identification of important assets;
conducting a risk analysis based on major threat scenarios, vulnerability of each asset, and potential impact; and
identification, selection and prioritisation of counter-measures and procedures with a distinction between:
permanent security measures, which identify indispensable security investments and means which are relevant to be employed at all times. This heading will include information concerning general measures such as technical measures (including installation of detection, access control, protection and prevention means); organisational measures (including procedures for alerts and crisis management); control and verification measures; communication; awareness raising and training; and security of information systems,
graduated security measures, which can be activated according to varying risk and threat levels.