Glossario

A

Aktiv ausgenutzte Schwachstelle

CRA term: a vulnerability for which there is reliable evidence that it has been exploited by a malicious actor. Triggers the reporting obligation under Art. 14 CRA. Maggiori informazioni: CRA

Assessment-Level

Depth of the TISAX check: AL1 self-assessment only without a label, AL2 plausibility check with evidence and interviews, usually remote, AL3 comprehensive check on site. The label determines which level is needed. Maggiori informazioni: TISAX

AV/AVV (Data processing / Data processing agreement)

If a service provider processes personal data on your behalf, a contract under Art. 28 GDPR is required. Among other things, it governs being bound by instructions, sub-processors and TOMs. Maggiori informazioni: GDPR

B

BBK (Federal Office of Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe))

Central point of contact and competent authority under the KRITIS-DachG for the physical resilience of critical facilities. Operators register their critical facilities via a joint registration facility of the BBK and BSI. Maggiori informazioni: Legge quadro KRITIS (KRITIS-DachG)

BCM (Business Continuity Management)

Planning and practising how critical business processes continue or are quickly restored in the event of disruption, e.g. according to ISO 22301 or BSI Standard 200-4. NIS2 requires business continuity and crisis management. Maggiori informazioni: Gestione della continuità operativa (BCM)

Betroffenenrechte (Rights of the data subject)

Access, rectification, erasure, restriction, data portability, objection and protection against solely automated decisions (Art. 15 to 22 GDPR). Reply as a rule within one month (Art. 12(3) GDPR). Maggiori informazioni: GDPR

BIA (Business impact analysis)

Analysis of how severe the damage becomes if a business process is disrupted for a certain time. The maximum tolerable period of disruption, the criticality and the recovery targets follow from it. Maggiori informazioni: Gestione della continuità operativa (BCM)

BSI (Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik))

Germany’s federal cybersecurity authority. Receives reports under § 32 BSIG, supervises NIS2 entities and publishes IT-Grundschutz. Maggiori informazioni: NIS2

BSIG (Act on the Federal Office for Information Security (BSI Act, BSIG))

Governs the tasks of the BSI and the obligations of particularly important and important entities, including registration (§ 33), risk management (§ 30) and reporting obligations (§ 32). Maggiori informazioni: NIS2

C

CE (CE marking)

Marking with which the manufacturer declares that a product meets the applicable EU harmonisation legislation, e.g. the Machinery Regulation, RED and CRA. A conformity assessment is a prerequisite. Maggiori informazioni: CRA

Conduit (Communication channel according to IEC 62443)

Grouping of the communication paths between zones, e.g. a firewall connection with defined protocols. An SL-T is also defined for conduits. Maggiori informazioni: IEC 62443

CPE (Common Platform Enumeration)

Standardised name for hardware, an operating system or an application including version, e.g. cpe:2.3:h:vendor:product:version. Used for matching against vulnerability databases such as the NVD. Maggiori informazioni: Vulnerability management

CRA (Cyber Resilience Act, Regulation (EU) 2024/2847)

EU regulation with cybersecurity requirements for products with digital elements across their entire lifecycle, including vulnerability handling. Manufacturers’ reporting obligations (Art. 14) apply from 11 September 2026, the other obligations from 11 December 2027. Maggiori informazioni: CRA

CSAF (Common Security Advisory Framework)

Machine-readable format (OASIS standard, JSON) for vendor security advisories, with affected products and versions, remediations and a profile for VEX. Vendors publish it via a provider-metadata.json, usually signed. Recommended by the BSI. Maggiori informazioni: Vulnerability management

CSIRT (Computer Security Incident Response Team)

Body that receives and coordinates security incidents. Under the CRA, reports go via the ENISA reporting platform to the CSIRT designated as coordinator in the Member State of your main establishment. Maggiori informazioni: NIS2

CVD (Coordinated vulnerability disclosure)

Process in which reporters and manufacturers agree on how to handle a vulnerability and when to publish it. The CRA requires manufacturers to have such a policy (Annex I Part II point 5). Maggiori informazioni: CRA

