NIS2 / BSIG / CRA

NIS2 Terminology Glossary

229 terms from NIS2, the BSIG and the CRA, in plain words. Where a course uses the term, you see the lesson and the sentence.

Simon Orzel·Continuously reviewed

The definitions come from the dictionaries of our courses. The same texts appear when you hover over a term anywhere in the wiki. A term with a German name is also listed under that name and points to the English entry, because the EU texts and our courses use the English term. Where we know the provision a definition rests on, it is printed below the text.

#

§ 30 BSIG: Cybersecurity measures: The central provision of NIS2 in German law. Lists ten categories of cybersecurity risk management measures that all in-scope entities must implement. Covers risk assessment, incident handling, business continuity, supply chain security, secure development, effectiveness assessment, training, cryptography, access control, and multi-factor authentication. The measures must be 'appropriate, proportionate and effective': not gold-plated, but genuine.; §30 BSIG
§ 32 BSIG: Incident reporting: The mandatory incident reporting cascade. When a significant incident occurs: early warning to the BSI within 24 hours of becoming aware, incident notification within 72 hours, an interim report if the BSI asks, and a final report no later than one month after the 72-hour notification (a progress report instead, if the incident is still ongoing). Each stage has specific content requirements. Late or missing reports are separate violations with their own penalty provisions (§65(2) no. 4 and 5 BSIG).; §32 BSIG
§ 33 BSIG: Registration obligation: The legal obligation for all in-scope entities to register with the BSI. You provide entity information, sector classification, cybersecurity contact details, and IP address ranges. Non-registration is a standalone violation punishable by fines up to €500,000, separate from any penalties for failing to implement actual security measures.; §33 BSIG
§ 38 BSIG: Implementation and oversight duty: The provision that obliges the management body to implement the risk management measures required under §30 BSIG and supervise their implementation (§38(1) BSIG), and to attend regular training on cybersecurity risks (§38(3) BSIG). The duty to approve those measures is set in Art. 20(1) NIS 2; §38(1) itself names implementing and supervising. Breaching the implementation and supervision duties makes management liable to its company for culpably caused damage, under the company-law rules for its legal form (§38(2) BSIG). Whether the company can waive such claims depends on that company law; §38 says nothing on it. This is the paragraph that gets managing directors' attention.; §38(1)-(3) BSIG

