Słownik

A

Aktiv ausgenutzte Schwachstelle

CRA term: a vulnerability for which there is reliable evidence that it has been exploited by a malicious actor. Triggers the reporting obligation under Art. 14 CRA. Więcej na ten temat: CRA

Assessment-Level

Depth of the TISAX check: AL1 self-assessment only without a label, AL2 plausibility check with evidence and interviews, usually remote, AL3 comprehensive check on site. The label determines which level is needed. Więcej na ten temat: TISAX

AV/AVV (Data processing / Data processing agreement)

If a service provider processes personal data on your behalf, a contract under Art. 28 GDPR is required. Among other things, it governs being bound by instructions, sub-processors and TOMs. Więcej na ten temat: RODO

B

BBK (Federal Office of Civil Protection and Disaster Assistance (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe))

Central point of contact and competent authority under the KRITIS-DachG for the physical resilience of critical facilities. Operators register their critical facilities via a joint registration facility of the BBK and BSI. Więcej na ten temat: KRITIS-DachG (niemiecka ustawa o infrastrukturze krytycznej)

BCM (Business Continuity Management)

Planning and practising how critical business processes continue or are quickly restored in the event of disruption, e.g. according to ISO 22301 or BSI Standard 200-4. NIS2 requires business continuity and crisis management. Więcej na ten temat: Zarządzanie ciągłością działania (BCM)

Betroffenenrechte (Rights of the data subject)

Access, rectification, erasure, restriction, data portability, objection and protection against solely automated decisions (Art. 15 to 22 GDPR). Reply as a rule within one month (Art. 12(3) GDPR). Więcej na ten temat: RODO

BIA (Business impact analysis)

Analysis of how severe the damage becomes if a business process is disrupted for a certain time. The maximum tolerable period of disruption, the criticality and the recovery targets follow from it. Więcej na ten temat: Zarządzanie ciągłością działania (BCM)

BSI (Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik))

Germany’s federal cybersecurity authority. Receives reports under § 32 BSIG, supervises NIS2 entities and publishes IT-Grundschutz. Więcej na ten temat: NIS2

BSIG (Act on the Federal Office for Information Security (BSI Act, BSIG))

Governs the tasks of the BSI and the obligations of particularly important and important entities, including registration (§ 33), risk management (§ 30) and reporting obligations (§ 32). Więcej na ten temat: NIS2

C

CE (CE marking)

Marking with which the manufacturer declares that a product meets the applicable EU harmonisation legislation, e.g. the Machinery Regulation, RED and CRA. A conformity assessment is a prerequisite. Więcej na ten temat: CRA

Conduit (Communication channel according to IEC 62443)

Grouping of the communication paths between zones, e.g. a firewall connection with defined protocols. An SL-T is also defined for conduits. Więcej na ten temat: IEC 62443

CPE (Common Platform Enumeration)

Standardised name for hardware, an operating system or an application including version, e.g. cpe:2.3:h:vendor:product:version. Used for matching against vulnerability databases such as the NVD. Więcej na ten temat: Zarządzanie podatnościami

CRA (Cyber Resilience Act, Regulation (EU) 2024/2847)

EU regulation with cybersecurity requirements for products with digital elements across their entire lifecycle, including vulnerability handling. Manufacturers’ reporting obligations (Art. 14) apply from 11 September 2026, the other obligations from 11 December 2027. Więcej na ten temat: CRA

CSAF (Common Security Advisory Framework)

Machine-readable format (OASIS standard, JSON) for vendor security advisories, with affected products and versions, remediations and a profile for VEX. Vendors publish it via a provider-metadata.json, usually signed. Recommended by the BSI. Więcej na ten temat: Zarządzanie podatnościami

CSIRT (Computer Security Incident Response Team)

Body that receives and coordinates security incidents. Under the CRA, reports go via the ENISA reporting platform to the CSIRT designated as coordinator in the Member State of your main establishment. Więcej na ten temat: NIS2

CVD (Coordinated vulnerability disclosure)

Process in which reporters and manufacturers agree on how to handle a vulnerability and when to publish it. The CRA requires manufacturers to have such a policy (Annex I Part II point 5). Więcej na ten temat: CRA

