September 2026
All 31 isidaten articles from September 2026.
An audit date is not yet an audit programme
Many internal ISO 27001 audits are a date in November, shortly before the surveillance audit, carried out by the person who also runs the ISMS. Clause 9.2 of the standard asks for something else: a programme that derives frequency and scope from the importance of the processes and the results of previous audits, and auditors who are objective and impartial. What that means in practice in a small organisation.
Read more
The standard does not start at Annex A
In many organisations ISO 27001 means "the 93 controls". Annex A, however, is only the list against which you check your own risk treatment. What gets certified is the management system in clauses 4 to 10: context, scope, leadership, risks, objectives, audit, management review. Why that is exactly where the gaps are, and how to tell whether a clause is evidenced or merely ticked.
Read more
Practice shows from the outside
NIS2 requires supply-chain measures to take account of suppliers' cybersecurity practices. A questionnaire provides a self-declaration for that. Whether a supplier secures its mail domain, renews certificates or exposes remote maintenance to the internet, on the other hand, can be seen from outside without asking. What an external rating proves, what it does not, and why "not measured" must never mean "clean".
Read more
A policy is not a guideline
Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.
Read more
Insured, as long as you can prove it
A cyber insurance policy pays for the attack, but only if the policyholder's duties were met: multi-factor sign-in, offline backup, patch deadlines. In case of gross negligence the insurer may reduce payment, and the insured company has to prove otherwise, in the middle of recovery. What Section 28 of the German Insurance Contract Act says, and why the evidence has to exist before the loss.
Read more
The deputy is not a loophole
Reporting deadlines keep running while the responsible person is on leave, so every role needs a deputy. IT-Grundschutz draws a line here that regularly gets crossed in practice: deputies are subject to segregation of duties too. Why the deputy is often the very person who filed the request, and what an approval during an absence has to record.
Read more
Yes to which text?
Article 7 GDPR requires the controller to be able to demonstrate consent. A tick box with a date only proves that someone said yes at some point. The European Data Protection Board asks for more: the information the person saw at that moment. Why the version of the consent text is the actual evidence, and what has to happen after a substantial change.
Read more
Installed is not effective
That endpoint protection is running is in the inventory. Whether it reacts when a thousand files are encrypted on a machine within a minute is written nowhere, until it happens. Section 30 BSIG requires procedures to assess effectiveness. How to check that without bringing malware into the building.
Read more
High times medium is not a number
NIS2 requires measures that are appropriate to the risk "taking into account the cost of implementation". A risk matrix cannot deliver that calculation, because there is no number on either side. What a three-point estimate and 10,000 simulated years make of it, and why the seed matters more than the decimal place.
Read more
Green without evidence
From 27 September 2026, "eco-friendly" without evidence, "climate neutral" via offsetting and labels without certification are on the blacklist of unfair commercial practices. Directive (EU) 2024/825 targets the website, and there usually nobody knows on how many pages "sustainable" appears.
Read more
The server is not the crown jewel
Basic terms, part 4: information domain, target object and asset are treated in everyday practice as the same thing as an inventory. IT-Grundschutz means three different things, and none of them is a device list. Why 3,000 clients can be one target object and the crown jewel is never a system.
Read more
What the agent never does
A service running as SYSTEM on every device is the most powerful piece of software in the building. The isidaten agent appeared in four of the last six articles, always as a tool. This one is about the agent itself: five things it never does, and why a stolen database therefore does not control the fleet.
Read more
Whoever knows the script is not practising
BSI Standard 200-4 allows the exercise lead to play an inject earlier, later or not at all. That only works if the crisis team cannot see the script. What separates a staff exercise from a read-through, which time the standard wants measured, and what a participant page must therefore never show.
Read more
Page two looks clean
Active Directory answers every search with at most 1,000 objects. Whoever does not page on checks the first 1,000 accounts and takes the rest for clean. Why a hardening report has to say what it did not see, and what that means for score, maturity and the BSI module APP.2.2.
