10.1 	Encryption			
11.1 	Security zones			
11.2 	Protection against external influences and external threats			
11.3 	Protective measures in the delivery and shipping area			
11.4 	Use of equipment			
12.1 	Change Management			
12.2 	Separation of development, testing and operational environments			
12.3 	Protection against malware			
12.4 	Backup procedures			
12.5 	Event logging			
12.6 	Logging administration activities			
12.7 	Tracing of vulnerabilities (patch management)			
12.8 	Review of information systems			
12.9 	Consideration of critical administrative functions of cloud services			
13.1 	Management of networks			
13.2 	Security requirements for networks/services			
13.3 	Separation of networks (network segmentation)			
13.4 	Electronic exchange of information			
13.5 	Non-disclosure agreements for information exchange with third parties			
14.1 	Requirements for the acquisition of information systems			
14.2 	Security in the software development process			
14.3 	Management of test data			
14.4 	Approval of external IT services			
15.1 	Risk management in collaboration with suppliers			
15.2 	Review of service provision by suppliers			
16.1 	Reporting system for information security incidents (incident management)			
16.2 	Processing of information security incidents			
17.1 	Information Security Aspects of Business Continuity Management (BCM)			
18.1 	Legal and contractual provisions			
18.2 	Confidentiality and protection of personally identifiable data			
18.3 	Audit of the ISMS by independent bodies			
18.4 	Effectiveness check