CVE (Common Vulnerabilities and Exposures)

Globally unique identifier of a publicly known vulnerability, e.g. CVE-2024-3400. Assigned in the CVE programme by authorised bodies (CNAs). Maggiori informazioni: Vulnerability management

CVSS (Common Vulnerability Scoring System)

Rates the severity of a vulnerability from 0.0 to 10.0 (none to critical), published by FIRST, widely used in versions 3.1 and 4.0. Says nothing about whether the vulnerability is actually being exploited. Maggiori informazioni: Vulnerability management

CWE (Common Weakness Enumeration)

Catalogue of typical weakness types in software and hardware (MITRE), e.g. CWE-787 “Out-of-bounds write” or CWE-79 “Cross-site scripting”. Maps a CVE to its cause. Maggiori informazioni: Vulnerability management

CycloneDX (OWASP CycloneDX (ECMA-424))

Open format for SBOMs (JSON or XML) by OWASP, standardised as ECMA-424. Describes components with supplier, purl, licence, checksums and dependencies and can also contain VEX statements. Maggiori informazioni: Asset management

D

Datenpanne (Breach of the security of personal data)

Breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12) GDPR). Notify the supervisory authority where feasible within 72 hours and, in case of a high risk, also inform the data subjects (Art. 34). Maggiori informazioni: GDPR

Defense in Depth (layered defence)

Security concept with several independent layers of protection, each of which still protects when another has been overcome (IEC 62443-4-1 SD-2). Maggiori informazioni: IEC 62443

DMZ (Demilitarised zone)

Separate network segment between two networks, e.g. office IT and OT, through which data is only exchanged in a controlled manner. There are no direct connections between the networks. Maggiori informazioni: IEC 62443

DSB (Data protection officer)

Advises and monitors the controller on data protection, acts free of instructions and is the contact point for the supervisory authority (Art. 37 to 39 GDPR). Whether a designation is mandatory depends on the activity and on national law (in Germany § 38 BDSG). Maggiori informazioni: GDPR

DSFA (Data protection impact assessment)

Prior assessment of processing likely to result in a high risk to data subjects: description, necessity, risks and remedial measures (Art. 35(7) GDPR). If a high risk remains, the supervisory authority must be consulted beforehand (Art. 36). Maggiori informazioni: GDPR

DSGVO (General Data Protection Regulation, Regulation (EU) 2016/679)

EU regulation on the protection of personal data. Particularly important for information security: Art. 32 (security of processing) and Art. 33 (notification of personal data breaches within 72 hours). Maggiori informazioni: GDPR

E

EN 18031 (Harmonisierte Normen EN 18031-1, -2 und -3)

European standards with cybersecurity requirements for radio equipment under the RED: Part 1 network protection, Part 2 protection of personal data, Part 3 protection against fraud. Maggiori informazioni: Direttiva sulle apparecchiature radio (RED)

ENISA (European Union Agency for Cybersecurity)

EU agency for cybersecurity. Among other things, it operates the single reporting platform for reports under the CRA and the European Vulnerability Database (EUVD). Maggiori informazioni: CRA

EoL (End of Life / End of Support)

Point in time from which the vendor no longer supports a product, in particular no longer provides security updates (end of vendor support). Some vendors then still offer paid extended security updates (ESU). Such assets need replacing or documented compensating measures. Maggiori informazioni: Asset management

EPSS (Exploit Prediction Scoring System)

Probability (0 to 1), calculated daily by FIRST, that a vulnerability will be exploited in the next 30 days. Complements CVSS for prioritisation. Maggiori informazioni: Vulnerability management

Erheblicher Sicherheitsvorfall

Security incident that causes or can cause severe operational disruption or financial loss, or considerable damage to others. Triggers the reporting obligation under § 32 BSIG. Maggiori informazioni: NIS2

EU-Konformitätserklärung (DoC, Declaration of Conformity)

