Information Security & Standards

There are many NIS2 software solutions that can support companies in implementing the requirements. Generally, they all claim to be "NIS2 ready." For SMEs, it is more important to consider who the solution was built for, how complex the implementation is, and what happens when additional requirements are added to NIS2. This comparison provides guidance for choosing the right provider.

How much does ISO 27001 certification truly cost? The answer depends on company size, maturity level, and scope – and therefore varies widely. Only looking at the audit underestimates the total costs. This article outlines all relevant cost components, typical price ranges by company size, and the most important levers to strategically manage effort and budget.

An Information Security Management System (ISMS) allows you to systematically protect your organization's internal and external information from unauthorized access. This overview summarizes the key facts about ISMS and best practices for its implementation.

A robust Information Security Management System (ISMS) forms the backbone of an effective corporate security strategy. Learn how to implement such a system in your company to keep hackers at bay.

The NIS2 Implementation Act has been in force since December 6, 2025. From now on, compliance officers must report significant security incidents within 24 hours. This guide shows you what other deadlines apply and how to safely meet them in an emergency.

The GDPR is based on a simple principle: the higher the risk to the individuals involved, the more extensive the protective measures must be. Risk analysis is therefore the foundation for almost all data protection decisions within a company—from selecting technical measures and reporting data breaches to determining whether a data protection impact assessment is required. This article explains how it works in practice.

Data security and data protection are not synonyms, but two important tasks for companies. Learn how to clearly distinguish between both areas and implement them efficiently.

Data security is of paramount importance in the digital age. This is especially true for companies that manage and process large volumes of data—such as that of customers, suppliers, business partners, and employees. Data security officer, IT security officer, data protection officer—at first glance, these terms seem almost identical and interchangeable. However, a closer look reveals distinct differences.

The General Data Protection Regulation (GDPR) requires companies to implement technical and organizational measures (TOMs) to ensure the secure processing of personal data. TOMs are the foundation of any GDPR-compliant data processing. In this guide, you will learn which measures are mandatory, how the 14 control areas work, and how to document your TOMs in a legally compliant manner—including practical tips for remote work and data processing agreements.

WeTransfer is a popular online service for sending large file attachments – but what about data protection? Discussions surrounding access rights in the terms and conditions and data storage on US servers raise important questions for compliance officers. This article provides a GDPR compliance check and demonstrates how SwissTransfer performs as a data protection-compliant alternative.

Google continues to dominate the global search engine market with a share of around 92% – but awareness of data protection and compliance requirements has fundamentally changed. For compliance officers in medium-sized companies, the question increasingly arises: How can we ensure secure, GDPR-compliant search processes? This article introduces 7 data protection-compliant search engine alternatives.

After years of criticism from data protection authorities, Google is taking action: starting April 2, 2026, Google will process reCAPTCHA data under a data processing agreement (DPA). This article explains what this means for your company and the steps you need to take now.

NIS2 requires supply chain security, GDPR demands transparent data processing, and DORA targets ICT security in the financial sector. Those who don't fully control their IT systems and data will struggle to meet these regulations. Digital sovereignty is therefore no longer a nice-to-have, but a prerequisite for demonstrable compliance.

Hybrid attacks, political tensions, and sabotage demonstrate: Germany is in the midst of a permanent cyber conflict – and SMEs are part of the attack surface. Companies that are not resilient could inadvertently become entangled in geopolitical conflicts.

In a world where cyberattacks are becoming increasingly frequent and sophisticated, information security and data protection are essential for organizations. The international standard ISO 27001 helps organizations reduce cyber risks using the ISO 27001 Controls from Annex A. Learn everything about the ISO 27001 Controls and how to successfully implement these measures.

IT service providers regularly process personal data as part of their operations—whether through storage in cloud services, access during technical support, or the extraction and analysis of data via specialized software. Because this access to personal data is so central to their work, data protection and GDPR compliance are of critical importance for IT service providers. We explain what you need to keep in mind.

Even today, executives are obliged to ensure IT security. However, with the new NIS2 directive, it becomes clear: responsibility unequivocally lies with management. Anyone who ignores obligations, fails to monitor measures, or foregoes training may be held personally liable. The NIS2 implementation act has been in force in Germany since December 6, 2025 – without a transition period. Learn everything about NIS2 liability in this article and why IT security is a top management priority.

NIS2 brings comprehensive cybersecurity requirements for companies. The following article outlines the obligations that affected organizations must meet as of December 6, 2025, and how your organization can efficiently master the EU's NIS2 requirements.

