Glossaire

A

Aktiv ausgenutzte Schwachstelle

CRA term: a vulnerability for which there is reliable evidence that it has been exploited by a malicious actor. Triggers the reporting obligation under Art. 14 CRA. En savoir plus: CRA

Assessment-Level

Depth of the TISAX check: AL1 self-assessment only without a label, AL2 plausibility check with evidence and interviews, usually remote, AL3 comprehensive check on site. The label determines which level is needed. En savoir plus: TISAX

AV/AVV (Data processing / Data processing agreement)

If a service provider processes personal data on your behalf, a contract under Art. 28 GDPR is required. Among other things, it governs being bound by instructions, sub-processors and TOMs. En savoir plus: RGPD

B

BBK (Federal Office of Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe))

Central point of contact and competent authority under the KRITIS-DachG for the physical resilience of critical facilities. Operators register their critical facilities via a joint registration facility of the BBK and BSI. En savoir plus: Loi-cadre KRITIS

BCM (Business Continuity Management)

Planning and practising how critical business processes continue or are quickly restored in the event of disruption, e.g. according to ISO 22301 or BSI Standard 200-4. NIS2 requires business continuity and crisis management. En savoir plus: Gestion de la continuité d’activité (BCM)

Betroffenenrechte (Rights of the data subject)

Access, rectification, erasure, restriction, data portability, objection and protection against solely automated decisions (Art. 15 to 22 GDPR). Reply as a rule within one month (Art. 12(3) GDPR). En savoir plus: RGPD

BIA (Business impact analysis)

Analysis of how severe the damage becomes if a business process is disrupted for a certain time. The maximum tolerable period of disruption, the criticality and the recovery targets follow from it. En savoir plus: Gestion de la continuité d’activité (BCM)

BSI (Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik))

Germany’s federal cybersecurity authority. Receives reports under § 32 BSIG, supervises NIS2 entities and publishes IT-Grundschutz. En savoir plus: NIS2

BSIG (Act on the Federal Office for Information Security (BSI Act, BSIG))

Governs the tasks of the BSI and the obligations of particularly important and important entities, including registration (§ 33), risk management (§ 30) and reporting obligations (§ 32). En savoir plus: NIS2

C

CE (CE marking)

Marking with which the manufacturer declares that a product meets the applicable EU harmonisation legislation, e.g. the Machinery Regulation, RED and CRA. A conformity assessment is a prerequisite. En savoir plus: CRA

Conduit (Communication channel according to IEC 62443)

Grouping of the communication paths between zones, e.g. a firewall connection with defined protocols. An SL-T is also defined for conduits. En savoir plus: IEC 62443

CPE (Common Platform Enumeration)

Standardised name for hardware, an operating system or an application including version, e.g. cpe:2.3:h:vendor:product:version. Used for matching against vulnerability databases such as the NVD. En savoir plus: Gestion des vulnérabilités

CRA (Cyber Resilience Act, Regulation (EU) 2024/2847)

EU regulation with cybersecurity requirements for products with digital elements across their entire lifecycle, including vulnerability handling. Manufacturers’ reporting obligations (Art. 14) apply from 11 September 2026, the other obligations from 11 December 2027. En savoir plus: CRA

CSAF (Common Security Advisory Framework)

Machine-readable format (OASIS standard, JSON) for vendor security advisories, with affected products and versions, remediations and a profile for VEX. Vendors publish it via a provider-metadata.json, usually signed. Recommended by the BSI. En savoir plus: Gestion des vulnérabilités

CSIRT (Computer Security Incident Response Team)

Body that receives and coordinates security incidents. Under the CRA, reports go via the ENISA reporting platform to the CSIRT designated as coordinator in the Member State of your main establishment. En savoir plus: NIS2

CVD (Coordinated vulnerability disclosure)

Process in which reporters and manufacturers agree on how to handle a vulnerability and when to publish it. The CRA requires manufacturers to have such a policy (Annex I Part II point 5). En savoir plus: CRA