CVE (Common Vulnerabilities and Exposures)

Globally unique identifier of a publicly known vulnerability, e.g. CVE-2024-3400. Assigned in the CVE programme by authorised bodies (CNAs). Więcej na ten temat: Zarządzanie podatnościami

CVSS (Common Vulnerability Scoring System)

Rates the severity of a vulnerability from 0.0 to 10.0 (none to critical), published by FIRST, widely used in versions 3.1 and 4.0. Says nothing about whether the vulnerability is actually being exploited. Więcej na ten temat: Zarządzanie podatnościami

CWE (Common Weakness Enumeration)

Catalogue of typical weakness types in software and hardware (MITRE), e.g. CWE-787 “Out-of-bounds write” or CWE-79 “Cross-site scripting”. Maps a CVE to its cause. Więcej na ten temat: Zarządzanie podatnościami

CycloneDX (OWASP CycloneDX (ECMA-424))

Open format for SBOMs (JSON or XML) by OWASP, standardised as ECMA-424. Describes components with supplier, purl, licence, checksums and dependencies and can also contain VEX statements. Więcej na ten temat: Zarządzanie zasobami

D

Datenpanne (Breach of the security of personal data)

Breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12) GDPR). Notify the supervisory authority where feasible within 72 hours and, in case of a high risk, also inform the data subjects (Art. 34). Więcej na ten temat: RODO

Defense in Depth (layered defence)

Security concept with several independent layers of protection, each of which still protects when another has been overcome (IEC 62443-4-1 SD-2). Więcej na ten temat: IEC 62443

DMZ (Demilitarised zone)

Separate network segment between two networks, e.g. office IT and OT, through which data is only exchanged in a controlled manner. There are no direct connections between the networks. Więcej na ten temat: IEC 62443

DSB (Data protection officer)

Advises and monitors the controller on data protection, acts free of instructions and is the contact point for the supervisory authority (Art. 37 to 39 GDPR). Whether a designation is mandatory depends on the activity and on national law (in Germany § 38 BDSG). Więcej na ten temat: RODO

DSFA (Data protection impact assessment)

Prior assessment of processing likely to result in a high risk to data subjects: description, necessity, risks and remedial measures (Art. 35(7) GDPR). If a high risk remains, the supervisory authority must be consulted beforehand (Art. 36). Więcej na ten temat: RODO

DSGVO (General Data Protection Regulation, Regulation (EU) 2016/679)

EU regulation on the protection of personal data. Particularly important for information security: Art. 32 (security of processing) and Art. 33 (notification of personal data breaches within 72 hours). Więcej na ten temat: RODO

E

EN 18031 (Harmonisierte Normen EN 18031-1, -2 und -3)

European standards with cybersecurity requirements for radio equipment under the RED: Part 1 network protection, Part 2 protection of personal data, Part 3 protection against fraud. Więcej na ten temat: Dyrektywa w sprawie urządzeń radiowych

ENISA (European Union Agency for Cybersecurity)

EU agency for cybersecurity. Among other things, it operates the single reporting platform for reports under the CRA and the European Vulnerability Database (EUVD). Więcej na ten temat: CRA

EoL (End of Life / End of Support)

Point in time from which the vendor no longer supports a product, in particular no longer provides security updates (end of vendor support). Some vendors then still offer paid extended security updates (ESU). Such assets need replacing or documented compensating measures. Więcej na ten temat: Zarządzanie zasobami

EPSS (Exploit Prediction Scoring System)

Probability (0 to 1), calculated daily by FIRST, that a vulnerability will be exploited in the next 30 days. Complements CVSS for prioritisation. Więcej na ten temat: Zarządzanie podatnościami

Erheblicher Sicherheitsvorfall

Security incident that causes or can cause severe operational disruption or financial loss, or considerable damage to others. Triggers the reporting obligation under § 32 BSIG. Więcej na ten temat: NIS2

EU-Konformitätserklärung (DoC, Declaration of Conformity)

