Latest from isidaten
Stay informed about the latest developments in data protection and information security.
New here every day. Follow along: RSS-Feed · LinkedIn · X
Looking for a specific date? The compliance calendar lists deadlines and events, each with its legal source.
The data protection officer has left, the supervisory authority still has his name
The appointment was in the file, the notification to the supervisory authority went out four years ago, the website still shows the old address. Then the person changes, and none of the three places finds out. What Art. 37 GDPR and IT-Grundschutz require for officers, and why an appointment only becomes a problem when it ends.
Read more
To the ones who say "we do not know" in the crisis exercise
Quiet work, part 3: twenty minutes into the crisis exercise, the head of the crisis team asks whether the backups are affected. Someone at the table says no, because it has always been that way. And then someone else says: "We do not know." Why that sentence makes the exercise a success and where BSI Standard 200-4 calls for it.
Read more
A/B is only redundant when each side carries the load alone
Machine room, part 3: two power rails, two strips per rack, every server with two power supplies. On the plan, that is redundant. Whether it really is depends on three things: the load on each side, where A and B join, and the devices whose second power supply is plugged into the same strip. What IT-Grundschutz says about it and how to check.
Read more
Filed on the intranet is not made known
The IT usage policy is approved, it is on the intranet, and a circular email pointed to it. In an audit, that is not enough. IT-Grundschutz requires new staff to confirm the policy before they use IT, and everyone to confirm it again after major changes. The intranet is the place to read it, not the evidence.
Read more
Drop the forced password change, and you have to detect leaks
Many organisations have dropped the 90-day password change, with the BSI on their side. IT-Grundschutz attaches a condition, though: whoever no longer forces changes by the calendar has to detect when a password is compromised. Where that knowledge can come from, and what has to happen next.
Read more
Whoever finds a flaw needs an address
A security researcher finds a vulnerability in your product and looks for a contact. She finds the legal notice, info@ and a chatbot. From December 2027, the Cyber Resilience Act requires a contact address for vulnerability reports and a policy on coordinated disclosure. The security.txt per RFC 9116 is where researchers look first, and it goes stale silently.
Read more
A Grundschutz check is not an audit
Basic terms, part 7: "We had an audit in spring." Often it was an IT-Grundschutz check that the information security officer carried out with the responsible staff. That is valuable, but something else. BSI Standard 200-2 distinguishes three kinds of review: the check as a target/actual comparison, the IS audit as a regular review of effectiveness, and the audit by independent bodies. Who reviews, against what, and with what consequence.
Read more
Evidence does not belong in an email attachment
Before the audit comes the request list, and then exports, ZIP files and sharing links go to the audit body. After the audit, nobody knows where the copies are, which version was presented or who saw it. IT-Grundschutz module DER.3.1 requires the opposite: auditors do not intervene, access is withdrawn afterwards, and only authorised people can reach the documents.
Read more
To the ones who still report the phishing suspicion at 5:55 pm
Quiet work, part 2: Friday, shortly before closing time, a click on a link that feels wrong. Two options: close the laptop and hope, or call and say you may have clicked something. Why the second is often the earliest detection an organisation gets, where IT-Grundschutz requires it, and why it is so rarely thanked.
Read more
A data centre for the BSI, not for the Energy Efficiency Act
Machine room, part 2: three racks in the basement, forty kilowatts, "we don't have a data centre". For the German Energy Efficiency Act that is true, because it counts kilowatts and starts at 300. IT-Grundschutz counts something else: importance for the organisation's tasks. On that basis, the only central server room is generally to be treated like a data centre. Two definitions, two different answers to the same question.
Read more
A list of findings is not yet a priority
The scanner reports four thousand vulnerabilities, the penetration test forty findings, the attack surface analysis a dozen exposed services. Every list is correct, together they cannot be worked through. German law does not require working through them, but managing vulnerabilities and evaluating effectiveness. Why sorting by CVSS is not enough for that and what continuous threat exposure management does differently.
Read more
When your supplier shows up on a leak site
Ransomware groups publish the names of their victims, often before those victims' customers hear about it. If your payroll provider or cloud provider is listed there, an assessment begins for you that you cannot afford to wait out. What the GDPR requires of the processor, when your own deadline starts and which four questions should be answered in the first hour.
Read more
Forensics starts before the incident
After an attack, management, insurers and supervisors ask how the attacker got in. Whether there is an answer is often decided in the first hour, usually by a well-meant reboot. The BSI module DER.2.2 therefore makes three things a basic requirement that must be done before the incident: legal clarification, a guide for initial measures and a forensics provider selected in advance.
Read more
A requirement is not a measure
Basic terms, part 6: "Has the measure been implemented?" Someone from IT-Grundschutz means something different by that than someone working to ISO 27001. The BSI Kompendium cleanly separates module, requirement and measure: what is being secured, what must be fulfilled and how it is fulfilled in your organisation. In the German ISO version, however, the control is called "Maßnahme" (measure). The same word, two levels.
