Glosario

A

Aktiv ausgenutzte Schwachstelle

CRA term: a vulnerability for which there is reliable evidence that it has been exploited by a malicious actor. Triggers the reporting obligation under Art. 14 CRA. Más información: CRA

Assessment-Level

Depth of the TISAX check: AL1 self-assessment only without a label, AL2 plausibility check with evidence and interviews, usually remote, AL3 comprehensive check on site. The label determines which level is needed. Más información: TISAX

AV/AVV (Data processing / Data processing agreement)

If a service provider processes personal data on your behalf, a contract under Art. 28 GDPR is required. Among other things, it governs being bound by instructions, sub-processors and TOMs. Más información: RGPD

B

BBK (Federal Office of Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe))

Central point of contact and competent authority under the KRITIS-DachG for the physical resilience of critical facilities. Operators register their critical facilities via a joint registration facility of the BBK and BSI. Más información: Ley marco KRITIS

BCM (Business Continuity Management)

Planning and practising how critical business processes continue or are quickly restored in the event of disruption, e.g. according to ISO 22301 or BSI Standard 200-4. NIS2 requires business continuity and crisis management. Más información: Gestión de la continuidad de negocio (BCM)

Betroffenenrechte (Rights of the data subject)

Access, rectification, erasure, restriction, data portability, objection and protection against solely automated decisions (Art. 15 to 22 GDPR). Reply as a rule within one month (Art. 12(3) GDPR). Más información: RGPD

BIA (Business impact analysis)

Analysis of how severe the damage becomes if a business process is disrupted for a certain time. The maximum tolerable period of disruption, the criticality and the recovery targets follow from it. Más información: Gestión de la continuidad de negocio (BCM)

BSI (Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik))

Germany’s federal cybersecurity authority. Receives reports under § 32 BSIG, supervises NIS2 entities and publishes IT-Grundschutz. Más información: NIS2

BSIG (Act on the Federal Office for Information Security (BSI Act, BSIG))

Governs the tasks of the BSI and the obligations of particularly important and important entities, including registration (§ 33), risk management (§ 30) and reporting obligations (§ 32). Más información: NIS2

C

CE (CE marking)

Marking with which the manufacturer declares that a product meets the applicable EU harmonisation legislation, e.g. the Machinery Regulation, RED and CRA. A conformity assessment is a prerequisite. Más información: CRA

Conduit (Communication channel according to IEC 62443)

Grouping of the communication paths between zones, e.g. a firewall connection with defined protocols. An SL-T is also defined for conduits. Más información: IEC 62443

CPE (Common Platform Enumeration)

Standardised name for hardware, an operating system or an application including version, e.g. cpe:2.3:h:vendor:product:version. Used for matching against vulnerability databases such as the NVD. Más información: Gestión de vulnerabilidades

CRA (Cyber Resilience Act, Regulation (EU) 2024/2847)

EU regulation with cybersecurity requirements for products with digital elements across their entire lifecycle, including vulnerability handling. Manufacturers’ reporting obligations (Art. 14) apply from 11 September 2026, the other obligations from 11 December 2027. Más información: CRA

CSAF (Common Security Advisory Framework)

Machine-readable format (OASIS standard, JSON) for vendor security advisories, with affected products and versions, remediations and a profile for VEX. Vendors publish it via a provider-metadata.json, usually signed. Recommended by the BSI. Más información: Gestión de vulnerabilidades

CSIRT (Computer Security Incident Response Team)

Body that receives and coordinates security incidents. Under the CRA, reports go via the ENISA reporting platform to the CSIRT designated as coordinator in the Member State of your main establishment. Más información: NIS2

CVD (Coordinated vulnerability disclosure)

Process in which reporters and manufacturers agree on how to handle a vulnerability and when to publish it. The CRA requires manufacturers to have such a policy (Annex I Part II point 5). Más información: CRA

CVE (Common Vulnerabilities and Exposures)

Globally unique identifier of a publicly known vulnerability, e.g. CVE-2024-3400. Assigned in the CVE programme by authorised bodies (CNAs). Más información: Gestión de vulnerabilidades

CVSS (Common Vulnerability Scoring System)

Rates the severity of a vulnerability from 0.0 to 10.0 (none to critical), published by FIRST, widely used in versions 3.1 and 4.0. Says nothing about whether the vulnerability is actually being exploited. Más información: Gestión de vulnerabilidades

CWE (Common Weakness Enumeration)

Catalogue of typical weakness types in software and hardware (MITRE), e.g. CWE-787 “Out-of-bounds write” or CWE-79 “Cross-site scripting”. Maps a CVE to its cause. Más información: Gestión de vulnerabilidades

CycloneDX (OWASP CycloneDX (ECMA-424))

