The first letter from the BSI is a hearing
The BSI has announced that it will start enforcing NIS2 in the fourth quarter of 2026. It will first approach entities that obviously should have registered, and the first step is a hearing, not a fine. What the BSI Act provides for, what follows from 2027, and what should be prepared before the letter arrives.
Read more
A list of findings is not yet a priority
The scanner reports four thousand vulnerabilities, the penetration test forty findings, the attack surface analysis a dozen exposed services. Every list is correct, together they cannot be worked through. German law does not require working through them, but managing vulnerabilities and evaluating effectiveness. Why sorting by CVSS is not enough for that and what continuous threat exposure management does differently.
Read more
A PUE from the data sheet is not a measurement
Machine room, part 1: from 1 July 2027 a statutory PUE limit applies to existing data centres in Germany, as an annual average. Many have a PUE, but often from the data sheet, from rated power or from a cool day in February. What the Energy Efficiency Act means by the metric, where it can be flattered, and why the amendment does not change that.
Read more
Practice shows from the outside
NIS2 requires supply-chain measures to take account of suppliers' cybersecurity practices. A questionnaire provides a self-declaration for that. Whether a supplier secures its mail domain, renews certificates or exposes remote maintenance to the internet, on the other hand, can be seen from outside without asking. What an external rating proves, what it does not, and why "not measured" must never mean "clean".
Read more
Installed is not effective
That endpoint protection is running is in the inventory. Whether it reacts when a thousand files are encrypted on a machine within a minute is written nowhere, until it happens. Section 30 BSIG requires procedures to assess effectiveness. How to check that without bringing malware into the building.
Read more
High times medium is not a number
NIS2 requires measures that are appropriate to the risk "taking into account the cost of implementation". A risk matrix cannot deliver that calculation, because there is no number on either side. What a three-point estimate and 10,000 simulated years make of it, and why the seed matters more than the decimal place.
Read more
One level, seven numbers
"What security level does your production have?" The honest answer is neither 2 nor 3. IEC 62443 has four levels, seven foundational requirements and three letters, and only together do they make a statement. What sits behind the vector, and why the controller never appeared on any vulnerability list.
Read more
One incident, two clocks
Since March an operator of critical installations has two supervisory files: one for cybersecurity with the BSI and one for physical protection with the BBK. Both demand reports within 24 hours. After that they count differently, and whoever runs both off one calendar entry misses one.
Read more
What exactly did you approve?
Section 38 BSIG puts the management body personally on the hook. The approval of measures is usually minuted as a resolution: date, subject, done. Two years later that is exactly the question nobody can answer any more.
Read more
Today's deadline is not in the law
The BSI's grace period for NIS2 registration ends on 31 July. The statutory deadline was 6 March. Why that difference matters, and why the actual obligations never depended on registration in the first place.
Read more
It is in the contract. Nobody ever checked.
Response time, certificate, incident notification duty, deletion at contract end: security requirements get negotiated once and then never touched again. Why every requirement needs a direction and a form of evidence, and why provided is not a permanent state.
Read more
Where the incident arrives first
The first hint of a security incident is rarely an alert. It is a ticket: the computer is slow, the mailbox is locked, an email looked odd. Whether it becomes an incident in time is decided at the service desk, long before any security tool fires. Why helpdesk and security process belong on one platform.
Read more
IT documentation ends at the rack. Power does not.
Server rooms are often documented down to the last rack unit. But the sub-distribution board in the hallway that the whole rack depends on lives in another world: the electrical binder. The NetBox community has been asking for DIN rails since 2018, most recently classified as out of core scope. isidaten now brings the distribution board into the model.
Read more
Registered is not implemented
On 31 July, the BSI sets the final NIS2 registration deadline. Around 29,500 organizations are affected, a good half have signed up, but only about a third have actually implemented the directive. Why the deadline is about signing up, not about security, and what really counts after 31 July.
Read more
Data center documentation that doesn't lie: why static plans fail
Every data center has a nice diagram that was correct the day it was drawn and has aged ever since. The moment someone swaps a server, repatches or a device fails, the documentation lies. Why static plans fail systematically, what living documentation changes, and why the data center inventory is also compliance substance.
Read more
Supply chain risk: responsibility does not end at your firewall
Your own security level is only as high as that of your service providers. Yet many organizations treat supplier review as a one-time questionnaire that gets filled in and forgotten. NIS2 turns it into a continuous obligation. isidaten manages suppliers, contracts and processors as traceable objects instead of an Excel silo.
Read more
Attack surface management: you can't protect what you can't see
The way into a network is rarely the spectacular zero-day. More often it is the forgotten asset nobody had on their radar anymore. isidaten makes the attack surface continuously visible from outside and inside, and matches it automatically against current vendor advisories.
Read more
NIS2: The first audit evidence is due, and why it shouldn't be a deadline
Around 30 June 2026 the first NIS2 evidence becomes due for many affected entities. Scrambling for proof at the deadline doesn't solve the real problem. Why evidence should be a state, not a one-off effort.
Read more