Manufacturer’s declaration that its product meets the essential requirements of the applicable EU legal acts. With it, the manufacturer assumes responsibility; it is a prerequisite for CE marking. Maggiori informazioni: CRA

EUVD (European Vulnerability Database)

Database of publicly known vulnerabilities in ICT products and services, operated by ENISA under Art. 12(2) NIS2. Maggiori informazioni: Vulnerability management

F

Frühwarnung (in the BSIG: frühe Erstmeldung)

First reporting stage: no later than 24 hours after becoming aware of a significant security incident (Art. 23 NIS2) or an actively exploited vulnerability or severe incident (Art. 14 CRA). The BSIG calls it “frühe Erstmeldung” (§ 32 BSIG). Maggiori informazioni: NIS2

G

Gap-Analyse

Self-assessment of how far a measure is implemented today, compared with the target level. The difference is the gap. Maggiori informazioni: Compliance management

H

HinSchG (Whistleblower Protection Act)

German act protecting persons who report violations; implements Directive (EU) 2019/1937. Employers with 50 or more employees must set up an internal reporting office. Maggiori informazioni: HinSchG

Hochrisiko-KI-System

AI system used as a safety component of a product under Annex I that requires third-party assessment (Art. 6(1)) or in an area listed in Annex III, such as recruitment or creditworthiness (Art. 6(2)). AI used exclusively for quality control is not a safety component. Maggiori informazioni: Regolamento sull’IA

I

IACS (Industrial Automation and Control System)

Industrial automation and control system: personnel, hardware, software and policies that enable the secure operation of an industrial process. Central term of IEC 62443. Maggiori informazioni: IEC 62443

IEC 62443 (ISA/IEC 62443 series)

Series of standards on the security of industrial automation and control systems (IACS), with parts for asset owners (2-x), systems (3-x) and component manufacturers (4-x). Core concepts are zones, conduits and security levels. Maggiori informazioni: IEC 62443

ISB (Information security officer)

Person who coordinates the ISMS, advises management and reports to it on the state of information security. Often also called CISO. Maggiori informazioni: ISO 27001

ISMS (Information security management system)

Rules, processes and responsibilities with which an organisation systematically manages, reviews and improves information security, e.g. according to ISO 27001 or IT-Grundschutz. Maggiori informazioni: ISO 27001

ISO 27001 (ISO/IEC 27001)

International standard with requirements for an ISMS. Certifiable; Annex A of the 2022 edition contains 93 controls. Maggiori informazioni: ISO 27001

ISO 27002 (ISO/IEC 27002)

Guidance on the controls in Annex A of ISO 27001 with purpose and implementation guidance. Not certifiable. Maggiori informazioni: ISO 27001

IT-Grundschutz (BSI IT-Grundschutz (BSI-GS))

BSI methodology based on BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium, which can be used to build an ISMS and obtain ISO 27001 certification on the basis of IT-Grundschutz. Maggiori informazioni: IT-Grundschutz

K

KEV (Known Exploited Vulnerabilities Catalog)

List by the US agency CISA of vulnerabilities that are known to be exploited. A good indicator of what should be fixed first. Maggiori informazioni: Vulnerability management

KI-Kompetenz

Skills, knowledge and understanding for the informed deployment of AI systems (Art. 3(56)). Since 2 February 2025 providers and deployers take measures to support the AI literacy of their staff; since Regulation (EU) 2026/1744 without guaranteeing a specific level. Maggiori informazioni: Regolamento sull’IA

KI-Modell mit allgemeinem Verwendungszweck (GPAI model)

AI model displaying significant generality that can perform a wide range of distinct tasks and be integrated into downstream systems, such as a large language model. Obligations of model providers: Chapter V (Art. 53, 55). Maggiori informazioni: Regolamento sull’IA

KI-System

Machine-based system that operates with varying levels of autonomy and infers from its inputs how to generate predictions, content, recommendations or decisions. Software with purely fixed rules defined by humans is generally not an AI system. Maggiori informazioni: Regolamento sull’IA