CVE (Common Vulnerabilities and Exposures)

Globally unique identifier of a publicly known vulnerability, e.g. CVE-2024-3400. Assigned in the CVE programme by authorised bodies (CNAs). En savoir plus: Gestion des vulnérabilités

CVSS (Common Vulnerability Scoring System)

Rates the severity of a vulnerability from 0.0 to 10.0 (none to critical), published by FIRST, widely used in versions 3.1 and 4.0. Says nothing about whether the vulnerability is actually being exploited. En savoir plus: Gestion des vulnérabilités

CWE (Common Weakness Enumeration)

Catalogue of typical weakness types in software and hardware (MITRE), e.g. CWE-787 “Out-of-bounds write” or CWE-79 “Cross-site scripting”. Maps a CVE to its cause. En savoir plus: Gestion des vulnérabilités

CycloneDX (OWASP CycloneDX (ECMA-424))

Open format for SBOMs (JSON or XML) by OWASP, standardised as ECMA-424. Describes components with supplier, purl, licence, checksums and dependencies and can also contain VEX statements. En savoir plus: Gestion des actifs

D

Datenpanne (Breach of the security of personal data)

Breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12) GDPR). Notify the supervisory authority where feasible within 72 hours and, in case of a high risk, also inform the data subjects (Art. 34). En savoir plus: RGPD

Defense in Depth (layered defence)

Security concept with several independent layers of protection, each of which still protects when another has been overcome (IEC 62443-4-1 SD-2). En savoir plus: IEC 62443

DMZ (Demilitarised zone)

Separate network segment between two networks, e.g. office IT and OT, through which data is only exchanged in a controlled manner. There are no direct connections between the networks. En savoir plus: IEC 62443

DSB (Data protection officer)

Advises and monitors the controller on data protection, acts free of instructions and is the contact point for the supervisory authority (Art. 37 to 39 GDPR). Whether a designation is mandatory depends on the activity and on national law (in Germany § 38 BDSG). En savoir plus: RGPD

DSFA (Data protection impact assessment)

Prior assessment of processing likely to result in a high risk to data subjects: description, necessity, risks and remedial measures (Art. 35(7) GDPR). If a high risk remains, the supervisory authority must be consulted beforehand (Art. 36). En savoir plus: RGPD

DSGVO (General Data Protection Regulation, Regulation (EU) 2016/679)

EU regulation on the protection of personal data. Particularly important for information security: Art. 32 (security of processing) and Art. 33 (notification of personal data breaches within 72 hours). En savoir plus: RGPD

E

EN 18031 (Harmonisierte Normen EN 18031-1, -2 und -3)

European standards with cybersecurity requirements for radio equipment under the RED: Part 1 network protection, Part 2 protection of personal data, Part 3 protection against fraud. En savoir plus: Directive RED

ENISA (European Union Agency for Cybersecurity)

EU agency for cybersecurity. Among other things, it operates the single reporting platform for reports under the CRA and the European Vulnerability Database (EUVD). En savoir plus: CRA

EoL (End of Life / End of Support)

Point in time from which the vendor no longer supports a product, in particular no longer provides security updates (end of vendor support). Some vendors then still offer paid extended security updates (ESU). Such assets need replacing or documented compensating measures. En savoir plus: Gestion des actifs

EPSS (Exploit Prediction Scoring System)

Probability (0 to 1), calculated daily by FIRST, that a vulnerability will be exploited in the next 30 days. Complements CVSS for prioritisation. En savoir plus: Gestion des vulnérabilités

Erheblicher Sicherheitsvorfall

Security incident that causes or can cause severe operational disruption or financial loss, or considerable damage to others. Triggers the reporting obligation under § 32 BSIG. En savoir plus: NIS2

EU-Konformitätserklärung (DoC, Declaration of Conformity)

