--- title: "Part 3: Catalog of reference measures and should-be comparison" description: "Step 3 of 6 of SRC IT Security Consulting: Reference measure catalog and target-performance comparison according to MaRisk and BAIT" image: https://blog.src-consulting.com/hubfs/Blog-03.png --- [![Logo-SRC](https://blog.src-consulting.com/hubfs/HubSpot%20website/Logo-SRC.svg "Logo-SRC")](https://www.src-consulting.com/en/) - [About us](https://www.src-consulting.com/en/about-us) - [Work](https://www.src-consulting.com/en/work) - [Services](https://www.src-consulting.com/en/services) - [IT Security](https://www.src-consulting.com/en/services/it-security-consulting) - [IT Governance](https://www.src-consulting.com/en/services/it-governance-consulting) - [Internal Control System](https://www.src-consulting.com/en/en/services/internal-control-systems) - [Risk Management](https://www.src-consulting.com/en/services/risk-management-consulting) - [IT Compliance](https://www.src-consulting.com/en/services/it-compliance-consulting) - [Automation](https://www.src-consulting.com/en/services/sgrc-automation) - [Data Analytics](https://www.src-consulting.com/en/services/data-analytics-consulting) - [Career](https://www.src-consulting.com/en/career) English - [English](https://blog.src-consulting.com/en/information-security/reference-measures-catalog-and-should-be-comparison) - [Deutsch](https://blog.src-consulting.com/informationssicherheit/referenzmassnahmen-und-soll-ist-abgleich) [Contact us](https://www.src-consulting.com/en/contact) [![Logo-SRC](https://blog.src-consulting.com/hubfs/HubSpot%20website/Logo-SRC.svg "Logo-SRC")](https://www.src-consulting.com/en/) [Contact us](https://www.src-consulting.com/en/contact) [![Logo-SRC](https://blog.src-consulting.com/hubfs/HubSpot%20website/Logo-SRC.svg "Logo-SRC")](https://www.src-consulting.com/en/) - [About us](https://www.src-consulting.com/en/about-us) - [Work](https://www.src-consulting.com/en/work) - [Services](https://www.src-consulting.com/en/services) - [IT Security](https://www.src-consulting.com/en/services/it-security-consulting) - [IT Governance](https://www.src-consulting.com/en/services/it-governance-consulting) - [Internal Control System](https://www.src-consulting.com/en/en/services/internal-control-systems) - [Risk Management](https://www.src-consulting.com/en/services/risk-management-consulting) - [IT Compliance](https://www.src-consulting.com/en/services/it-compliance-consulting) - [Automation](https://www.src-consulting.com/en/services/sgrc-automation) - [Data Analytics](https://www.src-consulting.com/en/services/data-analytics-consulting) - [Career](https://www.src-consulting.com/en/career) English - [English](https://blog.src-consulting.com/en/information-security/reference-measures-catalog-and-should-be-comparison) - [Deutsch](https://blog.src-consulting.com/informationssicherheit/referenzmassnahmen-und-soll-ist-abgleich) [Contact us](https://www.src-consulting.com/en/contact) [![Logo-SRC](https://blog.src-consulting.com/hubfs/HubSpot%20website/Logo-SRC.svg "Logo-SRC")](https://www.src-consulting.com/en/) [Contact us](https://www.src-consulting.com/en/contact) - [About us](https://www.src-consulting.com/en/about-us) - [Work](https://www.src-consulting.com/en/work) - [Services](https://www.src-consulting.com/en/services) - [IT Security](https://www.src-consulting.com/en/services/it-security-consulting) - [IT Governance](https://www.src-consulting.com/en/services/it-governance-consulting) - [Internal Control System](https://www.src-consulting.com/en/en/services/internal-control-systems) - [Risk Management](https://www.src-consulting.com/en/services/risk-management-consulting) - [IT Compliance](https://www.src-consulting.com/en/services/it-compliance-consulting) - [Automation](https://www.src-consulting.com/en/services/sgrc-automation) - [Data Analytics](https://www.src-consulting.com/en/services/data-analytics-consulting) - [Career](https://www.src-consulting.com/en/career) Current language: English - [English](https://blog.src-consulting.com/en/information-security/reference-measures-catalog-and-should-be-comparison) - [Deutsch](https://blog.src-consulting.com/informationssicherheit/referenzmassnahmen-und-soll-ist-abgleich) [Compliance](https://blog.src-consulting.com/en/tag/compliance) [Security](https://blog.src-consulting.com/en/tag/security) [Digitalization](https://blog.src-consulting.com/en/tag/digitalization) # Part 3: Catalog of reference measures and should-be comparison By [Dr. Jaber Kakar](https://blog.src-consulting.com/en/author/jaber-kakar) 2/16/22 5:02 PM 1 Minute Read Recall that [step 1](https://blog.src-consulting.com/en/information-security-part1) is all about developing a solid understanding of security-relevant assets while [step 2](https://blog.src-consulting.com/en/information-security-part2) deals with determining the criticality of assets in terms of protection goals. But knowing your protection assets does not mean that they already meet the corresponding security requirements. This is where step 3 to achieve reconciliation of rapid digital transformation with security and compliance kicks in.  ## **Target-performance comparison of security measures** Knowing your protection assets does not mean that they already meet the corresponding security requirements. After all, your security requirements must keep pace with current technological developments and risks. *A safety catalog serves as a collection of safety-relevant measures.* Without a doubt, different security measures must be taken for applications that require a relatively high level of protection in terms of confidentiality, e.g., because they process or collect highly sensitive data according to GDPR, then for systems that require less protection. The aforementioned security catalog must therefore be set up in particular with a focus on protection goals, protection requirements and technology. *A constantly updated security requirements catalog is crucial to putting your security implementation to the test.* From our experience, a team of technical and audit experts are needed to establish a compliant and technically-sound collection of security measures. Digital tools are important instruments here that can simplify and speed up the creation and updates in dealing with the security catalog. *Because without these tools, the paradigm shift from "Move fast OR Stay secure" to "Move fast AND Stay secure", i.e. the process towards the governance of the digital era, would not occur.* In addition, digital solutions immediately detect deficiencies in the implementation of security measures for assets worth protecting. The detection of security deficiencies needs to be fully automatic and has to adapt to your security requirements catalog.   [![Subcribe to Blog](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/25138374/d8e5938c-d9f8-4711-ba29-6338077ad7b4.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/25138374/d8e5938c-d9f8-4711-ba29-6338077ad7b4) #### Dr. Jaber Kakar Author ## Recommended For You [![IT Governance - Protection needs analysis ](https://blog.src-consulting.com/hubfs/Blog-02-1.png)](https://blog.src-consulting.com/en/information-security/protection-needs-analysis) [Compliance](https://blog.src-consulting.com/en/tag/compliance) [Security](https://blog.src-consulting.com/en/tag/security) [Digitalization](https://blog.src-consulting.com/en/tag/digitalization) 1 Min Read ### [Part 2: Protection needs analysis](https://blog.src-consulting.com/en/information-security/protection-needs-analysis) [Dr. Jaber Kakar 12/10/21 3:30 PM](https://blog.src-consulting.com/en/author/jaber-kakar) [![](https://blog.src-consulting.com/hubfs/HubSpot%20website/Blog-Pt_05-02.png)](https://blog.src-consulting.com/en/information-security/risk-analysis) [Compliance](https://blog.src-consulting.com/en/tag/compliance) [Security](https://blog.src-consulting.com/en/tag/security) [Digitalization](https://blog.src-consulting.com/en/tag/digitalization) 1 Min Read ### [Part 5: Risk analysis based on the risk inventory](https://blog.src-consulting.com/en/information-security/risk-analysis) [Dr. Jaber Kakar 3/31/22 4:44 PM](https://blog.src-consulting.com/en/author/jaber-kakar) [![IT Governance - Information security protection goals](https://blog.src-consulting.com/hubfs/Blog-01-2.png)](https://blog.src-consulting.com/en/information-security/protection-goals-of-information-security) [Security](https://blog.src-consulting.com/en/tag/security) [CIA triad](https://blog.src-consulting.com/en/tag/cia-triad) 4 Min Read ### [Information security protection goals](https://blog.src-consulting.com/en/information-security/protection-goals-of-information-security) [Dr. Jaber Kakar 1/6/22 5:37 PM](https://blog.src-consulting.com/en/author/jaber-kakar) ![SRC-logo_white](https://blog.src-consulting.com/hubfs/HubSpot%20website/SRC-logo_white.svg) Your enabler in security, risk and compliance [Follow us on LinkedIn](https://www.linkedin.com/company/security-risk-compliance/) [Follow us on Twitter](https://twitter.com/SrcGmbh) [Follow us on Facebook](https://www.facebook.com/ConsultingBySRC/) [Read our posts on Medium](https://src-security.medium.com/) Copyright by SRC Security Risk Compliance GmbH © 2022 - [Privacy policy](https://www.src-consulting.com/en/datenschutzerklaerung) - [Imprint](https://www.src-consulting.com/en/impressum)