October 2026
All 22 isidaten articles from October 2026.
A forgotten server still draws power
Machine room, part 4: almost every server room has a device that nobody needs any more and nobody wants to switch off. It draws power, has to be cooled and occupies rack units. What the Energy Efficiency Act requires, why switching off fails on ownership, and how to find ghost servers without hitting a production server.
Read more
The lift emergency call has to move before the 2G network goes
The three German network operators will switch off 2G in 2028, Telekom expected on 30 June. Anyone operating a lift must ensure that the emergency call in the car can reach an emergency service at all times. If it relies on a 2G module, that ends with the shutdown. What needs to be clarified now.
Read more
At 47 days, nobody renews by hand any more
Since March 2026, public TLS certificates may be valid for at most 200 days, from March 2027 for 100 and from March 2029 for only 47. What the CA/Browser Forum schedule means for operations, which systems become the problem, and what should be done before the 100 days apply.
Read more
The first letter from the BSI is a hearing
The BSI has announced that it will start enforcing NIS2 in the fourth quarter of 2026. It will first approach entities that obviously should have registered, and the first step is a hearing, not a fine. What the BSI Act provides for, what follows from 2027, and what should be prepared before the letter arrives.
Read more
An attestation is not a certificate
Basic terms, part 8: The supplier questionnaire says "ISO 27001 certified", "C5 attestation", "BSI-tested" or "accredited". Four answers that sound alike and mean different things. Who checks, who checks the checker, and what ends up on paper: certification, accreditation and attestation, with the passages from EU law, the BSI Act and the BSI's C5.
Read more
The data protection officer has left, the supervisory authority still has his name
The appointment was in the file, the notification to the supervisory authority went out four years ago, the website still shows the old address. Then the person changes, and none of the three places finds out. What Art. 37 GDPR and IT-Grundschutz require for officers, and why an appointment only becomes a problem when it ends.
Read more
To the ones who say "we do not know" in the crisis exercise
Quiet work, part 3: twenty minutes into the crisis exercise, the head of the crisis team asks whether the backups are affected. Someone at the table says no, because it has always been that way. And then someone else says: "We do not know." Why that sentence makes the exercise a success and where BSI Standard 200-4 calls for it.
Read more
A/B is only redundant when each side carries the load alone
Machine room, part 3: two power rails, two strips per rack, every server with two power supplies. On the plan, that is redundant. Whether it really is depends on three things: the load on each side, where A and B join, and the devices whose second power supply is plugged into the same strip. What IT-Grundschutz says about it and how to check.
Read more
Filed on the intranet is not made known
The IT usage policy is approved, it is on the intranet, and a circular email pointed to it. In an audit, that is not enough. IT-Grundschutz requires new staff to confirm the policy before they use IT, and everyone to confirm it again after major changes. The intranet is the place to read it, not the evidence.
Read more
Drop the forced password change, and you have to detect leaks
Many organisations have dropped the 90-day password change, with the BSI on their side. IT-Grundschutz attaches a condition, though: whoever no longer forces changes by the calendar has to detect when a password is compromised. Where that knowledge can come from, and what has to happen next.
Read more
Whoever finds a flaw needs an address
A security researcher finds a vulnerability in your product and looks for a contact. She finds the legal notice, info@ and a chatbot. From December 2027, the Cyber Resilience Act requires a contact address for vulnerability reports and a policy on coordinated disclosure. The security.txt per RFC 9116 is where researchers look first, and it goes stale silently.
Read more
A Grundschutz check is not an audit
Basic terms, part 7: "We had an audit in spring." Often it was an IT-Grundschutz check that the information security officer carried out with the responsible staff. That is valuable, but something else. BSI Standard 200-2 distinguishes three kinds of review: the check as a target/actual comparison, the IS audit as a regular review of effectiveness, and the audit by independent bodies. Who reviews, against what, and with what consequence.
Read more
Evidence does not belong in an email attachment
Before the audit comes the request list, and then exports, ZIP files and sharing links go to the audit body. After the audit, nobody knows where the copies are, which version was presented or who saw it. IT-Grundschutz module DER.3.1 requires the opposite: auditors do not intervene, access is withdrawn afterwards, and only authorised people can reach the documents.
Read more
To the ones who still report the phishing suspicion at 5:55 pm
Quiet work, part 2: Friday, shortly before closing time, a click on a link that feels wrong. Two options: close the laptop and hope, or call and say you may have clicked something. Why the second is often the earliest detection an organisation gets, where IT-Grundschutz requires it, and why it is so rarely thanked.
Read more
A data centre for the BSI, not for the Energy Efficiency Act
Machine room, part 2: three racks in the basement, forty kilowatts, "we don't have a data centre". For the German Energy Efficiency Act that is true, because it counts kilowatts and starts at 300. IT-Grundschutz counts something else: importance for the organisation's tasks. On that basis, the only central server room is generally to be treated like a data centre. Two definitions, two different answers to the same question.
Read more
A list of findings is not yet a priority
The scanner reports four thousand vulnerabilities, the penetration test forty findings, the attack surface analysis a dozen exposed services. Every list is correct, together they cannot be worked through. German law does not require working through them, but managing vulnerabilities and evaluating effectiveness. Why sorting by CVSS is not enough for that and what continuous threat exposure management does differently.
Read more
When your supplier shows up on a leak site
Ransomware groups publish the names of their victims, often before those victims' customers hear about it. If your payroll provider or cloud provider is listed there, an assessment begins for you that you cannot afford to wait out. What the GDPR requires of the processor, when your own deadline starts and which four questions should be answered in the first hour.
Read more
Forensics starts before the incident
After an attack, management, insurers and supervisors ask how the attacker got in. Whether there is an answer is often decided in the first hour, usually by a well-meant reboot. The BSI module DER.2.2 therefore makes three things a basic requirement that must be done before the incident: legal clarification, a guide for initial measures and a forensics provider selected in advance.
Read more
A requirement is not a measure
Basic terms, part 6: "Has the measure been implemented?" Someone from IT-Grundschutz means something different by that than someone working to ISO 27001. The BSI Kompendium cleanly separates module, requirement and measure: what is being secured, what must be fulfilled and how it is fulfilled in your organisation. In the German ISO version, however, the control is called "Maßnahme" (measure). The same word, two levels.
Read more
A metric without a calculation method measures nothing
In clause 9.1, ISO 27001 does not simply ask for metrics but for decisions: what is measured, by which method, when, by whom, and who evaluates the results. The method should produce comparable and reproducible results. Why many security metrics fail exactly there, and how to recognise a number that only counts activity.
Read more
To the ones who test the restore
Quiet work, part 1: a backup that reports green every night says nothing about whether anything can be brought back from it. Only someone who tries knows, on a Tuesday afternoon, without cause and without an audience. Why IT-Grundschutz requires exactly that as a basic requirement, and why hardly anyone notices it anyway.
Read more
A PUE from the data sheet is not a measurement
Machine room, part 1: from 1 July 2027 a statutory PUE limit applies to existing data centres in Germany, as an annual average. Many have a PUE, but often from the data sheet, from rated power or from a cool day in February. What the Energy Efficiency Act means by the metric, where it can be flattered, and why the amendment does not change that.
Read more