KI-VO (Artificial Intelligence Act, Regulation (EU) 2024/1689)

EU regulation laying down harmonised rules on artificial intelligence: prohibition of certain practices, requirements for high-risk AI systems, transparency obligations and AI literacy. Amended by Regulation (EU) 2026/1744; the obligations for high-risk AI systems apply under Annex III from 2 December 2027 and under Annex I from 2 August 2028. Maggiori informazioni: Regolamento sull’IA

Konformitätsbewertung

Procedure for verifying whether a product meets the essential requirements, e.g. the cybersecurity requirements of the CRA. Depending on the product, carried out by the manufacturer itself or with the involvement of a notified body. Maggiori informazioni: CRA

KRITIS (Critical infrastructure)

Facilities whose failure would lead to significant supply shortages or threats to public safety, e.g. in energy, water or health. Operators of critical facilities have additional obligations under the BSIG and KRITIS-DachG. Maggiori informazioni: Legge quadro KRITIS (KRITIS-DachG)

M

MaschinenVO (Machinery Regulation, Regulation (EU) 2023/1230)

Replaces the Machinery Directive 2006/42/EC from 20 January 2027. For the first time, it contains requirements for protection against corruption, i.e. for the cybersecurity of control systems and software (Annex III). Maggiori informazioni: Regolamento macchine

MITRE ATT&CK (Knowledge base of the MITRE Corporation on attack tactics and techniques)

Public knowledge base of real attacks: what do attackers want to achieve (tactic), how do they proceed (technique), what helps against it (mitigation)? Two matrices: Enterprise for IT, ICS for controllers and plants. IDs such as T1133 (External Remote Services) or T0883 (Internet Accessible Device, ICS) describe scenarios consistently.

MTPD (Maximum Tolerable Period of Disruption)

Longest time a process may be disrupted before the damage to the company is no longer bearable. The recovery time objective (RTO) must be shorter. Maggiori informazioni: Gestione della continuità operativa (BCM)

N

NIS2 (Directive (EU) 2022/2555)

EU directive for a high common level of cybersecurity. It obliges essential and important entities to manage risks and to report significant security incidents; transposed in Germany in the BSIG. Maggiori informazioni: NIS2

NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act (NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz))

German law transposing the NIS2 Directive. At its core is the revised BSI Act (BSIG), with obligations for particularly important and important entities. Maggiori informazioni: NIS2

Notifizierte Stelle (also known as notified body (benannte Stelle))

Independent conformity assessment body that a Member State has notified to the European Commission. It must be involved, for example, for important products of class II and critical products under the CRA or for certain machinery from Annex I of the Machinery Regulation. Maggiori informazioni: CRA

NVD (National Vulnerability Database)

Vulnerability database of the US NIST. Supplements CVEs with CVSS scores, weakness types (CWE) and affected products as CPEs with version ranges. Maggiori informazioni: Vulnerability management

O

OT (Operational Technology)

Hardware and software that monitors and controls physical processes, e.g. PLC, HMI and SCADA in manufacturing, energy or water. Availability and the safety of people and plant usually take priority here. Maggiori informazioni: Asset management

P

Pseudonymisierung (Pseudonymisation of personal data)

Processing after which data can no longer be attributed to a person without additional information kept separately (Art. 4(5) GDPR). Pseudonymised data remain personal data but lower the risk. Maggiori informazioni: GDPR

PSIRT (Product Security Incident Response Team)

A manufacturer’s team that receives, assesses and fixes vulnerability reports on its own products and publishes security advisories. Helps with vulnerability handling under Annex I Part II CRA. Maggiori informazioni: CRA

Purdue-Modell (Purdue Enterprise Reference Architecture)

Layer model for industrial networks: level 0 field devices, 1 control (PLC), 2 supervision (HMI, SCADA), 3 operations management (MES), 3.5 industrial DMZ, 4 and 5 enterprise IT and internet. Helps with dividing into zones. Maggiori informazioni: IEC 62443

R

RED (Radio Equipment Directive 2014/53/EU)