Open format for SBOMs (JSON or XML) by OWASP, standardised as ECMA-424. Describes components with supplier, purl, licence, checksums and dependencies and can also contain VEX statements. Más información: Gestión de activos

D

Datenpanne (Breach of the security of personal data)

Breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12) GDPR). Notify the supervisory authority where feasible within 72 hours and, in case of a high risk, also inform the data subjects (Art. 34). Más información: RGPD

Defense in Depth (layered defence)

Security concept with several independent layers of protection, each of which still protects when another has been overcome (IEC 62443-4-1 SD-2). Más información: IEC 62443

DMZ (Demilitarised zone)

Separate network segment between two networks, e.g. office IT and OT, through which data is only exchanged in a controlled manner. There are no direct connections between the networks. Más información: IEC 62443

DSB (Data protection officer)

Advises and monitors the controller on data protection, acts free of instructions and is the contact point for the supervisory authority (Art. 37 to 39 GDPR). Whether a designation is mandatory depends on the activity and on national law (in Germany § 38 BDSG). Más información: RGPD

DSFA (Data protection impact assessment)

Prior assessment of processing likely to result in a high risk to data subjects: description, necessity, risks and remedial measures (Art. 35(7) GDPR). If a high risk remains, the supervisory authority must be consulted beforehand (Art. 36). Más información: RGPD

DSGVO (General Data Protection Regulation, Regulation (EU) 2016/679)

EU regulation on the protection of personal data. Particularly important for information security: Art. 32 (security of processing) and Art. 33 (notification of personal data breaches within 72 hours). Más información: RGPD

E

EN 18031 (Harmonisierte Normen EN 18031-1, -2 und -3)

European standards with cybersecurity requirements for radio equipment under the RED: Part 1 network protection, Part 2 protection of personal data, Part 3 protection against fraud. Más información: Directiva sobre equipos radioeléctricos (RED)

ENISA (European Union Agency for Cybersecurity)

EU agency for cybersecurity. Among other things, it operates the single reporting platform for reports under the CRA and the European Vulnerability Database (EUVD). Más información: CRA

EoL (End of Life / End of Support)

Point in time from which the vendor no longer supports a product, in particular no longer provides security updates (end of vendor support). Some vendors then still offer paid extended security updates (ESU). Such assets need replacing or documented compensating measures. Más información: Gestión de activos

EPSS (Exploit Prediction Scoring System)

Probability (0 to 1), calculated daily by FIRST, that a vulnerability will be exploited in the next 30 days. Complements CVSS for prioritisation. Más información: Gestión de vulnerabilidades

Erheblicher Sicherheitsvorfall

Security incident that causes or can cause severe operational disruption or financial loss, or considerable damage to others. Triggers the reporting obligation under § 32 BSIG. Más información: NIS2

EU-Konformitätserklärung (DoC, Declaration of Conformity)

Manufacturer’s declaration that its product meets the essential requirements of the applicable EU legal acts. With it, the manufacturer assumes responsibility; it is a prerequisite for CE marking. Más información: CRA

EUVD (European Vulnerability Database)

Database of publicly known vulnerabilities in ICT products and services, operated by ENISA under Art. 12(2) NIS2. Más información: Gestión de vulnerabilidades

F

Frühwarnung (in the BSIG: frühe Erstmeldung)

First reporting stage: no later than 24 hours after becoming aware of a significant security incident (Art. 23 NIS2) or an actively exploited vulnerability or severe incident (Art. 14 CRA). The BSIG calls it “frühe Erstmeldung” (§ 32 BSIG). Más información: NIS2

G

Gap-Analyse

Self-assessment of how far a measure is implemented today, compared with the target level. The difference is the gap. Más información: Gestión del cumplimiento

H

HinSchG (Whistleblower Protection Act)

German act protecting persons who report violations; implements Directive (EU) 2019/1937. Employers with 50 or more employees must set up an internal reporting office. Más información: HinSchG

Hochrisiko-KI-System

AI system used as a safety component of a product under Annex I that requires third-party assessment (Art. 6(1)) or in an area listed in Annex III, such as recruitment or creditworthiness (Art. 6(2)). AI used exclusively for quality control is not a safety component. Más información: Reglamento de IA

I

IACS (Industrial Automation and Control System)

Industrial automation and control system: personnel, hardware, software and policies that enable the secure operation of an industrial process. Central term of IEC 62443. Más información: IEC 62443

IEC 62443 (ISA/IEC 62443 series)

Series of standards on the security of industrial automation and control systems (IACS), with parts for asset owners (2-x), systems (3-x) and component manufacturers (4-x). Core concepts are zones, conduits and security levels. Más información: IEC 62443

ISB (Information security officer)

Person who coordinates the ISMS, advises management and reports to it on the state of information security. Often also called CISO. Más información: ISO 27001