Manufacturer’s declaration that its product meets the essential requirements of the applicable EU legal acts. With it, the manufacturer assumes responsibility; it is a prerequisite for CE marking. En savoir plus: CRA

EUVD (European Vulnerability Database)

Database of publicly known vulnerabilities in ICT products and services, operated by ENISA under Art. 12(2) NIS2. En savoir plus: Gestion des vulnérabilités

F

Frühwarnung (in the BSIG: frühe Erstmeldung)

First reporting stage: no later than 24 hours after becoming aware of a significant security incident (Art. 23 NIS2) or an actively exploited vulnerability or severe incident (Art. 14 CRA). The BSIG calls it “frühe Erstmeldung” (§ 32 BSIG). En savoir plus: NIS2

G

Gap-Analyse

Self-assessment of how far a measure is implemented today, compared with the target level. The difference is the gap. En savoir plus: Gestion de la conformité

H

HinSchG (Whistleblower Protection Act)

German act protecting persons who report violations; implements Directive (EU) 2019/1937. Employers with 50 or more employees must set up an internal reporting office. En savoir plus: HinSchG

Hochrisiko-KI-System

AI system used as a safety component of a product under Annex I that requires third-party assessment (Art. 6(1)) or in an area listed in Annex III, such as recruitment or creditworthiness (Art. 6(2)). AI used exclusively for quality control is not a safety component. En savoir plus: Règlement sur l’IA

I

IACS (Industrial Automation and Control System)

Industrial automation and control system: personnel, hardware, software and policies that enable the secure operation of an industrial process. Central term of IEC 62443. En savoir plus: IEC 62443

IEC 62443 (ISA/IEC 62443 series)

Series of standards on the security of industrial automation and control systems (IACS), with parts for asset owners (2-x), systems (3-x) and component manufacturers (4-x). Core concepts are zones, conduits and security levels. En savoir plus: IEC 62443

ISB (Information security officer)

Person who coordinates the ISMS, advises management and reports to it on the state of information security. Often also called CISO. En savoir plus: ISO 27001

ISMS (Information security management system)

Rules, processes and responsibilities with which an organisation systematically manages, reviews and improves information security, e.g. according to ISO 27001 or IT-Grundschutz. En savoir plus: ISO 27001

ISO 27001 (ISO/IEC 27001)

International standard with requirements for an ISMS. Certifiable; Annex A of the 2022 edition contains 93 controls. En savoir plus: ISO 27001

ISO 27002 (ISO/IEC 27002)

Guidance on the controls in Annex A of ISO 27001 with purpose and implementation guidance. Not certifiable. En savoir plus: ISO 27001

IT-Grundschutz (BSI IT-Grundschutz (BSI-GS))

BSI methodology based on BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium, which can be used to build an ISMS and obtain ISO 27001 certification on the basis of IT-Grundschutz. En savoir plus: IT-Grundschutz

K

KEV (Known Exploited Vulnerabilities Catalog)

List by the US agency CISA of vulnerabilities that are known to be exploited. A good indicator of what should be fixed first. En savoir plus: Gestion des vulnérabilités

KI-Kompetenz

Skills, knowledge and understanding for the informed deployment of AI systems (Art. 3(56)). Since 2 February 2025 providers and deployers take measures to support the AI literacy of their staff; since Regulation (EU) 2026/1744 without guaranteeing a specific level. En savoir plus: Règlement sur l’IA

KI-Modell mit allgemeinem Verwendungszweck (GPAI model)

AI model displaying significant generality that can perform a wide range of distinct tasks and be integrated into downstream systems, such as a large language model. Obligations of model providers: Chapter V (Art. 53, 55). En savoir plus: Règlement sur l’IA

KI-System

Machine-based system that operates with varying levels of autonomy and infers from its inputs how to generate predictions, content, recommendations or decisions. Software with purely fixed rules defined by humans is generally not an AI system. En savoir plus: Règlement sur l’IA

