August 2026
All 31 isidaten articles from August 2026.
Three days before the deadline
On 8 September we are at DIGITAL X in Cologne, all three founders. Three days later the first binding obligation of the Cyber Resilience Act takes effect. And anyone who sat at our table in July would have seen a different product.
Read more
A threat is not a hazard
Basic Terms, part 1: threat, vulnerability, hazard and risk build on one another in IT-Grundschutz and mean four different things. Plus the term the BSI abolished in 2017 that almost everyone still uses.
Read more
The NDA obligation stays open
Ticking the "NDA required" box gets nothing done. Until a signature is recorded, the project keeps flagging the party as open. Why that is the whole point, and why a rejected security approval is worth more than an empty field.
Read more
The worst clause wins
Four of five sub-clauses met does not add up to eighty percent, it takes the status of the fifth. Why the standards cockpit deliberately does not average, what the middle value "partial" achieves, and why a justified exclusion is evidence in itself.
Read more
One VM, three witnesses
The hypervisor sees the virtual machine, so does the network scan, so does the software scan. Fail to merge them and it sits in your inventory three times, with an asset count that depends on how many scanners you run rather than how many machines you have.
Read more
Maintained twice is wrong once
The main process shows not a single link, although it is plainly critical. Everything sits on the sub-processes. Why maintaining things twice is the worse answer, and how a process can display links without owning them.
Read more
The old device checks in too
In a notebook replacement the old device checks in just as reliably as the new one. Ask a rollout's success verification only whether there was contact and every target comes back yes. Why the check hangs on the completion timestamp and why a failure never demotes.
Read more
Old does not mean exempt
The Cyber Resilience Act applies from December 2027, and existing products are spared until then. For the reporting duty starting 11 September, exactly that does not hold: a separate paragraph explicitly withdraws the exemption.
Read more
Four times twenty is sixty
A room with four 20 kW cooling units does not carry 80 kW redundantly, but 60. Each unit may still be labelled N+1. The label is a promise, the arithmetic is reality.
Read more
The metric counts, not the number
A hundred installations are not a hundred licences. They are a hundred, twelve or none, depending on how the vendor counts. Deriving a licence position from an installation list answers the wrong question.
Read more
Not operable, not completed
A mandatory training with a 98 percent completion rate looks good. It says nothing about the missing two percent. Whoever could not operate the training appears in the report exactly like someone who did not want to.
Read more
The stopgap becomes a fixture
WiBA looked like an entry aid for small municipalities, to be swapped later for the real thing. The BSI has since decided otherwise: the checklists become a fixture of the successor to the IT-Grundschutz-Kompendium.
Read more
There is no good reason for that
Every security alert starts with the same question: was that one of us? A decoy answers it in advance. It has no operational purpose, so there is no harmless explanation for using it.
Read more
Non-binding, but machine-readable
The BSI has published TR-03183-1 in version 1.0.0: an entry aid into the Cyber Resilience Act, without presumption of conformity. The most interesting part sits at the margin: the selection of measures also comes in the machine-readable OSCAL format, though only on request.
Read more
Fine alone, critical together
The severity of a cloud misconfiguration comes from the catalog. But the catalog does not know the resource the check fired on. How we resolved that, and why a single risk factor raises nothing.
Read more
How would you notice?
For every attack technique the usual question is: do we have a control? The more uncomfortable question is about visibility. MITRE ATT&CK answers it, and we have now made that answer importable.
Read more
Required to delete, not allowed to
The retention period has expired but proceedings are still running. Three mechanisms govern this, and they get confused constantly: the period says when, sealing says do not change, the hold says do not delete.
Read more
An answer proves nothing at all
In March, NIST reissued its DNS deployment guide after thirteen years. We built the checks from it and learned along the way how easily a DNS test measures the wrong thing.
Read more
We can seal it, not open it
Emergency plans usually sit in exactly the system that is gone when it matters. Our new emergency kit therefore starts from an uncomfortable assumption: in an emergency, the platform itself is the compromised side.
Read more
The duty that already applies
With the Data Act, everyone points to 12 September 2026. Treating that as the starting gun misses two things: strictly speaking the cut-off is the day after, and the practically most useful duty has applied for a year already.
Read more
When both sides are right
A document sits in the e-file and in the ISMS. As long as only one side changes, reconciliation is easy. When both change, someone has to decide, and no tool can make that call in general.
Read more
Not clean, just unknown
A patch report usually knows two states: patched or gap. The third one is missing and quietly gets counted as the first: devices that were never surveyed. Why that deserves a field of its own, and what follows for distribution.
Read more
Whoever watches is watched
Remote support is the most far-reaching access in IT operations. It requires works council co-determination not because anyone intends to monitor, but because the tool could. Which is why our remote support module ships locked.
Read more
Non-conformant is a permitted answer
The accessibility statement is the only compliance document that has to name your own shortcomings in public. There are three conformance levels, and the worst one is permitted. What is missing is not the excuse but the substance behind it.
Read more
Two questions to ask a backup
Did the backup run? And where is it written that it had to run, how long copies are kept and whether anyone can still alter them? Those are two questions for two audiences. What the Cohesity connector therefore writes to two separate places, and where it deliberately writes nothing at all.
Read more
Exploitable is not exploited
On 11 September the reporting duty under the Cyber Resilience Act takes effect, two years before the regulation applies in full. 24 hours from awareness. But awareness of what exactly? The regulation distinguishes three kinds of vulnerability, and only the third triggers a report.
Read more
The law changes quietly
On 24 July the EU amended the AI Act. We noticed the change and still cited the wrong provision. What that mistake reveals about the level at which a legal register has to operate.
Read more
Forwarded is not reported
The click rate measures who fails. The report rate measures who protects. But then the reporting path has to be worth something, and forwarding is not just forwarding: the ordinary inline forward loses exactly the data needed to assess the mail.
Read more
How do you measure people without surveilling them?
Computing a human risk index is technically trivial, the data has long been there. The hard part is what you may do with it afterwards. Why the defaults are the real statement in this metric, and what a minimum group size is for.
Read more
Deferred is not suspended
Today the EU AI Act becomes generally applicable. The high-risk obligations everyone talks about, however, were deferred to December 2027 at the end of July. What remains affects almost everyone: the transparency duties under Article 50.
Read more
99.9 percent of what?
An availability figure without a definition is an opinion. What counts as an outage, whether an HTTP 200 proves anything at all, and how maintenance windows enter the calculation shape the number more than the technology behind it.
Read more