{"id":73411,"date":"2026-08-05T22:34:11","date_gmt":"2026-08-05T20:34:11","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73411"},"modified":"2026-08-05T22:34:11","modified_gmt":"2026-08-05T20:34:11","slug":"cybersecurity-resilienz","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/cybersecurity-resilienz\/","title":{"rendered":"Cybersecurity & Resilience"},"content":{"rendered":"
\"Cybersecurity<\/span>

\u2190 Implement regulatory requirements securely<\/a><\/p>

Cybersecurity & Resilience<\/h1>

Structure cybersecurity requirements so that responsibility, protection measures and operations fit together.<\/strong><\/p><\/div><\/div>\n\n\n\n

NIS2, Cyber Resilience Act (CRA), DORA and KRITIS address different starting points: organisations, digital products, financial companies and critical infrastructure. Together they require resilient risk management. The sensible way to start is therefore not a collection of individual controls, but rather a clear impact assessment with legal advice as well as an implementable plan for governance, supply chain, incident response and evidence.<\/p>\n<\/div>\n\n\n

Relationship to services and technologies<\/h2>\n\n
\"Cybersecurity<\/figure>
\n

This page classifies regulatory security requirements and evidence. For the selection and implementation of specific security services in the Microsoft stack, the entry leads to the solution IT Security & Compliance<\/a>.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Background<\/h2>\n\n

In many companies, security measures grow historically: a new endpoint product, a process for suppliers, an emergency plan. It often remains unclear to management and IT which risk is being addressed, who decides and which evidence is available in the event of an emergency or to auditors. Regulatory requirements make these gaps visible, but do not replace prioritization.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n
\"IT-Security-Spezialistin<\/figure>
\n

NIS2\/BSIG<\/strong> concerns the cybersecurity of certain institutions in Germany. DORA<\/strong> has been applicable to the financial sector since January 17, 2025 and concerns digital operational resilience and ICT third-party risks. KRITIS Umbrella Act<\/strong> has also applied to the physical and organisational resilience of critical systems since March 17, 2026; it must be separated from digital protection according to BSIG\/NIS2. The CRA<\/strong> On the other hand, it is aimed at manufacturers and other economic actors for products with digital elements.<\/p>\n<\/div><\/div>\n\n\n\n

For product obligations, the page leads Cyber Resilience Act<\/a> further. The NIS2 implementation logic explained Implement NIS2 in practice<\/a>; DORA, KRITIS and standards border DORA, KRITIS and Standards<\/a> from.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n