ChatGPT is sparking global curiosity about Artificial Intelligence. Around 500 million people interact with the chatbot weekly. But with the hype, concerns from data protection experts are also growing. How secure is ChatGPT regarding data protection, and do companies have to forgo the AI tool?

it-sa 2025 in Nuremberg impressively demonstrated: Information security is no longer a theoretical exercise – it's a business-critical reality for German SMEs. Amidst crowded exhibition aisles and intense discussions, a clear picture emerged: companies are not looking for the perfect solution, but for pragmatic answers to urgent compliance questions. From NIS2 and digital sovereignty to AI governance – regulatory requirements are growing rapidly, while internal resources remain limited. This report summarizes the key findings of our panel discussion "Risk Exposure – What Does AI Really Change?" and provides concrete recommendations for SMEs.

With an ISO risk assessment, IT and InfoSec managers lay the groundwork for an effective ISMS that protects their company from cyberattacks and data loss and helps meet GDPR and NIS2 requirements. In this practical guide, you will learn everything about ISO risk analysis and the role Annex A and the SoA play.

Information security is relevant for all industries – the automotive industry, for example, agreed some time ago to adopt TISAX® certification to ensure consistent security standards. This article explains what this certification entails, what requirements companies must meet, and how much it costs.

When it comes to the security of IT systems and data, ISO 27001 and TISAX® are often mentioned. These are certifications that demonstrate your company takes cybersecurity and data protection seriously. We explain the basics of both standards and show you which one is truly relevant for your company.

Information security is relevant across all industries, and the automotive sector even has its own certification for companies that implement specific measures to protect information. This article breaks down the costs of this hallmark of cybersecurity.

Have you ever been a victim of identity theft? In the digital age, it happens faster than ever before. With inadequately protected data, it is easy for hackers to collect information and use it for malicious purposes.

The entry into force of the General Data Protection Regulation (GDPR) has created an urgent need for action for many agencies and companies. If you have not yet taken a closer look at data protection law and the legal requirements for data transfers via the internet, email, or fax: the stricter rules on data security and data transfers have been in effect since May 2018. But what exactly constitutes a data transfer?

Data security encompasses the protection of all data, while data privacy is a subset of this field, focusing specifically on the protection of personal data. To ensure both, it is recommended that companies establish a data security concept. Data security is an integral part of data privacy and describes a concrete approach for companies to comply with data protection laws, ensuring the necessary framework for the collection, processing, and use of personal data. Because data security and the broader field of data privacy are closely linked to corporate IT, this is often referred to as information security. A data security concept must be tailored to the individual needs of each company. We explain what you need to keep in mind.

When personal telecommunications data is stored by public authorities—or on their behalf—without a specific cause, this is referred to as data retention. As a precursor to telecommunications surveillance, data retention is one of the most controversial areas of data protection law. Corresponding legal provisions have been struck down multiple times by both the Federal Constitutional Court and the European Court of Justice.

For companies, knowledge is capital. These trade secrets have significant economic value and must not fall into the hands of unauthorized third parties. It is not just large corporations but also startups that possess sensitive trade secrets worthy of protection, which are subject to confidentiality requirements and can secure a competitive advantage. With the entry into force of the Trade Secret Act (GeschGehG), every company must demonstrate that it protects its know-how through measures that are both externally recognizable and appropriate.

Rapid technological development and globalization have led to the processing of increasingly vast and almost intangible amounts of data. The collection, processing, and exchange of personal data have grown immensely in recent years, posing ever-greater challenges for data protection. Consequently, companies must strictly adhere to specific legal requirements when handling data. Violations not only risk criminal sanctions but also result in a significant and lasting loss of trust among customers and employees. Particularly when using the internet, corporate data protection obligations often prove to be highly complex.

Data misuse occurs when personal data such as names, contact details, or account information is used against a person's will to commit potentially criminal acts. To protect personal and thus sensitive data from such misuse, there are, among other things, data protection laws and the General Data Protection Regulation (GDPR). This form of data misuse can take many different forms in practice and sometimes has serious consequences: from identity theft to corporate bankruptcy.

In an increasingly digitized world, passwords serve as the first line of defense for our personal data. But how secure are these traditional passwords really? Given the constant evolution of technology and the growing threat of cybercrime, it is essential to evaluate and understand various authentication methods.

IT companies are facing major challenges: cyber threats are growing, yet they cannot afford to fall behind in the digitalization race. Here is how data protection helps balance IT security with progress.

The BSI status report provides regular updates on the state of IT security in Germany. The latest report presents alarming findings. We have summarized the 5 most important takeaways and show you how to protect your company.

Are digitalization and data protection eternal antagonists? Digital processes generate floods of data, while data protection advocates for a frugal and minimalist approach, especially regarding personal information. Despite this apparent conflict, data protection and digitalization are more closely linked than they might seem.