A

Access control: The policies and mechanisms that restrict who can access systems and data.; People and access: (g) cyber hygiene and staff training, (h) cryptography policies, (i) human resources security, access control, and asset management, and (j) multi-factor authentication and secured communications.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
access review: A periodic check of who has access to what, to remove permissions that are no longer needed.
Actively exploited vulnerability: A vulnerability in your product for which there is reliable evidence that a malicious actor has exploited it in a system without the permission of the system owner (Article 3(42) CRA). The trigger for the notification duty in Article 14(1) CRA, which starts with an early warning within 24 hours (Article 14(2)(a)). Distinguished from a publicly disclosed but not yet exploited vulnerability.; The obligation is triggered by an actively exploited vulnerability, a vulnerability that a malicious actor is currently using against real systems without permission.CRA SBOM Fundamentals, Lesson 3.2: Keeping Your SBOM Current and Monitoring for Vulnerabilities. Also in: Lesson 0.1
acts of war: An exclusion category triggered when an attack is attributed to a state or state-sponsored actor.; The Mondelez case proves the pattern: even a hundred-million-dollar policy can be denied under a single exclusion clause when the insurer decides the attack qualifies as an act of war.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls
Administrative fine: The penalty the regulator imposes on the company under Article 34 of the NIS2 Directive.; Article 34 of the NIS2 Directive sets the maximum administrative fine for Essential entities at the higher of ten million euros or two percent of total worldwide annual turnover.NIS2 Management Training, Lesson 1.3: Penalties and the Manager Ban
All-hazards approach: The Article 21(2) principle that your duty covers every threat to the systems, not only cyber attacks, including physical, environmental, and human threats.; Article 21(2) requires risk management "based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents."NIS2 Management Training, Lesson 1.10: All-Hazards Approach and State of the Art
Appropriate and proportionate: The standard in Article 21(1) NIS 2 for cybersecurity measures. They must fit the risk and be sized for the entity (§30(1) BSIG adds 'effective'). A plan you have never tested is hard to defend as appropriate, because Article 21(2)(f) requires procedures to assess whether measures work.; It uses the appropriate and proportionate rule in Article 21(1) NIS 2 and the testing rule in CIR 2024/2690 Annex Section 4.1.NIS 2 Tabletop Exercise Training, Lesson 3.1: Annual Cadence, Final Quiz, and Attestation
Article 21(2)(g) NIS 2: The directive paragraph that requires basic cyber hygiene practices and cybersecurity training. The legal basis for the role-specific training this course's attestation covers.; The PDF you receive at the end of this course is proof that you completed role-specific cybersecurity training under Article 21(2)(g) NIS 2 for the facilitator role.NIS 2 Tabletop Exercise Training, Lesson 3.1: Annual Cadence, Final Quiz, and Attestation
Asset: Anything the business depends on to operate - people, processes, cloud subscriptions, buildings, and IT hardware.; This lesson covers what "asset" means under NIS2 and why the inventory of those assets is the foundation that every other security control sits on.NIS2 Management Training, Lesson 2.2: What Is an Asset?
Asset inventory: The maintained list of all assets, kept current as the business changes; the foundation every other security control sits on.; The full list of them is called the asset inventory, and it must be kept current - an inventory that was correct last year and has not been updated is already a gap.NIS2 Management Training, Lesson 2.2: What Is an Asset?
Asset management: The process of identifying, inventorying, and managing all IT assets the business depends on.; People and access: (g) cyber hygiene and staff training, (h) cryptography policies, (i) human resources security, access control, and asset management, and (j) multi-factor authentication and secured communications.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
Attestation: The dated PDF this course gives you when you finish. Proof of role-specific cybersecurity training under Article 21(2)(g) NIS 2 for the facilitator role. Not the same as management body training under Article 20(2).; When you pass, the platform generates a dated PDF attestation.CRA SBOM Fundamentals, Lesson 4.1: Final Assessment. Also in: NIS 2 Tabletop Exercise Training, Lesson 0.1; Lesson 0.1
Attribution: The act of identifying who is behind an attack; determines whether acts-of-war clauses apply and whether sanctions law is triggered.; For the acts-of-war clause specifically, ask three questions: how is "hostile or warlike action" defined in this policy, what happens when attribution is unclear, and what is the insurer's stated position on state-aligned ransomware groups.NIS2 Management Training, Lesson 4.4: Common Policy Exclusions to Read For. Also in: Lesson 4.5; Lesson 4.6
