This diploma work is based on a market study of the IT Security situation in small and medium business enterprises (SME). There is a huge need for professional assistance concerning IT Security in those companies. It is the goal of this paper to provide an IT Security service portfolio which is useful for a consultant or a consulting company. Our business partner was GO OUT Production GmbH, which might use our concept to consult SME in dealing with their IT Security problems.

Shortly put, we developed an IT Security consulting concept for SME.

We began our work focussing on planning and creating this consulting service. We developed a concept for a Security audit, which is divided into six sections:

1. Start-up
2. Analysis
3. Evaluation
4. Presentation
5. Implementation
6. Maintenance

Then we kept developing this concept and started to create the necessary tools and aids. The main tools represent an extensive catalog of questions for the analysis section and the safety guidelines for the evaluation process. Besides that we looked for a test customer, in order to prove the usability of the developed concepts.

On October 11th 2002 we accomplished a test audit in a medium sized enterprise in Zurich. As a result we developed a specific catalog of measures and integrated this into a report for the test customer. The experiences won in this test audit flowed into the advancement of the concepts and aids.

This work showed that, in order to reach a reasonable safety level in a KMU, the majority of efforts has to lay within the organizational range of measures, because particularly this range is mostly neglected. Therefore the emphasis of this work clearly laid on the interview with the administrator in the analysis section and the safety guidelines in the evaluation process.