The GDPR mandates data protection through technology design via privacy by design. Furthermore, privacy by default is intended to ensure data-friendly settings from the outset. In practice, this does not always work as intended.

How secure is the data you store in Google Drive? And can that security be improved? We have put together information and tips on Google Drive and data privacy to ensure your data stays truly secure.

The GDPR sets high standards for passwords. Password managers make it easy to keep track of numerous, complex passwords. Which password managers are recommended for businesses?

The European Union is currently working on a digital identity wallet. This will allow EU citizens to identify themselves more easily online and store important documents, such as ID cards or driver's licenses, in a digital format. The digital wallet will also be relevant for businesses. However, data protection advocates see more than just benefits in this development.

In today's digital era, external cyberattacks on companies are no longer unusual and are a well-known risk. Yet, despite all the justified fear of external threats, an increasingly underestimated risk is coming into focus: data theft from within the organization.

The ongoing digitalization of the healthcare sector, particularly regarding the handling of patient data on the electronic health card (eGK), raises important questions about data privacy in medicine.

Using WhatsApp for business? From a data protection perspective, it’s not a great idea, as app providers are also subject to the GDPR. We highlight the risks and introduce popular messenger alternatives like Threema and Signal.

The CRM tool HubSpot is a valuable asset for companies in customer acquisition and sales. However, storing large amounts of personal data also raises data protection concerns. Read on to learn about the applicable regulations.

Aufmerksame Besitzer eines neuen Android-Gerätes haben es vielleicht schon entdeckt: die Suchmaschine Presearch als Alternative zu Google. Auch wenn die Bekanntheit und ihr Marktanteil noch sehr gering sind, ist das Auftauchen von Presearch auf dem Smartphone Grund genug, dass wir uns diese Suchmaschine hinsichtlich Datenschutz genauer anschauen.

Fingerprint devices are used in both private and professional settings, for example, to secure hardware. But what about data protection when it comes to these fingerprint scanners? And what other security concerns should be considered?

They really do still exist—clattering fax machines that are by no means confined to dusty offices. But what about the issue of data protection and faxing? Do they actually go together?

The electronic patient record, or ePA for short, is a divisive topic: will it give the German healthcare system a much-needed digital boost, or does it primarily pose a data privacy risk? We provide an overview of the digital patient record and data protection.

Mobile Device Management (MDM) solutions help companies easily implement various GDPR requirements. Our partner Lendis explains what you need to know.

IT maintenance is often carried out via remote access. Companies, in particular, must strictly adhere to data protection regulations in the process. What does the GDPR stipulate regarding remote maintenance?

Virtual Private Networks (VPNs) enhance security and privacy online, both at work and in your personal life. But what exactly does that mean, and which aspects of data protection are involved? We’ll break it down for you.

Telegram has long been considered a secure alternative to WhatsApp and similar apps because it does not require a phone number. However, this enthusiasm waned as more radical groups began using the platform for bot services and planning criminal activities. Criticism regarding data privacy has also grown louder; learn more about Telegram's data privacy practices here.

As of January 1, 2022, electronic prescriptions are mandatory in all medical practices. However, e-prescriptions have also raised concerns regarding the sensitive data stored within them. Read on to learn how e-prescriptions align with data protection standards.

Medical appointment booking portals promise users a simple and straightforward way to schedule and manage doctor visits. Recently, the booking platform Doctolib has come under scrutiny by the Berlin Commissioner for Data Protection. This raises the question: is sensitive data being adequately protected, and what should we as consumers keep in mind when booking appointments online?

Online networks like LinkedIn make it easier to build and maintain professional connections. However, the information users are required to provide is usually personal data and should be protected accordingly.

It’s not just during the pre-Christmas rush that online shopping surges. However, shopping online can become problematic if consumers end up on shady websites. Here is what you should look out for when shopping online and how to spot dangerous fake shops.

Due to the COVID-19 pandemic, the video conferencing tool Zoom gained more than 150 million new users almost overnight. Internet trolls looking to exploit the situation were quick to act, leading to the rise of what is known as "Zoombombing."

Videos are one of the most important means of communication today, and YouTube is one of the largest video platforms in existence. But how does YouTube handle data privacy and GDPR compliance?

Is Signal a secure messenger? As an alternative to the market leader WhatsApp, Signal is becoming increasingly popular. But how does Signal stack up when it comes to data privacy, GDPR, and related issues?

What will I look like when I’m old? Should I get preventative fillers for any potential wrinkles? To answer these questions, FaceApp helps with digital aging. However, what the app does with the data provided and the state of FaceApp’s data privacy is alarming.

To ensure that data protection remains a priority during digital work—even in times of COVID-19 and widespread remote work—we have compiled the best data privacy tips for screensharing.