audit rights: Contractual clauses giving you the right to inspect a supplier's security controls.; Three: contractual clauses - incident notification so they tell you fast when they are breached, a security baseline, and audit rights so you or a nominee can check their work.NIS2 Management Training, Lesson 2.9: Measure 4 - Supply Chain Security. Also in: Lesson 3.9
Audit trail: The chronological record of what was known, when, and by whom; the reason hiding something rarely works.; §30(1) sentence 3 BSIG, §61 BSIG; Hiding a gap or quietly fixing it both fail when the audit trail tells the story - and the audit trail always tells the story.NIS2 Management Training, Lesson 3.11: Scenario - Pre-Audit Gap Discovery
Availability: The property of a system being accessible and usable when needed.
awareness training: Recurring security training for all staff covering the basics of cyber hygiene; the CIR asks for it to be repeated and offered at planned intervals (8.1.2, 8.1.3).

B

back door: A hidden entry point in software that allows unauthorised access, often planted by an attacker.
breach of trust: A German criminal offence (section 266 StGB) for breaching a duty to look after the company's property interests and thereby causing it a loss, for example by spending its money against its interest.; In Germany, breach of trust under section 266 of the criminal code applies when company money is spent against the company's interest.NIS2 Management Training, Lesson 4.6: Ransomware Payment Decisions
BSI registration: The mandatory registration of in-scope entities with the BSI via its online portal. Required by §33 BSIG with its own penalty provision. You provide your company details, sector classification, a cybersecurity contact person, and IP address ranges. This is a standalone legal obligation: completing it does not satisfy your other NIS2 requirements, but not completing it is its own violation.; §33 BSIG
BSI Standard 200-4: The German BSI's standard on business continuity management. Defines five exercise types (plan review or desk check, staff exercise, extended staff exercise, alert exercise, function test) and requires a yearly exercise plan.; BSI Standard 200-4 and the international standard ISO 22301:2019 Section 8.6 name four types of exercise:NIS 2 Tabletop Exercise Training, Lesson 0.1: What a Tabletop Is and Why NIS 2 Demands One
BSI TR-02102: The BSI technical guideline listing currently recommended cryptographic algorithms; reference it in the policy so it stays current automatically.; Rather than memorising algorithm names, the right reference for European companies is BSI TR-02102, which BSI updates as research evolves.NIS2 Management Training, Lesson 2.13: Measure 8 - Cryptography
BSIG: Germany's BSI Act (Act on the Federal Office for Information Security and on the Security of Information Technology of Entities), the national law that implements NIS2 in Germany.; BSIG (Art. 1 of the Act of 2 December 2025, BGBl. 2025 I Nr. 301); In Germany, that law is the BSIG (the Federal IT Security Act, amended by the NIS2 Implementation Act).NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists
Business continuity: The plans and processes ensuring critical operations continue during and after a disruption.; Incident and continuity: (b) incident handling and (c) business continuity - backups, recovery, and crisis management.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
Business continuity (BCM): The overall discipline of keeping the business running through incidents; covers backup, disaster recovery, and crisis management.; "What is our RTO on the core business system, and what does the last disaster recovery test say the actual recovery time was?"NIS2 Management Training, Lesson 2.8: Measure 3 - Business Continuity
Business impact analysis (BIA): The analysis of how severe disruptions would hit business operations; it sets continuity requirements such as recovery times and acceptable data loss (CIR 4.1.3) and makes the risk matrix actionable.; The document that translates these categories into business numbers is called a business impact analysis - BIA.NIS2 Management Training, Lesson 2.5: The CIA Triad and Business Impact
business interruption: The financial loss from operations being halted or degraded during and after an incident.; It pays for the costs of handling a cyber incident: forensic investigation, incident response, customer notification, and business interruption losses.NIS2 Management Training, Lesson 4.3: Cyber Insurance vs D&O - Different Products, Different Coverage
Business Judgment Rule: The corporate-law principle that protects directors from personal liability for good-faith business decisions made with reasonable information.; The Business Judgment Rule protects directors from personal liability for business decisions made in good faith, with reasonable information, for the company's benefit.NIS2 Management Training, Lesson 1.8: The Business Judgment Rule Does Not Protect You