Manufacturer’s declaration that its product meets the essential requirements of the applicable EU legal acts. With it, the manufacturer assumes responsibility; it is a prerequisite for CE marking. Więcej na ten temat: CRA

EUVD (European Vulnerability Database)

Database of publicly known vulnerabilities in ICT products and services, operated by ENISA under Art. 12(2) NIS2. Więcej na ten temat: Zarządzanie podatnościami

F

Frühwarnung (in the BSIG: frühe Erstmeldung)

First reporting stage: no later than 24 hours after becoming aware of a significant security incident (Art. 23 NIS2) or an actively exploited vulnerability or severe incident (Art. 14 CRA). The BSIG calls it “frühe Erstmeldung” (§ 32 BSIG). Więcej na ten temat: NIS2

G

Gap-Analyse

Self-assessment of how far a measure is implemented today, compared with the target level. The difference is the gap. Więcej na ten temat: Zarządzanie zgodnością

H

HinSchG (Whistleblower Protection Act)

German act protecting persons who report violations; implements Directive (EU) 2019/1937. Employers with 50 or more employees must set up an internal reporting office. Więcej na ten temat: HinSchG

Hochrisiko-KI-System

AI system used as a safety component of a product under Annex I that requires third-party assessment (Art. 6(1)) or in an area listed in Annex III, such as recruitment or creditworthiness (Art. 6(2)). AI used exclusively for quality control is not a safety component. Więcej na ten temat: Akt w sprawie AI

I

IACS (Industrial Automation and Control System)

Industrial automation and control system: personnel, hardware, software and policies that enable the secure operation of an industrial process. Central term of IEC 62443. Więcej na ten temat: IEC 62443

IEC 62443 (ISA/IEC 62443 series)

Series of standards on the security of industrial automation and control systems (IACS), with parts for asset owners (2-x), systems (3-x) and component manufacturers (4-x). Core concepts are zones, conduits and security levels. Więcej na ten temat: IEC 62443

ISB (Information security officer)

Person who coordinates the ISMS, advises management and reports to it on the state of information security. Often also called CISO. Więcej na ten temat: ISO 27001

ISMS (Information security management system)

Rules, processes and responsibilities with which an organisation systematically manages, reviews and improves information security, e.g. according to ISO 27001 or IT-Grundschutz. Więcej na ten temat: ISO 27001

ISO 27001 (ISO/IEC 27001)

International standard with requirements for an ISMS. Certifiable; Annex A of the 2022 edition contains 93 controls. Więcej na ten temat: ISO 27001

ISO 27002 (ISO/IEC 27002)

Guidance on the controls in Annex A of ISO 27001 with purpose and implementation guidance. Not certifiable. Więcej na ten temat: ISO 27001

IT-Grundschutz (BSI IT-Grundschutz (BSI-GS))

BSI methodology based on BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium, which can be used to build an ISMS and obtain ISO 27001 certification on the basis of IT-Grundschutz. Więcej na ten temat: IT-Grundschutz

K

KEV (Known Exploited Vulnerabilities Catalog)

List by the US agency CISA of vulnerabilities that are known to be exploited. A good indicator of what should be fixed first. Więcej na ten temat: Zarządzanie podatnościami

KI-Kompetenz

Skills, knowledge and understanding for the informed deployment of AI systems (Art. 3(56)). Since 2 February 2025 providers and deployers take measures to support the AI literacy of their staff; since Regulation (EU) 2026/1744 without guaranteeing a specific level. Więcej na ten temat: Akt w sprawie AI

KI-Modell mit allgemeinem Verwendungszweck (GPAI model)

AI model displaying significant generality that can perform a wide range of distinct tasks and be integrated into downstream systems, such as a large language model. Obligations of model providers: Chapter V (Art. 53, 55). Więcej na ten temat: Akt w sprawie AI

KI-System

Machine-based system that operates with varying levels of autonomy and infers from its inputs how to generate predictions, content, recommendations or decisions. Software with purely fixed rules defined by humans is generally not an AI system. Więcej na ten temat: Akt w sprawie AI

KI-VO (Artificial Intelligence Act, Regulation (EU) 2024/1689)

