Glossary term
NIS2
Also: NIS2 Directive, Directive (EU) 2022/2555
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
NIS2 is the second generation of European cybersecurity regulation. It entered into force on 16 January 2023; the EU transposition deadline was 17 October 2024. Germany transposed it via the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), in force since 6 December 2025. The statutory BSI registration deadline was 6 March 2026; the BSI expects outstanding registrations by 31 July 2026 as an enforcement grace period, not as a change to the statutory deadline.
Scope: essential entities (energy, transport, banking, health, drinking water, digital infrastructure, ICT services, public administration, space) and important entities (postal, waste, chemicals, food, manufacturing, digital services, research).
In practice
Core duties: ten Article 21 minimum measures (risk analysis, incident handling, business continuity, supply-chain security, secure procurement and maintenance, effectiveness review, cyber hygiene, cryptography, personnel security, MFA). Reporting deadlines 24 h / 72 h / 1 month. Fines up to 10 M EUR or 2% of turnover. Personal liability of management body.
Related terms
NIS2 Art. 20
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.