EU directive for radio equipment. Since 1 August 2025, cybersecurity requirements (Art. 3(3)(d), (e), (f)) apply to connected radio equipment via Delegated Regulation (EU) 2022/30, specified by EN 18031. Maggiori informazioni: Direttiva sulle apparecchiature radio (RED)

RTO/RPO (Recovery Time Objective / Recovery Point Objective)

RTO (recovery time objective): target for when a process or service runs again after a disruption; it must be shorter than the maximum tolerable period of disruption (MTPD). RPO: maximum tolerable data loss, measured as the period since the last backup. Maggiori informazioni: Gestione della continuità operativa (BCM)

S

SBOM (Software Bill of Materials)

Machine-readable list of a product’s software components and their dependencies, e.g. in CycloneDX or SPDX format. The CRA requires it from manufacturers (Annex I Part II). Maggiori informazioni: Asset management

SCADA (Supervisory Control and Data Acquisition)

System for monitoring and controlling distributed plants with visualisation, alarms and data acquisition. Purdue level 2. Maggiori informazioni: Asset management

SDL (Secure development lifecycle)

Documented development process that embeds security from requirements through design, implementation and testing to updates and decommissioning. For suppliers of industrial components IEC 62443-4-1 describes the requirements in eight practices. Maggiori informazioni: IEC 62443 fabbricante

SL-T (Security Level Target)

IEC 62443: targeted security level of a zone or conduit (SL 1 to SL 4), derived from the risk assessment. Maggiori informazioni: IEC 62443

SoA (Statement of Applicability)

Mandatory document under ISO 27001. For each control in Annex A, it states whether it is applied, with justification and implementation status. Maggiori informazioni: ISO 27001

SPDX (Software Package Data Exchange (ISO/IEC 5962))

Open format of the Linux Foundation for SBOMs and licence information, standardised as ISO/IEC 5962. The SPDX licence identifiers (e.g. MIT, Apache-2.0) are also used by other formats. Maggiori informazioni: Asset management

SPS/PLC (Programmable Logic Controller (Speicherprogrammierbare Steuerung, SPS))

Industrial controller that reads sensors and controls actuators according to a program, e.g. Siemens S7. Purdue level 1. Maggiori informazioni: Asset management

T

TISAX (Trusted Information Security Assessment Exchange)

Automotive industry procedure in which companies have their information security checked by an approved audit provider and share the result with partners via the ENX platform. The result is a label, not a certificate. TISAX® is a registered trademark of the ENX Association. Maggiori informazioni: TISAX

TOM (Technical and organisational measures)

Measures for the security of processing personal data under Art. 32 GDPR, e.g. encryption, access control and backup. Maggiori informazioni: GDPR

V

VDA ISA (Information Security Assessment of the VDA)

Questionnaire of the German Association of the Automotive Industry (VDA) that a TISAX assessment checks against, with the modules information security, prototype protection and data protection. Maggiori informazioni: TISAX

VEX (Vulnerability Exploitability eXchange)

Machine-readable statement of whether a known vulnerability actually affects a product (e.g. “not affected”, “affected”, “fixed”). Complements the SBOM, but is not explicitly required by the CRA. Maggiori informazioni: Vulnerability management

VVT (Record of processing activities)

Mandatory record under Art. 30 GDPR listing purposes, data subjects, data categories, recipients, transfers to third countries, erasure periods and TOMs for each processing activity. The supervisory authority can request it at any time. Maggiori informazioni: GDPR

W

Wirtschaftsakteur

Umbrella term for manufacturers, authorised representatives, importers and distributors. Each role has its own obligations; anyone who markets a product under their own name or substantially modifies it becomes a manufacturer themselves. Maggiori informazioni: CRA

Z

Zone (Security zone according to IEC 62443)

Group of assets with the same security requirements, e.g. a manufacturing cell. An SL-T is defined for each zone. Maggiori informazioni: IEC 62443

Le spiegazioni sono semplificate e non sostituiscono la consulenza legale. Fanno fede le rispettive leggi e norme.