EU regulation laying down harmonised rules on artificial intelligence: prohibition of certain practices, requirements for high-risk AI systems, transparency obligations and AI literacy. Amended by Regulation (EU) 2026/1744; the obligations for high-risk AI systems apply under Annex III from 2 December 2027 and under Annex I from 2 August 2028. Więcej na ten temat: Akt w sprawie AI

Konformitätsbewertung

Procedure for verifying whether a product meets the essential requirements, e.g. the cybersecurity requirements of the CRA. Depending on the product, carried out by the manufacturer itself or with the involvement of a notified body. Więcej na ten temat: CRA

KRITIS (Critical infrastructure)

Facilities whose failure would lead to significant supply shortages or threats to public safety, e.g. in energy, water or health. Operators of critical facilities have additional obligations under the BSIG and KRITIS-DachG. Więcej na ten temat: KRITIS-DachG (niemiecka ustawa o infrastrukturze krytycznej)

M

MaschinenVO (Machinery Regulation, Regulation (EU) 2023/1230)

Replaces the Machinery Directive 2006/42/EC from 20 January 2027. For the first time, it contains requirements for protection against corruption, i.e. for the cybersecurity of control systems and software (Annex III). Więcej na ten temat: Rozporządzenie w sprawie maszyn

MITRE ATT&CK (Knowledge base of the MITRE Corporation on attack tactics and techniques)

Public knowledge base of real attacks: what do attackers want to achieve (tactic), how do they proceed (technique), what helps against it (mitigation)? Two matrices: Enterprise for IT, ICS for controllers and plants. IDs such as T1133 (External Remote Services) or T0883 (Internet Accessible Device, ICS) describe scenarios consistently.

MTPD (Maximum Tolerable Period of Disruption)

Longest time a process may be disrupted before the damage to the company is no longer bearable. The recovery time objective (RTO) must be shorter. Więcej na ten temat: Zarządzanie ciągłością działania (BCM)

N

NIS2 (Directive (EU) 2022/2555)

EU directive for a high common level of cybersecurity. It obliges essential and important entities to manage risks and to report significant security incidents; transposed in Germany in the BSIG. Więcej na ten temat: NIS2

NIS2UmsuCG (NIS2 Implementation and Cybersecurity Strengthening Act (NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz))

German law transposing the NIS2 Directive. At its core is the revised BSI Act (BSIG), with obligations for particularly important and important entities. Więcej na ten temat: NIS2

Notifizierte Stelle (also known as notified body (benannte Stelle))

Independent conformity assessment body that a Member State has notified to the European Commission. It must be involved, for example, for important products of class II and critical products under the CRA or for certain machinery from Annex I of the Machinery Regulation. Więcej na ten temat: CRA

NVD (National Vulnerability Database)

Vulnerability database of the US NIST. Supplements CVEs with CVSS scores, weakness types (CWE) and affected products as CPEs with version ranges. Więcej na ten temat: Zarządzanie podatnościami

O

OT (Operational Technology)

Hardware and software that monitors and controls physical processes, e.g. PLC, HMI and SCADA in manufacturing, energy or water. Availability and the safety of people and plant usually take priority here. Więcej na ten temat: Zarządzanie zasobami

P

Pseudonymisierung (Pseudonymisation of personal data)

Processing after which data can no longer be attributed to a person without additional information kept separately (Art. 4(5) GDPR). Pseudonymised data remain personal data but lower the risk. Więcej na ten temat: RODO

PSIRT (Product Security Incident Response Team)

A manufacturer’s team that receives, assesses and fixes vulnerability reports on its own products and publishes security advisories. Helps with vulnerability handling under Annex I Part II CRA. Więcej na ten temat: CRA

Purdue-Modell (Purdue Enterprise Reference Architecture)

Layer model for industrial networks: level 0 field devices, 1 control (PLC), 2 supervision (HMI, SCADA), 3 operations management (MES), 3.5 industrial DMZ, 4 and 5 enterprise IT and internet. Helps with dividing into zones. Więcej na ten temat: IEC 62443

R

RED (Radio Equipment Directive 2014/53/EU)