KI-VO (Artificial Intelligence Act, Regulation (EU) 2024/1689)

EU regulation laying down harmonised rules on artificial intelligence: prohibition of certain practices, requirements for high-risk AI systems, transparency obligations and AI literacy. Amended by Regulation (EU) 2026/1744; the obligations for high-risk AI systems apply under Annex III from 2 December 2027 and under Annex I from 2 August 2028. En savoir plus: Règlement sur l’IA

Konformitätsbewertung

Procedure for verifying whether a product meets the essential requirements, e.g. the cybersecurity requirements of the CRA. Depending on the product, carried out by the manufacturer itself or with the involvement of a notified body. En savoir plus: CRA

KRITIS (Critical infrastructure)

Facilities whose failure would lead to significant supply shortages or threats to public safety, e.g. in energy, water or health. Operators of critical facilities have additional obligations under the BSIG and KRITIS-DachG. En savoir plus: Loi-cadre KRITIS

M

MaschinenVO (Machinery Regulation, Regulation (EU) 2023/1230)

Replaces the Machinery Directive 2006/42/EC from 20 January 2027. For the first time, it contains requirements for protection against corruption, i.e. for the cybersecurity of control systems and software (Annex III). En savoir plus: Règlement Machines

MITRE ATT&CK (Knowledge base of the MITRE Corporation on attack tactics and techniques)

Public knowledge base of real attacks: what do attackers want to achieve (tactic), how do they proceed (technique), what helps against it (mitigation)? Two matrices: Enterprise for IT, ICS for controllers and plants. IDs such as T1133 (External Remote Services) or T0883 (Internet Accessible Device, ICS) describe scenarios consistently.

MTPD (Maximum Tolerable Period of Disruption)

Longest time a process may be disrupted before the damage to the company is no longer bearable. The recovery time objective (RTO) must be shorter. En savoir plus: Gestion de la continuité d’activité (BCM)

N

NIS2 (Directive (EU) 2022/2555)

EU directive for a high common level of cybersecurity. It obliges essential and important entities to manage risks and to report significant security incidents; transposed in Germany in the BSIG. En savoir plus: NIS2

NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act (NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz))

German law transposing the NIS2 Directive. At its core is the revised BSI Act (BSIG), with obligations for particularly important and important entities. En savoir plus: NIS2

Notifizierte Stelle (also known as notified body (benannte Stelle))

Independent conformity assessment body that a Member State has notified to the European Commission. It must be involved, for example, for important products of class II and critical products under the CRA or for certain machinery from Annex I of the Machinery Regulation. En savoir plus: CRA

NVD (National Vulnerability Database)

Vulnerability database of the US NIST. Supplements CVEs with CVSS scores, weakness types (CWE) and affected products as CPEs with version ranges. En savoir plus: Gestion des vulnérabilités

O

OT (Operational Technology)

Hardware and software that monitors and controls physical processes, e.g. PLC, HMI and SCADA in manufacturing, energy or water. Availability and the safety of people and plant usually take priority here. En savoir plus: Gestion des actifs

P

Pseudonymisierung (Pseudonymisation of personal data)

Processing after which data can no longer be attributed to a person without additional information kept separately (Art. 4(5) GDPR). Pseudonymised data remain personal data but lower the risk. En savoir plus: RGPD

PSIRT (Product Security Incident Response Team)

A manufacturer’s team that receives, assesses and fixes vulnerability reports on its own products and publishes security advisories. Helps with vulnerability handling under Annex I Part II CRA. En savoir plus: CRA

Purdue-Modell (Purdue Enterprise Reference Architecture)

Layer model for industrial networks: level 0 field devices, 1 control (PLC), 2 supervision (HMI, SCADA), 3 operations management (MES), 3.5 industrial DMZ, 4 and 5 enterprise IT and internet. Helps with dividing into zones. En savoir plus: IEC 62443

R

RED (Radio Equipment Directive 2014/53/EU)