C

chain of evidence: The unbroken record of how digital evidence was collected, stored, and handled; destroyed by restoring systems before forensics.; Restoring before forensics examines compromised systems destroys the chain of evidence and leaves the entry vector open.NIS2 Management Training, Lesson 3.8: Scenario - Ransomware Hits Friday Afternoon
CIA triad: Confidentiality, integrity, availability - the three types of harm an incident can cause; the language every security conversation uses.; Underneath that phrase sits a three-letter vocabulary every security conversation uses: the CIA triad.NIS2 Management Training, Lesson 2.5: The CIA Triad and Business Impact
CIR: Commission Implementing Regulation (EU) 2024/2690, the detailed technical rulebook for certain digital providers (such as DNS, cloud, data centre and managed service providers, online marketplaces) and trust service providers; it applies directly in all member states.; Commission Implementing Regulation (EU) 2024/2690; On top of the directive sits a second piece of EU law: Commission Implementing Regulation (EU) 2024/2690 - the CIR.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists
CIR 2024/2690: Commission Implementing Regulation (EU) 2024/2690. Spells out technical and methodological requirements for cybersecurity measures for specific digital infrastructure entities.; CIR 2024/2690 Article 3 defines what counts as significant.NIS 2 Tabletop Exercise Training, Lesson 1.1: The Article 23 Cascade Your Exercise Must Rehearse. Also in: Lesson 2.2; Lesson 2.3
CISO: Chief Information Security Officer; the person responsible for the company's cybersecurity programme.; If your regulator walked into your office tomorrow and asked about your cybersecurity, how many questions could you answer without turning to your CISO?NIS2 Management Training, Lesson 3.1: The Questions Every CEO Must Answer
Civil liability: The legal exposure that allows your own company to sue you personally for damages under national corporate law.
Competent authority: The national authority that supervises and enforces NIS2 (BSI in Germany). A member state may designate more than one authority.; Each country designates a competent authority - the regulator who supervises, audits, and fines covered companies.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists. Also in: Lesson 1.4
Compliance gap: A missing or incomplete element of the required compliance programme.; Without it, they cannot reach you - and that communication gap is itself a compliance gap.NIS2 Management Training, Lesson 1.4: The Registration Obligation
compliance officer: The person responsible for ensuring the company meets its legal and regulatory obligations.; On-site, they interview the CISO, the compliance officer, and you.NIS2 Management Training, Lesson 3.7: What Happens During a Regulator Audit
Compliance scope: The range of entities and activities a law covers, and so the obligations that apply to them.; The difference is enforcement intensity, not compliance scope.NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
confidentiality: Data is only accessible to the people supposed to see it; a loss is a leak.
Conformity assessment: The process a manufacturer uses to demonstrate that its product meets CRA requirements. Default-class products can self-assess. Important Class I products can self-assess using harmonised standards. Important Class II products require a third-party conformity assessment body (CAB). The SBOM is part of the technical documentation reviewed during conformity assessment.
containment: The immediate actions taken to stop an incident from spreading further.; Wait until Monday and you waste sixty-four hours of containment - the twenty-four-hour regulatory clock ticks whether you declare or not.NIS2 Management Training, Lesson 3.8: Scenario - Ransomware Hits Friday Afternoon. Also in: Lesson 3.10
Coordinated vulnerability disclosure: A process where a security researcher privately reports a vulnerability to the manufacturer before publishing details publicly. Annex I, Part II, point (5) CRA requires manufacturers to put in place and enforce a policy on coordinated vulnerability disclosure (see also Article 13(8)). Typically implemented via a security.txt file and a dedicated security contact.; Design and development documentation including architecture, design decisions, threat model, and coordinated vulnerability disclosure policyCRA SBOM Fundamentals, Lesson 1.3: The 10-Year Retention Rule and Who Gets Access
Coverage gap: The specific space between what your policies cover and what the regulator can actually claim from you; the place where uninsured personal liability lives.; The gap between what you assumed the policy covered and what it actually covers is the space where the expensive surprise lives.NIS2 Management Training, Lesson 4.2: D&O Insurance - What It Covers and the Cyber Exclusions
Crisis declaration: The formal act that switches the company into incident response mode, which only the management body can authorise.
crisis management: A named crisis team with pre-assigned decision authority and a documented plan; NIS2 lists crisis management next to business continuity in Article 21(2)(c).
critical asset: An asset whose loss would cause significant harm to the business; prioritised in the BIA.
Critical sectors: Industries the EU considers essential to society and economy, listed in NIS2 Annexes I and II.; One EU-wide rulebook on how companies in critical sectors protect themselves against cyber attacks and what they must do when something goes wrong.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists
critical vulnerability: A weakness in a system rated at the highest severity level; the CIR expects vulnerabilities critical to operations to be addressed without undue delay (6.10.2(c)).
Cross-border impact: The effect of an incident on services or entities in other EU member states.; Root cause, mitigation measures applied, and any cross-border impact.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents
Cryptography: The use of encryption and related techniques to protect data confidentiality and integrity.; People and access: (g) cyber hygiene and staff training, (h) cryptography policies, (i) human resources security, access control, and asset management, and (j) multi-factor authentication and secured communications.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
CSIRT: Computer Security Incident Response Team, a national body (a Member State may have several) that handles incidents; reports go to it or, where applicable, to the competent authority (Article 23(1)).; NIS2 Directive Art. 10, §32 BSIG; Article 23 of the NIS2 Directive requires covered companies to report significant incidents to their national CSIRT or competent authority.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents. Also in: Lesson 4.5; NIS 2 Tabletop Exercise Training, Lesson 1.1
Customer notification: Your duty under Article 23(1) to tell affected customers, where appropriate, about a significant incident, separate from your reporting duty to the regulator.; If they cannot answer, assume the worst and prepare customer notification.NIS2 Management Training, Lesson 3.9: Scenario - Supplier Breach Affecting Your Customer Data
customer notification duty: The legal obligation to inform affected customers, where appropriate, about a significant incident that is likely to adversely affect the service they receive.; The customer notification duty under Article 23(1) - that lands on you regardless.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls
CVE: Common Vulnerabilities and Exposures. The standardised identifier for publicly known cybersecurity vulnerabilities. Format: CVE-YEAR-NUMBER (e.g. CVE-2021-44228 for Log4Shell). An SBOM linked to a CVE database tells you which known vulnerabilities affect your product.; Each vulnerability entry references a CVE and the component it affects.CRA SBOM Fundamentals, Lesson 2.1: CycloneDX: The Security-Focused SBOM Format. Also in: Lesson 1.1; Lesson 3.2
Cyber hygiene: Basic security practices (patching, password management, awareness) that reduce everyday risk.; People and access: (g) cyber hygiene and staff training, (h) cryptography policies, (i) human resources security, access control, and asset management, and (j) multi-factor authentication and secured communications.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview. Also in: Lesson 2.12
Cyber insurance: A policy that pays after an incident, covering some financial losses, subject to exclusions.; Mondelez held a cyber policy with Zurich Insurance for that amount.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls. Also in: Lesson 4.3; Lesson 4.4
CycloneDX: An OWASP SBOM standard in JSON or XML format. Security-focused: built around vulnerability tracking, VEX statements, and CVE integration. Version 1.7 is current. The CRA names no preferred format (Annex I, Part II, point (1) asks for a commonly used, machine-readable one), but CycloneDX maps directly to vulnerability management workflows.; The formats, CycloneDX and SPDX, fill that gap.CRA SBOM Fundamentals, Lesson 1.1: What Goes Into an SBOM: Components, Versions, and Identifiers. Also in: Lesson 0.1; Lesson 2.1; Lesson 2.2; Lesson 4.1