EU directive for radio equipment. Since 1 August 2025, cybersecurity requirements (Art. 3(3)(d), (e), (f)) apply to connected radio equipment via Delegated Regulation (EU) 2022/30, specified by EN 18031. Więcej na ten temat: Dyrektywa w sprawie urządzeń radiowych

RTO/RPO (Recovery Time Objective / Recovery Point Objective)

RTO (recovery time objective): target for when a process or service runs again after a disruption; it must be shorter than the maximum tolerable period of disruption (MTPD). RPO: maximum tolerable data loss, measured as the period since the last backup. Więcej na ten temat: Zarządzanie ciągłością działania (BCM)

S

SBOM (Software Bill of Materials)

Machine-readable list of a product’s software components and their dependencies, e.g. in CycloneDX or SPDX format. The CRA requires it from manufacturers (Annex I Part II). Więcej na ten temat: Zarządzanie zasobami

SCADA (Supervisory Control and Data Acquisition)

System for monitoring and controlling distributed plants with visualisation, alarms and data acquisition. Purdue level 2. Więcej na ten temat: Zarządzanie zasobami

SDL (Secure development lifecycle)

Documented development process that embeds security from requirements through design, implementation and testing to updates and decommissioning. For suppliers of industrial components IEC 62443-4-1 describes the requirements in eight practices. Więcej na ten temat: Producent IEC 62443

SL-T (Security Level Target)

IEC 62443: targeted security level of a zone or conduit (SL 1 to SL 4), derived from the risk assessment. Więcej na ten temat: IEC 62443

SoA (Statement of Applicability)

Mandatory document under ISO 27001. For each control in Annex A, it states whether it is applied, with justification and implementation status. Więcej na ten temat: ISO 27001

SPDX (Software Package Data Exchange (ISO/IEC 5962))

Open format of the Linux Foundation for SBOMs and licence information, standardised as ISO/IEC 5962. The SPDX licence identifiers (e.g. MIT, Apache-2.0) are also used by other formats. Więcej na ten temat: Zarządzanie zasobami

SPS/PLC (Programmable Logic Controller (Speicherprogrammierbare Steuerung, SPS))

Industrial controller that reads sensors and controls actuators according to a program, e.g. Siemens S7. Purdue level 1. Więcej na ten temat: Zarządzanie zasobami

T

TISAX (Trusted Information Security Assessment Exchange)

Automotive industry procedure in which companies have their information security checked by an approved audit provider and share the result with partners via the ENX platform. The result is a label, not a certificate. TISAX® is a registered trademark of the ENX Association. Więcej na ten temat: TISAX

TOM (Technical and organisational measures)

Measures for the security of processing personal data under Art. 32 GDPR, e.g. encryption, access control and backup. Więcej na ten temat: RODO

V

VDA ISA (Information Security Assessment of the VDA)

Questionnaire of the German Association of the Automotive Industry (VDA) that a TISAX assessment checks against, with the modules information security, prototype protection and data protection. Więcej na ten temat: TISAX

VEX (Vulnerability Exploitability eXchange)

Machine-readable statement of whether a known vulnerability actually affects a product (e.g. “not affected”, “affected”, “fixed”). Complements the SBOM, but is not explicitly required by the CRA. Więcej na ten temat: Zarządzanie podatnościami

VVT (Record of processing activities)

Mandatory record under Art. 30 GDPR listing purposes, data subjects, data categories, recipients, transfers to third countries, erasure periods and TOMs for each processing activity. The supervisory authority can request it at any time. Więcej na ten temat: RODO

W

Wirtschaftsakteur

Umbrella term for manufacturers, authorised representatives, importers and distributors. Each role has its own obligations; anyone who markets a product under their own name or substantially modifies it becomes a manufacturer themselves. Więcej na ten temat: CRA

Z

Zone (Security zone according to IEC 62443)

Group of assets with the same security requirements, e.g. a manufacturing cell. An SL-T is defined for each zone. Więcej na ten temat: IEC 62443

Wyjaśnienia są uproszczone i nie zastępują porady prawnej. Rozstrzygające są właściwe ustawy i normy.