ISMS (Information security management system)

Rules, processes and responsibilities with which an organisation systematically manages, reviews and improves information security, e.g. according to ISO 27001 or IT-Grundschutz. Más información: ISO 27001

ISO 27001 (ISO/IEC 27001)

International standard with requirements for an ISMS. Certifiable; Annex A of the 2022 edition contains 93 controls. Más información: ISO 27001

ISO 27002 (ISO/IEC 27002)

Guidance on the controls in Annex A of ISO 27001 with purpose and implementation guidance. Not certifiable. Más información: ISO 27001

IT-Grundschutz (BSI IT-Grundschutz (BSI-GS))

BSI methodology based on BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium, which can be used to build an ISMS and obtain ISO 27001 certification on the basis of IT-Grundschutz. Más información: IT-Grundschutz

K

KEV (Known Exploited Vulnerabilities Catalog)

List by the US agency CISA of vulnerabilities that are known to be exploited. A good indicator of what should be fixed first. Más información: Gestión de vulnerabilidades

KI-Kompetenz

Skills, knowledge and understanding for the informed deployment of AI systems (Art. 3(56)). Since 2 February 2025 providers and deployers take measures to support the AI literacy of their staff; since Regulation (EU) 2026/1744 without guaranteeing a specific level. Más información: Reglamento de IA

KI-Modell mit allgemeinem Verwendungszweck (GPAI model)

AI model displaying significant generality that can perform a wide range of distinct tasks and be integrated into downstream systems, such as a large language model. Obligations of model providers: Chapter V (Art. 53, 55). Más información: Reglamento de IA

KI-System

Machine-based system that operates with varying levels of autonomy and infers from its inputs how to generate predictions, content, recommendations or decisions. Software with purely fixed rules defined by humans is generally not an AI system. Más información: Reglamento de IA

KI-VO (Artificial Intelligence Act, Regulation (EU) 2024/1689)

EU regulation laying down harmonised rules on artificial intelligence: prohibition of certain practices, requirements for high-risk AI systems, transparency obligations and AI literacy. Amended by Regulation (EU) 2026/1744; the obligations for high-risk AI systems apply under Annex III from 2 December 2027 and under Annex I from 2 August 2028. Más información: Reglamento de IA

Konformitätsbewertung

Procedure for verifying whether a product meets the essential requirements, e.g. the cybersecurity requirements of the CRA. Depending on the product, carried out by the manufacturer itself or with the involvement of a notified body. Más información: CRA

KRITIS (Critical infrastructure)

Facilities whose failure would lead to significant supply shortages or threats to public safety, e.g. in energy, water or health. Operators of critical facilities have additional obligations under the BSIG and KRITIS-DachG. Más información: Ley marco KRITIS

M

MaschinenVO (Machinery Regulation, Regulation (EU) 2023/1230)

Replaces the Machinery Directive 2006/42/EC from 20 January 2027. For the first time, it contains requirements for protection against corruption, i.e. for the cybersecurity of control systems and software (Annex III). Más información: Reglamento de máquinas

MITRE ATT&CK (Knowledge base of the MITRE Corporation on attack tactics and techniques)

Public knowledge base of real attacks: what do attackers want to achieve (tactic), how do they proceed (technique), what helps against it (mitigation)? Two matrices: Enterprise for IT, ICS for controllers and plants. IDs such as T1133 (External Remote Services) or T0883 (Internet Accessible Device, ICS) describe scenarios consistently.

MTPD (Maximum Tolerable Period of Disruption)

Longest time a process may be disrupted before the damage to the company is no longer bearable. The recovery time objective (RTO) must be shorter. Más información: Gestión de la continuidad de negocio (BCM)

N

NIS2 (Directive (EU) 2022/2555)

EU directive for a high common level of cybersecurity. It obliges essential and important entities to manage risks and to report significant security incidents; transposed in Germany in the BSIG. Más información: NIS2

NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act (NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz))

German law transposing the NIS2 Directive. At its core is the revised BSI Act (BSIG), with obligations for particularly important and important entities. Más información: NIS2

Notifizierte Stelle (also known as notified body (benannte Stelle))

Independent conformity assessment body that a Member State has notified to the European Commission. It must be involved, for example, for important products of class II and critical products under the CRA or for certain machinery from Annex I of the Machinery Regulation. Más información: CRA

NVD (National Vulnerability Database)

Vulnerability database of the US NIST. Supplements CVEs with CVSS scores, weakness types (CWE) and affected products as CPEs with version ranges. Más información: Gestión de vulnerabilidades

O

OT (Operational Technology)

Hardware and software that monitors and controls physical processes, e.g. PLC, HMI and SCADA in manufacturing, energy or water. Availability and the safety of people and plant usually take priority here. Más información: Gestión de activos

