In the first part of this thesis, Austrian universities of applied sciences were asked about their security structure (eg established security roles) and the defined security systems (eg Business Continuity Management). In the second part of this thesis, the risk assessment of universities of applied sciences in Austria was carried out on the basis of defined safety-related scenarios by senior technical college staff as well as by external security experts and compared with each other in order to show differences between the two risk matrixes. In the third part of this thesis, the cost factors of security-related incidents in the past 10 years were surveyed and compared with the cost estimates of the external security experts.