July 2026
All 32 isidaten articles from July 2026.
Today's deadline is not in the law
The BSI's grace period for NIS2 registration ends on 31 July. The statutory deadline was 6 March. Why that difference matters, and why the actual obligations never depended on registration in the first place.
Read more
Save the date: isidaten at DIGITAL X in Cologne
On 8 September 2026 we will be at DIGITAL X in Cologne's Rheinauhafen, on Deutsche Telekom's partner floor. And all three founders will be there: the CISO, the data protection and the IT management perspective at one table.
Read more
It is in the contract. Nobody ever checked.
Response time, certificate, incident notification duty, deletion at contract end: security requirements get negotiated once and then never touched again. Why every requirement needs a direction and a form of evidence, and why provided is not a permanent state.
Read more
The passing scan that proves nothing
A green ASV scan says only one thing: nothing critical was found in what was scanned. It says nothing about the real question, namely whether the right things were scanned. Why the scan scope is the assessment point in PCI DSS, and why the chain of quarterly scans counts as much as any single result.
Read more
The biggest data store is a mailbox
No system accumulates as much personal data as an organization's email mailboxes: bank details, ID scans, sick notes, passwords in plain text. Two questions bring this to light, and both arrive under time pressure: what data do you hold about me? And: who is affected by this incident?
Read more
Where the incident arrives first
The first hint of a security incident is rarely an alert. It is a ticket: the computer is slow, the mailbox is locked, an email looked odd. Whether it becomes an incident in time is decided at the service desk, long before any security tool fires. Why helpdesk and security process belong on one platform.
Read more
The chain that must not break
With classified material there is no approximate answer. Who held which document and when, who signed for it, when was it destroyed and who witnessed that? Why in classified information protection the record is not documentation of the work but the work itself, and what that means for a paper-based classified register.
Read more
The binder next to the fire extinguisher
Fire safety is the oldest compliance in the building, and in many organizations it still runs on paper: the fire safety log in a binder, inspection dates on stickers, the marshal quota as an estimate. Why the deadlines here are especially hard to keep track of, and what happens when you manage them like an asset inventory.
Read more
Who sends mail in your name
A phishing mail with your sender address does not hit you, it hits your customers, partners and applicants. Whether that is possible is decided by a handful of DNS records. Why the most common mistake is not a missing DMARC but an existing one that only watches, and what isidaten now checks per domain.
Read more
Two lists nobody reconciles
The data processing agreement and the register of processors describe the same service providers, from two angles. Legally they belong together, in practice they are two separate lists that drift apart. Why exactly this gap surfaces in an audit, and how the register entry can be derived from the contract itself.
Read more
An emergency plan is a sequence, not a list
A recovery plan that merely lists what has to run again helps little in an emergency. Because nothing starts at once: the application needs the database, which needs the network, which needs power. Why sequence and the critical path decide the real recovery time, and why an estimated RTO rarely holds when it counts.
Read more
The break-in that looks like a working day
For the first time in 19 years, stolen credentials are no longer the most common way into a network; exploited vulnerabilities have overtaken them. That sounds like relief for identity security, and it is not: across the full attack chain, credential abuse remains the most pervasive technique. Why a valid login raises no alarm, and only behavior gives it away.
Read more
The certificate nobody renewed
An expired TLS certificate blocks a service for every browser, loudly and instantly. Until now a manageable nuisance, because a certificate lasted about a year. But the CA/Browser Forum is cutting the maximum lifetime in stages from 398 to 47 days. Why manual certificate upkeep reaches its end, and what takes its place.
Read more
Software makes things visible, not secure
Hardly a brochure does without the promise of compliance at the push of a button. But a tool closes no gap, it shows one. Why the honest role of software is that of a mirror, why visibility is the real service, and why a tool that flatters the state fails exactly when it counts.
Read more
§ 39 is every three years. Critical infrastructure is every day.
Healthcare operators of critical infrastructure must regularly prove their IT security, since the NIS2 implementation act under § 39 BSIG and now only every three years. The longer the interval, the larger the gap between two snapshots. Why the B3S catalog only describes the WHAT, the real work sits in the HOW, and how the audit sprint becomes a continuously measured state.
Read more
Security you can show
Every B2B deal now starts with a security questionnaire, and half the questions are always the same. Still, someone answers them by hand every time. Why the questionnaire flood will not go away, why a static security PDF is no answer, and how a trust center handles half the due diligence proactively.
Read more
The reporting office nobody wants used
Since July 2023, companies with 50 or more employees need an internal reporting office. In many organizations this became an email inbox, combined with the quiet hope that nothing ever arrives. Why exactly that defeats the purpose, which deadlines the German Whistleblower Protection Act sets, and why the return channel for anonymous reports is the real crux.