D

D&O insurance: Directors and Officers liability insurance; a separate product from cyber insurance, covering personal liability claims against the management body.; And personal liability under Article 20(1) is covered by D&O insurance, not cyber insurance - they are different products.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls. Also in: Lesson 4.3
deductible: The amount the insured must pay out of pocket before coverage begins.
Digital infrastructure entities: The entity types CIR 2024/2690 applies to directly (the 'relevant entities' in its Article 1): DNS providers, TLD registries, cloud providers, data centres, CDNs, MSPs, MSSPs, online marketplaces, search engines, social networks, trust service providers. Not identical to the NIS 2 sector 'digital infrastructure', which also covers internet exchange points and telecom providers.; CIR 2024/2690 (the Commission Implementing Regulation that gives technical detail for digital infrastructure entities) is more direct.NIS 2 Tabletop Exercise Training, Lesson 0.1: What a Tabletop Is and Why NIS 2 Demands One
Direct reporting line: The organisational structure that gives at least one person a line straight to the management body on cybersecurity, required for the provider types covered by Implementing Regulation (EU) 2024/2690 (Annex 1.2.3) and checked by auditors.; If the company then has an incident, the absence of a direct reporting line is evidence that the management body was not properly overseeing the cybersecurity programme.NIS2 Management Training, Lesson 3.6: CISO and Supervisory Board Reporting Lines
Directive: An EU law that tells each country what result to achieve; each country writes its own national law to implement it.; The formal name is Directive (EU) 2022/2555 - the NIS2 Directive.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists. Also in: Lesson 0.1
Directors and officers liability insurance: The product sold to protect board members from claims of mismanagement; it typically covers damages claims for breaches of duty, but not fines against the company or knowing breaches.; Your board secretary forwards the renewal quote for the company's directors and officers insurance.NIS2 Management Training, Lesson 4.2: D&O Insurance - What It Covers and the Cyber Exclusions
disaster recovery: The procedures and infrastructure that bring the business back online after a major event.
DPO: Data Protection Officer. The role regulated in Articles 37 to 39 GDPR (designation, position, tasks). Strongly recommended at any tabletop where personal data is involved.; DPO or data protection contact when personal data is involved.NIS 2 Tabletop Exercise Training, Lesson 1.2: Role Assignments: Who Must Be in the Room
Due care: The standard of attention and diligence a reasonable director is expected to exercise.; Asking the question and documenting that you asked it is already part of the due care standard.NIS2 Management Training, Lesson 1.3: Penalties and the Manager Ban. Also in: Lesson 1.7; Lesson 1.8; Lesson 3.2
Due diligence: The homework you have to do before signing anything that carries legal weight; the standard that determines whether your approval is defensible.
Duty of legality: The specific duty of a director to comply with applicable law, which sits above the Business Judgment Rule: no judgment is permitted about whether to follow a legal duty.; The principle is called the duty of legality: a director must comply with applicable law, and no business judgment is permitted about whether to follow a legal duty.NIS2 Management Training, Lesson 1.8: The Business Judgment Rule Does Not Protect You

E

Early warning: The first reporting stage, due within twenty-four hours of becoming aware of a significant incident.; First: the early warning.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents. Also in: Lesson 3.8; NIS 2 Tabletop Exercise Training, Lesson 1.1; NIS 2 Tabletop Exercise Training, Lesson 2.1
Encryption at rest: Scrambling stored data (on disk, in a database, or in a backup) so that physical theft does not expose it.; Encryption at rest means data sitting on disk, in a database, or in a backup is scrambled so that someone who steals the storage cannot read it.NIS2 Management Training, Lesson 2.13: Measure 8 - Cryptography
Encryption in transit: Scrambling data in motion between systems so that interception does not expose it.; Encryption in transit means data moving between systems is scrambled so that someone who intercepts the traffic cannot read it.NIS2 Management Training, Lesson 2.13: Measure 8 - Cryptography
ENISA: European Union Agency for Cybersecurity. Receives Article 14 CRA vulnerability and incident reports, together with the CSIRT designated as coordinator, via the Single Reporting Platform (operational since September 11, 2026). Under NIS 2 Article 23, entities report to their CSIRT or competent authority, not to ENISA; ENISA receives information on cross-border incidents and quarterly summary reports from the national bodies.
ENISA registry: The registry ENISA keeps under Article 27 NIS2 of DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, and providers of online marketplaces, online search engines and social networking services platforms, based on information from the national single points of contact.
Essential entity: A large company in an Annex I sector, or certain providers such as DNS service providers regardless of size, subject to proactive supervision.; §28(1), §61(5), §65(5) BSIG, NIS2 Directive Art. 3(1); If you are classified as an Essential entity, the regulator can audit you whenever they choose - no reason, no incident, no complaint needed.NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
Exclusion: A named category of loss the policy will not cover (acts of war, pre-existing vulnerabilities, sanctions).; Insurance spreads the financial loss after the fact - and only the financial loss, subject to exclusions the insurer's lawyers wrote.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls. Also in: Lesson 4.2
exclusion clause: The specific contractual language that removes a category of loss from coverage.; The Mondelez case proves the pattern: even a hundred-million-dollar policy can be denied under a single exclusion clause when the insurer decides the attack qualifies as an act of war.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls. Also in: Lesson 4.4
exfiltration: The act of stealing data out of your systems; the point at which containment can turn into a notification obligation.; Third question: was data exfiltrated?NIS2 Management Training, Lesson 3.10: Scenario - Phishing Success: Significant or Not?