Read more
A metric without a calculation method measures nothing
In clause 9.1, ISO 27001 does not simply ask for metrics but for decisions: what is measured, by which method, when, by whom, and who evaluates the results. The method should produce comparable and reproducible results. Why many security metrics fail exactly there, and how to recognise a number that only counts activity.
Read more
To the ones who test the restore
Quiet work, part 1: a backup that reports green every night says nothing about whether anything can be brought back from it. Only someone who tries knows, on a Tuesday afternoon, without cause and without an audience. Why IT-Grundschutz requires exactly that as a basic requirement, and why hardly anyone notices it anyway.
Read more
A PUE from the data sheet is not a measurement
Machine room, part 1: from 1 July 2027 a statutory PUE limit applies to existing data centres in Germany, as an annual average. Many have a PUE, but often from the data sheet, from rated power or from a cool day in February. What the Energy Efficiency Act means by the metric, where it can be flattered, and why the amendment does not change that.
Read more
An audit date is not yet an audit programme
Many internal ISO 27001 audits are a date in November, shortly before the surveillance audit, carried out by the person who also runs the ISMS. Clause 9.2 of the standard asks for something else: a programme that derives frequency and scope from the importance of the processes and the results of previous audits, and auditors who are objective and impartial. What that means in practice in a small organisation.
Read more
The standard does not start at Annex A
In many organisations ISO 27001 means "the 93 controls". Annex A, however, is only the list against which you check your own risk treatment. What gets certified is the management system in clauses 4 to 10: context, scope, leadership, risks, objectives, audit, management review. Why that is exactly where the gaps are, and how to tell whether a clause is evidenced or merely ticked.
Read more
Practice shows from the outside
NIS2 requires supply-chain measures to take account of suppliers' cybersecurity practices. A questionnaire provides a self-declaration for that. Whether a supplier secures its mail domain, renews certificates or exposes remote maintenance to the internet, on the other hand, can be seen from outside without asking. What an external rating proves, what it does not, and why "not measured" must never mean "clean".
Read more
A policy is not a guideline
Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.
Read more
Insured, as long as you can prove it
A cyber insurance policy pays for the attack, but only if the policyholder's duties were met: multi-factor sign-in, offline backup, patch deadlines. In case of gross negligence the insurer may reduce payment, and the insured company has to prove otherwise, in the middle of recovery. What Section 28 of the German Insurance Contract Act says, and why the evidence has to exist before the loss.
Read more
The deputy is not a loophole
Reporting deadlines keep running while the responsible person is on leave, so every role needs a deputy. IT-Grundschutz draws a line here that regularly gets crossed in practice: deputies are subject to segregation of duties too. Why the deputy is often the very person who filed the request, and what an approval during an absence has to record.
Read more
Yes to which text?
Article 7 GDPR requires the controller to be able to demonstrate consent. A tick box with a date only proves that someone said yes at some point. The European Data Protection Board asks for more: the information the person saw at that moment. Why the version of the consent text is the actual evidence, and what has to happen after a substantial change.
Read more
Installed is not effective
That endpoint protection is running is in the inventory. Whether it reacts when a thousand files are encrypted on a machine within a minute is written nowhere, until it happens. Section 30 BSIG requires procedures to assess effectiveness. How to check that without bringing malware into the building.
Read more
High times medium is not a number
NIS2 requires measures that are appropriate to the risk "taking into account the cost of implementation". A risk matrix cannot deliver that calculation, because there is no number on either side. What a three-point estimate and 10,000 simulated years make of it, and why the seed matters more than the decimal place.
Read more
Green without evidence
From 27 September 2026, "eco-friendly" without evidence, "climate neutral" via offsetting and labels without certification are on the blacklist of unfair commercial practices. Directive (EU) 2024/825 targets the website, and there usually nobody knows on how many pages "sustainable" appears.
Read more
The server is not the crown jewel
Basic terms, part 4: information domain, target object and asset are treated in everyday practice as the same thing as an inventory. IT-Grundschutz means three different things, and none of them is a device list. Why 3,000 clients can be one target object and the crown jewel is never a system.
Read more
What the agent never does
A service running as SYSTEM on every device is the most powerful piece of software in the building. The isidaten agent appeared in four of the last six articles, always as a tool. This one is about the agent itself: five things it never does, and why a stolen database therefore does not control the fleet.
Read more
Whoever knows the script is not practising
BSI Standard 200-4 allows the exercise lead to play an inject earlier, later or not at all. That only works if the crisis team cannot see the script. What separates a staff exercise from a read-through, which time the standard wants measured, and what a participant page must therefore never show.
Read moreArchive by month
- October 2026 (17)
- September 2026 (31)
- August 2026 (31)
- July 2026 (32)
- June 2026 (7)
- December 2025 (1)
- November 2025 (2)
- July 2025 (2)
- April 2025 (1)
- March 2025 (1)
- February 2025 (1)
Questions about an update?
Talk to us – we are happy to show you the latest features and integrations in a demo.