Read more
Deletion is a process, not a button
The GDPR demands deletion, commercial and tax law demand retention, and both apply at the same time. Whoever deletes by gut feeling is guaranteed to violate one of the two duties. Why a deletion concept needs periods per data type, when a period even starts running, and why proving deletion is half the duty.
Read more
Awareness is not measured in attendance
The mandatory training is completed, the attendance rate looks good, the auditor is satisfied. And still, part of the workforce clicks on the next simulated phishing mail. Why attendance rate and click rate tell two different truths, and how simulation, findings and targeted training become a loop instead of a box-ticking exercise.
Read more
Hardening has an expiration date
Anyone can harden once: work through the benchmark, tick it off, done. Then everyday operations arrive, and the configuration drifts, quietly and without bad intent. Why configuration drift is the normal state in the absence of measurement, and how isidaten now checks daily against 28 hardening benchmarks, on Linux directly via OpenSCAP.
Read more
The first AI ransomware walked in through an open door
In early July, Sysdig documented the first ransomware campaign an AI agent ran on its own, from reconnaissance to encryption. The unsettling part is not the AI: entry came through a known vulnerability, a second one from 2021 and default credentials. Why the fundamentals still defend against attackers moving at machine speed.
Read more
IT documentation ends at the rack. Power does not.
Server rooms are often documented down to the last rack unit. But the sub-distribution board in the hallway that the whole rack depends on lives in another world: the electrical binder. The NetBox community has been asking for DIN rails since 2018, most recently classified as out of core scope. isidaten now brings the distribution board into the model.
Read more
Registered is not implemented
On 31 July, the BSI sets the final NIS2 registration deadline. Around 29,500 organizations are affected, a good half have signed up, but only about a third have actually implemented the directive. Why the deadline is about signing up, not about security, and what really counts after 31 July.
Read more
An asset inventory is not a device list
Most asset inventories are really device lists: hostname, IP, serial number. But an auditor rarely asks whether a device exists, they ask who is responsible, where it stands, what software runs and who accesses it. Why an inventory is a web of relationships, and why the most reliable source for it usually already sits in IT operations.
Read more
The most important connector is in nobody's catalog
Vendors advertise hundreds of ready-made integrations. But the one that matters when it counts is for your in-house tool, your legacy system, your niche software, and that one is in no catalog. Why integrability depends on the open interface, not on the length of the connector list.
Read more
Containers in the asset inventory: the platform counts, not the pod
A pod often lives for minutes. Whoever inventories every single one produces noise; whoever leaves the container layer out entirely has a blind spot exactly where production runs. Why the right question is not whether but at which level, and what belongs in the inventory for good.
Read more
The consent banner that sets cookies before anyone clicks
A study of one million websites found in 2025: on roughly 43 percent, tracking cookies run without valid consent. The TDDDG requires the opposite. Why the gap almost always comes down to nobody knowing what their own site really loads, and how to find out.
Read more
Cyber Resilience Act: why the 24-hour reporting duty forces preparation
From 11 September 2026, manufacturers must report actively exploited vulnerabilities within 24 hours, followed by a full notification in 72 hours and a final report in 14 days. The deadlines are not a formality but a test of whether the groundwork is done. What the Cyber Resilience Act really demands and why the real work happens beforehand.
Read more
Why half the CVE list is a waste of time
A scan against one exposed host finds 672 known vulnerabilities, from 2009 to today, critical ones next to scoreless ones. Patching by pure CVSS means chasing the theoretically worst holes instead of the truly dangerous ones. Three questions that turn a CVE into a real risk, and why prioritization without asset context stays blind.
Read more
Everyone is building compliance agents now. The interesting question is who controls them
Within a few weeks, Vanta, Drata and ServiceNow all unveiled AI agents for compliance. At the same time, Gartner expects four in ten companies to scale their autonomous agents back by 2027. A story about a race, an old pattern in new clothes, and three questions to answer before your first agent goes live.
Read more
You don't type an asset inventory, you let it be scanned
A hand-maintained inventory has two flaws: it ages faster than you can type, and it only contains what someone entered. The dangerous part is what was forgotten. Why a living inventory is discovered rather than recorded, and why a single source is never enough.
Read more
The ICT third-party register: the DORA duty that even NIS2-ready firms are unprepared for
DORA has applied since January 2025 and demands more than good contracts: a complete register of all ICT services, linked to functions, criticality and exit plans. Why this goes beyond NIS2 supply-chain work, what a living register looks like, and why contracts alone are not enough.
Read more