EU directive for radio equipment. Since 1 August 2025, cybersecurity requirements (Art. 3(3)(d), (e), (f)) apply to connected radio equipment via Delegated Regulation (EU) 2022/30, specified by EN 18031. En savoir plus: Directive RED

RTO/RPO (Recovery Time Objective / Recovery Point Objective)

RTO (recovery time objective): target for when a process or service runs again after a disruption; it must be shorter than the maximum tolerable period of disruption (MTPD). RPO: maximum tolerable data loss, measured as the period since the last backup. En savoir plus: Gestion de la continuité d’activité (BCM)

S

SBOM (Software Bill of Materials)

Machine-readable list of a product’s software components and their dependencies, e.g. in CycloneDX or SPDX format. The CRA requires it from manufacturers (Annex I Part II). En savoir plus: Gestion des actifs

SCADA (Supervisory Control and Data Acquisition)

System for monitoring and controlling distributed plants with visualisation, alarms and data acquisition. Purdue level 2. En savoir plus: Gestion des actifs

SDL (Secure development lifecycle)

Documented development process that embeds security from requirements through design, implementation and testing to updates and decommissioning. For suppliers of industrial components IEC 62443-4-1 describes the requirements in eight practices. En savoir plus: Fabricant IEC 62443

SL-T (Security Level Target)

IEC 62443: targeted security level of a zone or conduit (SL 1 to SL 4), derived from the risk assessment. En savoir plus: IEC 62443

SoA (Statement of Applicability)

Mandatory document under ISO 27001. For each control in Annex A, it states whether it is applied, with justification and implementation status. En savoir plus: ISO 27001

SPDX (Software Package Data Exchange (ISO/IEC 5962))

Open format of the Linux Foundation for SBOMs and licence information, standardised as ISO/IEC 5962. The SPDX licence identifiers (e.g. MIT, Apache-2.0) are also used by other formats. En savoir plus: Gestion des actifs

SPS/PLC (Programmable Logic Controller (Speicherprogrammierbare Steuerung, SPS))

Industrial controller that reads sensors and controls actuators according to a program, e.g. Siemens S7. Purdue level 1. En savoir plus: Gestion des actifs

T

TISAX (Trusted Information Security Assessment Exchange)

Automotive industry procedure in which companies have their information security checked by an approved audit provider and share the result with partners via the ENX platform. The result is a label, not a certificate. TISAX® is a registered trademark of the ENX Association. En savoir plus: TISAX

TOM (Technical and organisational measures)

Measures for the security of processing personal data under Art. 32 GDPR, e.g. encryption, access control and backup. En savoir plus: RGPD

V

VDA ISA (Information Security Assessment of the VDA)

Questionnaire of the German Association of the Automotive Industry (VDA) that a TISAX assessment checks against, with the modules information security, prototype protection and data protection. En savoir plus: TISAX

VEX (Vulnerability Exploitability eXchange)

Machine-readable statement of whether a known vulnerability actually affects a product (e.g. “not affected”, “affected”, “fixed”). Complements the SBOM, but is not explicitly required by the CRA. En savoir plus: Gestion des vulnérabilités

VVT (Record of processing activities)

Mandatory record under Art. 30 GDPR listing purposes, data subjects, data categories, recipients, transfers to third countries, erasure periods and TOMs for each processing activity. The supervisory authority can request it at any time. En savoir plus: RGPD

W

Wirtschaftsakteur

Umbrella term for manufacturers, authorised representatives, importers and distributors. Each role has its own obligations; anyone who markets a product under their own name or substantially modifies it becomes a manufacturer themselves. En savoir plus: CRA

Z

Zone (Security zone according to IEC 62443)

Group of assets with the same security requirements, e.g. a manufacturing cell. An SL-T is defined for each zone. En savoir plus: IEC 62443

Les explications sont simplifiées et ne remplacent pas un conseil juridique. Les lois et normes concernées font foi.