Glossary term
HSM / KMS
Also: Hardware Security Module, Key Management System
HSM = tamper-resistant hardware for cryptographic operations (FIPS 140-2/3, Common Criteria). KMS = software layer for key management, often with an HSM backend. Mandatory components for regulated encryption.
HSM classes: network HSM (Thales Luna, Entrust nShield, Utimaco), cloud HSM (AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM), USB HSM. Important: FIPS 140-2 Level 3 or higher for regulated workloads.
Cloud KMS: AWS KMS, Azure Key Vault, Google Cloud KMS. Bring-Your-Own-Key (BYOK) allows import of a customer key. Hold-Your-Own-Key (HYOK) keeps the master key with the customer; cloud KMS cannot decrypt.
In practice
Audit cases: BAIT BTO 5 (cryptography), DORA Art. 9 (ICT security measures), NIS2 Art. 21 (h) (cryptography), BSI TR-02102 (cryptographic guidance). Key sovereignty and rotation discipline are classic audit focal points.
Related terms
BYOK / HYOK (Bring/Hold Your Own Key)
Schlüssel-Management-Modelle in Cloud-Umgebungen: BYOK bedeutet, der Kunde bringt seinen eigenen Schlüssel in den Cloud-KMS ein. HYOK bedeutet, der Schlüssel verlässt nie die Kunden-Infrastruktur, nur die Operationen werden bei Bedarf an den KMS delegiert.
Sovereign cloud
A cloud deployment model that guarantees operational, legal and technical control of data and workloads within a specific jurisdiction (typically the EU). Sovereign cloud answers the concern that hyperscaler deployments remain exposed to foreign jurisdiction, primarily the US CLOUD Act.
Confidential Computing
Hardware-based isolation that keeps data encrypted during processing (data-in-use). Complements encryption at rest and in transit. Technologies: Intel SGX, Intel TDX, AMD SEV-SNP, ARM CCA, Nvidia H100 Confidential Computing.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.