Read more
One level, seven numbers
"What security level does your production have?" The honest answer is neither 2 nor 3. IEC 62443 has four levels, seven foundational requirements and three letters, and only together do they make a statement. What sits behind the vector, and why the controller never appeared on any vulnerability list.
Read more
The second bill of materials
By now everyone knows the software bill of materials; the Cyber Resilience Act requires it. Hardly anyone knows the second one: which cryptographic algorithms run where. Since 2024 there has been a format for it, and in isidaten three ways to fill it.
Read more
One incident, two clocks
Since March an operator of critical installations has two supervisory files: one for cybersecurity with the BSI and one for physical protection with the BBK. Both demand reports within 24 hours. After that they count differently, and whoever runs both off one calendar entry misses one.
Read more
Core is not the middle
Basic terms, part 3: basic, core and standard safeguarding are drawn as a staircase in almost every presentation. BSI Standard 200-2 describes something else: three approaches for three situations, on two axes. Anyone who takes core safeguarding for the middle step underestimates it.
Read more
This time the grandfathering holds
On 10 September an obligation began that also covers products sold long ago. On 12 September one begins that covers only new ones. Two regulations, the same week, opposite transitional rules. What that means for the next tender.
Read more
What exactly did you approve?
Section 38 BSIG puts the management body personally on the hook. The approval of measures is usually minuted as a resolution: date, subject, done. Two years later that is exactly the question nobody can answer any more.
Read more
Grandfathering stops at reporting
Everyone knows 11 December 2027 for the Cyber Resilience Act. The date that matters is 11 September 2026: that is the day the manufacturers' reporting obligations begin. And unlike the rest of the regulation, they come with no grandfathering.
Read more
Whoever nods has three spreadsheets
We travelled to DIGITAL X in Cologne with a question rather than a demo. What that changes about a trade fair day, and why the answer is usually on someone's face before they say anything.
Read more
Nine dimensions, one number
A risk analysis ends in a number. The matrix, the priority and the measure all follow from it. What it does not say is what kind of damage is meant. Why the maximum principle stays the default and a weighted average is a decision you have to justify.
Read more
Half a year of green
A device with no findings and a device with no configuration look identical on a dashboard. That error ran for half a year in our own agent. What we built so the next one shows up within a week.
Read more
How bad is not how fast
Basic terms, part 2: protection needs assessment and business impact analysis both ask about damage, but about different damage. One has no clock, the other lives by it. Why the BSI itself warns against merging them, and what separates normal operation from emergency operation.
Read more
Four minutes, six solutions
On 8 September we will be at DIGITAL X in Cologne, in the Startup Harbour along the Rhine promenade. Three times a day there is business speed dating: six solutions in thirty minutes, four minutes per provider, no registration. What we show in those four minutes.
Read more
Keeping is not contacting
After a trade fair the contacts are there, and the question is usually whether you may keep them. That is the easier half. Why the GDPR permits storage, why German unfair-competition law still blocks the marketing email, and why the B2B relief is missing exactly there.
Read more
There is no expiry date for .de
DENIC publishes neither expiry date nor transfer lock for .de domains, while the registry returns both for .com. What that means for renewal reminders, and why an empty date field deliberately triggers no due date but is counted as a gap of its own.
Read more
The locking system only knows today
Who can unlock a door today is in the system. Who could yesterday, and why that ended, is not. Why a withdrawn authorisation is revoked rather than deleted, and why a deleted record proves nothing in an audit.
Read more
Microsoft is not a cloud service
One line in the supplier directory does not answer the cloud question: Exchange Online, Teams and Entra ID are three services with different data locations and exit routes. Why OPS.2.2 requires a reference object per service, and what a rehearsal date on the exit achieves.
Read more
A device list is not a network diagram
The inventory knows four hundred devices and not a single connection. Edges do not live in the inventory but in the devices' own neighbour tables. Why an SNMP query alone is not enough, and what an import fundamentally cannot deliver.
Read more