Es wird ein Referenzmodell ontologisch sinnvoll organisierter Begriffe der IT-Sicherheit vorgestellt und gezeigt, wie dieses eine Begründung zur systematischen Durchführung von IT-Sicherheitsanalysen liefert. Das Referenzmodell besteht aus vier Ebenen: erstens die vorhandene Welt aus Gütern und Interessenkonflikten mit den bestehenden Systemen und ihren Schwachstellen; zweitens das Potenzial aus Bedrohungen und Sicherheitsanforderungen; drittens das planvolle Vorgehen mit Sicherheitsmaßnahmen zum Schutz von Geschäftszielen; und viertens die aktuellen Ereignisse aus Angriffen, Unfällen und Abwehroperationen. Das Referenzmodell wird in bestehende Verfahren der Sicherheitsanalyse eingeordnet und anhand des Beispiels Online-Banking erläutert

Common Criteria and ISO 27001/IT-Grundschutz are well acknowledged evaluation standards for the security of IT systems and the organisation they are embedded in. These standards take a technical point of view. In legally sensitive areas, such as processing of personal information or online voting, compliance with the legal specifications is of high importance, however, for the users’ trust in an IT system and thus for the success of this system. This article shows how standards for the evaluation of IT security may be integrated with the KORA approach for law compatible technology design to the benefit of both – increasing confidence IT systems and their conformity with the law on one hand and a concrete possibility for legal requirements to be integrated into technology design from the start. The soundness of this interdisciplinary work will be presented in an exemplary application to online voting.

Common Criteria and ISO 27001/IT-Grundschutz are well acknowledged evaluation standards for the security of IT systems and the organisation they are embedded in. These standards take a technical point of view. In legally sensitive areas, such as processing of personal information or online voting, compliance with the legal specifications is of high importance, however, for the users' trust in an IT system and thus for the success of this system. This article shows how standards for the evaluation of IT security may be integrated with the KORA approach for law compatible technology design to the benefit of both – increasing confidence IT systems and their conformity with the law on one hand and a concrete possibility for legal requirements to be integrated into technology design from the start. The soundness of this interdisciplinary work will be presented in an exemplary application to online voting.