Security management at Deutsche Telekom
"Security creates trust": Governing internal security at Deutsche Telekom through a holistic, convergent, integrated, risk-oriented, and collaborative approach.
As part of the Technology & Innovation (V TI) Board department, the Security function provides strategic governance for the Group across all security areas—from data, information, and cybersecurity to physical and personnel security, abuse detection, and Business Continuity Management—through a holistic, convergent, and integrated approach to security management. Our Group Security Strategy sets out this approach. It is derived from the Group strategy and contributes to it. To make its success resilient, Deutsche Telekom effectively protects its business with innovative security solutions. Looking ahead to the challenges of the next three to five years, the Security Strategy outlines and analyzes the anticipated challenges Telekom faces across eight areas and sets objectives. It also defines specific approaches to each challenge through strategic measures.
The DT Security Governance Model guides and provides an implementation framework for managing security across the Group for security leaders in all Group entities worldwide. Central business partners support their security work, helping ensure an appropriately high level of security across the Group.
Based on the Governance Model and the security strategy, annual strategic focus areas are defined in line with the security risk landscape, strategic business projects, and future trends. These form the core of the annual security programs developed by security leaders in the Group entities and at the overall Group level, resulting in the Group Security Program for a given year.
To help ensure appropriate security levels across the Group, the comprehensive Group Security Policy is based on international security standards—particularly the ISO 27000 series, to which we are also certified. In line with our holistic understanding of security and the converging, interdependent relationships and impacts across all security topics, it sets out Group-wide requirements for every area of security, including data, information, IT/network technology, & cybersecurity; physical and personnel security; and business continuity, emergency, and crisis management. It also covers investigations and abuse detection. In addition, it defines the fundamental roles and responsibilities across the Group, as well as key requirements for the Information Security Management System (ISMS), Business Continuity Management System (BCMS), and Enterprise Security Risk Management System (ESRM). On this basis, these systems are systematically established and sustainably implemented in the Group entities. The Group Security Policy has been put into effect in all Group entities by the relevant management bodies.
As part of our Security Control Framework, all security owners use a web-based self-assessment to assess their security maturity levels based on the COBIT model and evaluate prioritized security risk scenarios. We consolidate the results in the Group Security Risk Map, update them regularly, and analyze them to identify appropriate improvement measures and risk mitigation measures. This is also an established part of Group risk management in accordance with the Group-wide risk management process. We conduct sample-based security reviews (Security Audits) to verify the results of the self-assessments and provide support for appropriate improvement measures.
To help ensure and assess security awareness across the Group, we regularly conduct an online Security Awareness survey using a representative sample of around 30 percent of Group employees.
The annual Global Telekom Security Conference serves as the central platform for the strategic alignment of the Group-wide Security Community. Its broad range of topics spans societal and political contributions from government and business, strategic Group priorities, and best-practice contributions from Group units.
In addition, the Security Community’s virtual collaboration takes place primarily on the Group-wide Intranet through the „International Security“-Group - a major specialist community in the Group with more than 600 active members. This supports and encourages shared dialogue and the ongoing advancement of security at Deutsche Telekom across national borders.
