{"id":73418,"date":"2026-08-05T22:34:38","date_gmt":"2026-08-05T20:34:38","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73418"},"modified":"2026-08-05T22:34:38","modified_gmt":"2026-08-05T20:34:38","slug":"dora-kritis-standards","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/cybersecurity-resilienz\/dora-kritis-standards\/","title":{"rendered":"DORA, KRITIS and other reference framework"},"content":{"rendered":"
\"Cybersecurity<\/span>

\u2190 Cybersecurity & Resilience<\/a><\/p>

DORA, KRITIS and other reference framework<\/h1>

Clearly distinguish between sets of rules and standards so that measures, responsibilities and evidence fit together.<\/strong><\/p><\/div><\/div>\n\n\n\n

DORA is relevant for the financial sector and ICT risks, BSIG\/NIS2 for the cybersecurity of affected entities and KRITIS-Umbrella Act\/CER for the physical and organisational resilience of critical assets. ISO\/IEC 27001 is a certifiable ISMS, BSI IT-Grundschutz is a methodology and TISAX is a testing and exchange mechanism for the automotive industry. None of these sets of rules replaces the examination of another.<\/p>\n<\/div>\n\n\n

Relationship to services and technologies<\/h2>\n\n
\"Cybersecurity<\/figure>
\n

Here we compare application areas and technical reference points of DORA, KRITIS and standards. The binding impact assessment is carried out by the responsible specialist and legal functions; general security services are below IT Security & Compliance<\/a> described.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Background<\/h2>\n\n

When a company considers several requirements in parallel, terms are easily mixed up: a certificate is confused with a legal obligation or a technical control is understood as complete proof. This leads to unclear responsibilities, duplication of work and gaps in operations.<\/p>\n\n\n\n

The aim is therefore initially to create a reliable map: which companies, services and supply relationships are being considered? Which set of rules or standards serves which purpose? And which decisions, controls and evidence can be sensibly managed together?<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n
\"IT-Security-Spezialistin<\/figure>
\n

DORA<\/strong> (Regulation (EU) 2022\/2554) is aimed at the financial companies mentioned in Article 2 as well as certain third-party ICT service providers. It has been applicable since January 17, 2025 and regulates, among other things, governance, ICT risk management, incident management, resilience testing and ICT third-party risks.<\/p>\n<\/div><\/div>\n\n\n\n

BSIG\/NIS2<\/strong> concerns the digital protection of affected institutions. KRITIS Umbrella Act\/CER<\/strong> has supplemented this since March 17, 2026 for the physical and organisational resilience of critical systems. Both levels must be checked separately. Threshold values, criticality regulations and implementing regulations can change and must be checked against the current legal status.<\/p>\n\n\n\n

NIS2<\/strong> is an EU cybersecurity directive whose obligations are implemented nationally. It is not a security standard or a general certification. The practical implementation logic explained Implement NIS2 in practice<\/a>.<\/p>\n\n\n\n

ISO\/IEC 27001:2022<\/strong> is an international standard for information security management systems. BSI IT-Grundschutz<\/strong> With BSI standards and the compendium, offers a method and concrete building blocks for information security. TISAX<\/strong> is an audit information exchange mechanism used by the automotive industry. These frames of reference can structure requirements, but do not determine the legal applicability of DORA, NIS2 or KRITIS.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n