F

Fiduciary duty: The legal obligation of a director to act in the best interest of the company.
Final report: The third reporting stage, due no later than one month after the incident notification, covering root cause, mitigation, and cross-border impact.; Third: the final report.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents. Also in: NIS 2 Tabletop Exercise Training, Lesson 1.1; NIS 2 Tabletop Exercise Training, Lesson 2.1
forensics: The technical investigation of a cyber incident to determine cause, scope, and impact.; Nine: engagement of external forensics or legal counsel in major incidents.NIS2 Management Training, Lesson 3.5: What You Cannot Delegate - The Checklist. Also in: Lesson 3.8; Lesson 3.10; Lesson 4.3

G

Good-faith disclosure: The act of telling the regulator about a gap before they find it, which regulators weigh as a mitigating factor in enforcement decisions.; Good-faith disclosure typically results in a remediation order or warning, not a fine.NIS2 Management Training, Lesson 3.11: Scenario - Pre-Audit Gap Discovery
Grype: An open-source vulnerability scanner by Anchore. Takes an SBOM as input and matches components against the NVD, GitHub Advisory Database, and other vulnerability feeds. The tool that turns an SBOM into ongoing vulnerability monitoring, which supports the vulnerability handling duties in Annex I, Part II and helps you notice vulnerabilities that may trigger an Article 14 notification.; Grype by Anchore is the standard tool for the monitoring loop.CRA SBOM Fundamentals, Lesson 3.2: Keeping Your SBOM Current and Monitoring for Vulnerabilities. Also in: Lesson 2.1; Lesson 4.1

H

hardware token: A physical device (e.g. YubiKey) that generates or stores a second authentication factor.
Hash: A fixed-length fingerprint of a file computed by an algorithm such as SHA-256. Including a hash for each SBOM component lets you verify that the component has not been tampered with since the SBOM was generated. CycloneDX and SPDX both support hashes per component.; A hash is a fixed-length fingerprint of the component file.CRA SBOM Fundamentals, Lesson 1.1: What Goes Into an SBOM: Components, Versions, and Identifiers
Holding statement: A short factual acknowledgement issued early, before all the facts are known, that buys time to get them right without appearing silent.; Second: issue a holding statement within two hours.NIS2 Management Training, Lesson 4.5: First 48 Hours of Crisis Communication
Hot wash: The debrief meeting right after the exercise. Same room, same day, around twenty minutes. Four rounds: what went well, what went badly, what surprised us, what needs to change.; Coaching belongs in the hot wash after the exercise.NIS 2 Tabletop Exercise Training, Lesson 1.3: The Facilitator-vs-Participant Separation. Also in: Lesson 2.2; Lesson 2.3

I

Impact: How bad it would be if the event happened - measured in money, downtime, customers, or harm.; That exposure is measured with two numbers: likelihood - how often a bad event might happen - and impact - how much it would cost you if it did, measured in money, downtime, customers, or harm.NIS2 Management Training, Lesson 2.1: Risk = Likelihood x Impact
Important entity: A company in an Annex I or II sector that is covered but not essential: medium-sized in Annex I, medium-sized or large in Annex II. It is subject to reactive supervision.; §28(2), §62, §65(5) BSIG, NIS2 Directive Art. 3(2); If you are classified as an Important entity, the regulator only audits you when something triggers it - an incident, a complaint, a report.NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
Improvement item: An action item that comes out of the hot wash. Has a description, an owner, a deadline, a link to the Article 21(2) measure it closes a gap in, and a clear done criterion.; Each one becomes an improvement item with an owner, a deadline, and a link to the relevant Article 21(2) measure.NIS 2 Tabletop Exercise Training, Lesson 2.2: The Hot Wash Debrief
In scope: Subject to the requirements of the law; the company falls within the criteria for coverage.
Incident contact: The person your company designates to handle communication with the regulator during a security incident. Given the 24-hour early warning deadline, planning for reachability outside office hours is good practice.
Incident handling: The procedures for detecting, responding to, and recovering from security incidents.; Incident and continuity: (b) incident handling and (c) business continuity - backups, recovery, and crisis management.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
Incident notification: The second reporting stage, due within seventy-two hours, with severity, impact, and indicators of compromise.; Second: the incident notification.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents. Also in: NIS 2 Tabletop Exercise Training, Lesson 1.1; NIS 2 Tabletop Exercise Training, Lesson 2.1
incident response plan: The documented procedure for detecting, containing, and recovering from a security incident.; If you do not know the answer to all three before the call happens, your incident response plan has already failed.NIS2 Management Training, Lesson 2.7: Measure 2 - Incident Handling. Also in: Lesson 3.8; Lesson 4.6
Indemnification: A contractual clause that requires the party at fault to compensate you for the costs their failure caused.; Specifically: incident notification timelines, audit rights, indemnification.NIS2 Management Training, Lesson 3.9: Scenario - Supplier Breach Affecting Your Customer Data
Indicators of compromise: Technical artefacts (IP addresses, hashes, domains) that evidence a security breach.; An updated assessment including severity, impact, and where available, indicators of compromise.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents
Information security policy: The top-level security document that sits above every other security rule in the company; the first document the auditor reads.; The top-level document is called the information security policy.NIS2 Management Training, Lesson 2.6: Measure 1 - Risk Analysis and Information Security Policies. Also in: Lesson 3.2
Initial compromise: The earliest point in time when an attacker got into your environment. Ransomware operators often dwell for days, sometimes weeks, before they encrypt anything. The right restore point pre-dates this moment, not just the encryption.; Right answer: The most recent backup that pre-dates the initial compromise, confirmed clean by the forensics team.NIS 2 Tabletop Exercise Training, Lesson 2.1: One End-to-End Scenario: Ransomware on the ERP
Insider threat: A risk originating from within the organisation - employees, contractors, or partners.; Cyber attacks, physical break-ins, fires, floods, power outages, supplier failures, insider threats, and human error are all in scope.NIS2 Management Training, Lesson 1.10: All-Hazards Approach and State of the Art
integrity: Data is accurate and untampered; a loss is corruption.
Intermediate report: A status update under Article 23(4)(c) NIS 2 sent on request from the CSIRT. No fixed deadline. You answer when asked.; Article 23(4)(c) says the CSIRT can ask for an intermediate report when it wants.NIS 2 Tabletop Exercise Training, Lesson 1.1: The Article 23 Cascade Your Exercise Must Rehearse
Internal controls: The processes and safeguards a company maintains to ensure compliance and manage risk.; The claim was that legally required internal controls and disclosures were missing.NIS2 Management Training, Lesson 1.8: The Business Judgment Rule Does Not Protect You
ISMS: Information Security Management System - the complete set of policies, processes, and people that manage security.; The whole set of documents, people, and review cycles around them is what your CISO calls an ISMS - an Information Security Management System.NIS2 Management Training, Lesson 2.6: Measure 1 - Risk Analysis and Information Security Policies
IT-Grundschutz: The BSI's own cybersecurity methodology: a comprehensive framework of security modules (Bausteine) with step-by-step implementation guidance. For companies it is not mandatory: the BSI says an IT-Grundschutz certification can ease the proof of NIS2 compliance but must be checked against the measures required by §30 BSIG and supplemented where needed. §44(2) BSIG treats Grundschutz-based minimum requirements as fulfilling §30, but only for federal administration entities.; BSI-Standards 200-1 through 200-4; §44(2) BSIG applies to federal administration entities only