P

Pseudonymisierung (Pseudonymisation of personal data)

Processing after which data can no longer be attributed to a person without additional information kept separately (Art. 4(5) GDPR). Pseudonymised data remain personal data but lower the risk. Más información: RGPD

PSIRT (Product Security Incident Response Team)

A manufacturer’s team that receives, assesses and fixes vulnerability reports on its own products and publishes security advisories. Helps with vulnerability handling under Annex I Part II CRA. Más información: CRA

Purdue-Modell (Purdue Enterprise Reference Architecture)

Layer model for industrial networks: level 0 field devices, 1 control (PLC), 2 supervision (HMI, SCADA), 3 operations management (MES), 3.5 industrial DMZ, 4 and 5 enterprise IT and internet. Helps with dividing into zones. Más información: IEC 62443

R

RED (Radio Equipment Directive 2014/53/EU)

EU directive for radio equipment. Since 1 August 2025, cybersecurity requirements (Art. 3(3)(d), (e), (f)) apply to connected radio equipment via Delegated Regulation (EU) 2022/30, specified by EN 18031. Más información: Directiva sobre equipos radioeléctricos (RED)

RTO/RPO (Recovery Time Objective / Recovery Point Objective)

RTO (recovery time objective): target for when a process or service runs again after a disruption; it must be shorter than the maximum tolerable period of disruption (MTPD). RPO: maximum tolerable data loss, measured as the period since the last backup. Más información: Gestión de la continuidad de negocio (BCM)

S

SBOM (Software Bill of Materials)

Machine-readable list of a product’s software components and their dependencies, e.g. in CycloneDX or SPDX format. The CRA requires it from manufacturers (Annex I Part II). Más información: Gestión de activos

SCADA (Supervisory Control and Data Acquisition)

System for monitoring and controlling distributed plants with visualisation, alarms and data acquisition. Purdue level 2. Más información: Gestión de activos

SDL (Secure development lifecycle)

Documented development process that embeds security from requirements through design, implementation and testing to updates and decommissioning. For suppliers of industrial components IEC 62443-4-1 describes the requirements in eight practices. Más información: Fabricante IEC 62443

SL-T (Security Level Target)

IEC 62443: targeted security level of a zone or conduit (SL 1 to SL 4), derived from the risk assessment. Más información: IEC 62443

SoA (Statement of Applicability)

Mandatory document under ISO 27001. For each control in Annex A, it states whether it is applied, with justification and implementation status. Más información: ISO 27001

SPDX (Software Package Data Exchange (ISO/IEC 5962))

Open format of the Linux Foundation for SBOMs and licence information, standardised as ISO/IEC 5962. The SPDX licence identifiers (e.g. MIT, Apache-2.0) are also used by other formats. Más información: Gestión de activos

SPS/PLC (Programmable Logic Controller (Speicherprogrammierbare Steuerung, SPS))

Industrial controller that reads sensors and controls actuators according to a program, e.g. Siemens S7. Purdue level 1. Más información: Gestión de activos

T

TISAX (Trusted Information Security Assessment Exchange)

Automotive industry procedure in which companies have their information security checked by an approved audit provider and share the result with partners via the ENX platform. The result is a label, not a certificate. TISAX® is a registered trademark of the ENX Association. Más información: TISAX

TOM (Technical and organisational measures)

Measures for the security of processing personal data under Art. 32 GDPR, e.g. encryption, access control and backup. Más información: RGPD

V

VDA ISA (Information Security Assessment of the VDA)

Questionnaire of the German Association of the Automotive Industry (VDA) that a TISAX assessment checks against, with the modules information security, prototype protection and data protection. Más información: TISAX

VEX (Vulnerability Exploitability eXchange)

Machine-readable statement of whether a known vulnerability actually affects a product (e.g. “not affected”, “affected”, “fixed”). Complements the SBOM, but is not explicitly required by the CRA. Más información: Gestión de vulnerabilidades

VVT (Record of processing activities)

Mandatory record under Art. 30 GDPR listing purposes, data subjects, data categories, recipients, transfers to third countries, erasure periods and TOMs for each processing activity. The supervisory authority can request it at any time. Más información: RGPD

W

Wirtschaftsakteur

Umbrella term for manufacturers, authorised representatives, importers and distributors. Each role has its own obligations; anyone who markets a product under their own name or substantially modifies it becomes a manufacturer themselves. Más información: CRA

Z

Zone (Security zone according to IEC 62443)

Group of assets with the same security requirements, e.g. a manufacturing cell. An SL-T is defined for each zone. Más información: IEC 62443

Las explicaciones están simplificadas y no sustituyen el asesoramiento jurídico. Son determinantes las leyes y normas correspondientes.