J

Joiner-mover-leaver: The process for provisioning access at onboarding, adjusting at role change, and revoking at departure.; The process that connects HR and IT across the full employee lifecycle - joining, changing roles, and leaving - is called the joiner-mover-leaver process.NIS2 Management Training, Lesson 2.14: Measure 9 - HR Security, Access Control, and Asset Management

K

Key management: Generating, storing, rotating, and destroying the cryptographic keys that make encryption work; where cryptography most commonly fails.; Key management decides whether the encryption is sound or hollow.NIS2 Management Training, Lesson 2.13: Measure 8 - Cryptography
Key performance indicator: The metrics that show whether the security controls are working as designed.; The reporting meetings must be regular, documented, and contain specific content - KPIs, KRIs, incident summary, budget status, threat landscape, and decisions needing escalation.NIS2 Management Training, Lesson 3.6: CISO and Supervisory Board Reporting Lines
Key risk indicator: The metrics that show where the company's cyber exposure sits at a given point in time, and how it is trending.; The reporting meetings must be regular, documented, and contain specific content - KPIs, KRIs, incident summary, budget status, threat landscape, and decisions needing escalation.NIS2 Management Training, Lesson 3.6: CISO and Supervisory Board Reporting Lines
key rotation: Replacing cryptographic keys on a schedule to limit the damage if a key is compromised.
KPI: Key Performance Indicator - measures how well a security process is running (e.g. percentage of patches applied on time).; KPIs - Key Performance Indicators - measure how well a process is running (for example, what percentage of patches were applied on time).NIS2 Management Training, Lesson 2.11: Measure 6 - Effectiveness Assessment
KRI: Key Risk Indicator - measures how much risk the company is currently carrying (e.g. number of open critical vulnerabilities).; KRIs - Key Risk Indicators - measure how much risk you are currently carrying (for example, how many critical vulnerabilities are open right now).NIS2 Management Training, Lesson 2.11: Measure 6 - Effectiveness Assessment
KRITIS: Operators of critical facilities that exceed the thresholds defined in the BSI-KritisV regulation (typically 500,000 people served). KRITIS operators are automatically classified as essential entities (in the BSIG: besonders wichtige Einrichtungen) and face additional obligations beyond standard NIS2: evidence of their measures every three years, mandatory attack detection systems, and extra content in incident reports (type of facility and critical service). The reporting deadlines are the same as for other entities.; §2 No. 22, §28(1), §31(2), §32(3), §39 BSIG; §2 No. 3 KRITISDachG; BSI-KritisV

L

Layered insurance: The approach of combining D&O, cyber, and legal defence policies to close the gap between them.
Least privilege: The principle that every user has only the access they need for their job - no more, no less.
Leitfragen: The German term for the structured questions in chapter 3 of the BSI's non-binding training aid for management bodies (§ 38 Abs. 3 BSIG).; Your auditor or consultant will call this list the BSI Leitfragen.NIS2 Management Training, Lesson 3.1: The Questions Every CEO Must Answer
Lessons learned: The written post-incident document that records root cause and updates the plan; DER.2.1.A17 says management should (SOLLTE) be informed about incidents every year.; It has five parts, and the auditor checks whether all five exist and have been tested: detection (how you notice something is wrong), classification (how serious it is and whether it crosses the reporting threshold from Lesson 1.11), response (who does what, in what order), recovery (how you restore service - this ties into Measure 3, business continuity), and lessons learned (what happened, why, and what changes as a result).NIS2 Management Training, Lesson 2.7: Measure 2 - Incident Handling
Likelihood: How often a bad event might happen in a given period.; That exposure is measured with two numbers: likelihood - how often a bad event might happen - and impact - how much it would cost you if it did, measured in money, downtime, customers, or harm.NIS2 Management Training, Lesson 2.1: Risk = Likelihood x Impact

M

malware: Malicious software designed to damage, disrupt, or gain unauthorised access to systems.; In 2017, the food company Mondelez was hit by the NotPetya malware and suffered roughly one hundred million dollars in damage.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls
Management approval: The formal act of the management body signing off on the cybersecurity risk-management measures, as Article 20(1) requires, creating a dated record of informed consent.
Management body: The leadership team of the company: CEO, managing directors, executive board members, and anyone called by law or the articles of association to manage the business and represent the company.; § 2 No. 13 BSIG; The directive creates personal accountability for the management body - which is why the leadership team, not just IT, is addressed directly.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists. Also in: Lesson 0.1; Lesson 1.5; NIS 2 Tabletop Exercise Training, Lesson 0.1; NIS 2 Tabletop Exercise Training, Lesson 1.2
Management body training: The training duty created by Article 20(2), separate from the staff awareness training your employees receive; a personal obligation on every member of the management body.
Management liability: The personal liability of company management (Geschäftsführung) to its own company for NIS2 compliance under §38 BSIG. Management must implement the risk management measures under §30, supervise their implementation and undergo regular cybersecurity training (§38(1) and (3)). A breach of the implementation and supervision duties makes management liable to the company for culpably caused damage, under the company-law rules for its legal form (§38(2)). The duty to approve those measures is set in Art. 20(1) NIS 2; §38(1) itself names implementing and supervising. Whether the company can waive such claims depends on that company law; §38 says nothing on it. This is the provision that moves cybersecurity from the IT department to the boardroom.; §38(1)-(3) BSIG
management review: A regular evaluation in which the management body reviews the organisation's security posture; BSI-Standard 200-1 (section 4.3) recommends it as part of an information security management system.; BSI Standard 200-1, Section 7.4 hardcodes this as the only mandatory annual frequency in the framework - the formal management review where you, the management body, sit down and assess whether the whole security programme still works.NIS2 Management Training, Lesson 2.4: Why Risk Management Is Continuous. Also in: Lesson 2.11; Lesson 3.3; Lesson 5.1
Management review protocol: The dated, signed document recording what was reviewed, what was decided, and who owns each follow-up action from the annual management review.; The management review is a dated, signed document - the management review protocol - recording what was reviewed, what was decided, and who owns each follow-up action.NIS2 Management Training, Lesson 2.11: Measure 6 - Effectiveness Assessment
Manager ban: The power under Article 32(5)(b), for Essential entities only, to have the person at CEO or legal representative level temporarily banned from management functions in that entity when the regulator's orders are ignored past a deadline.; If an Essential entity misses them, the regulator can ask for a temporary manager ban under Article 32(5)(b), which lasts until the gaps are fixed.NIS2 Management Training, Lesson 1.3: Penalties and the Manager Ban
Mandatory incident reporting: Your legal duty to notify the regulator of a significant incident inside the 24-hour / 72-hour / one-month cascade defined in Article 23.
Market surveillance authority: The national authority that checks CRA compliance in each EU member state. On a reasoned request, market surveillance authorities can require the documentation needed to check conformity, and the SBOM if it is necessary for that check. You do not have to make it publicly available.; A market surveillance authority investigating a vulnerability from three years ago wants the SBOM from the version that was in the market at that time.CRA SBOM Fundamentals, Lesson 1.3: The 10-Year Retention Rule and Who Gets Access. Also in: Lesson 0.1
MUK: Germany's central business account for federal administration services, authenticated via ELSTER certificates. A prerequisite for BSI registration: companies must first create a MUK account, then access the BSI registration portal through it. If you do not yet have a MUK account, you cannot register with the BSI: this is the first practical step before any compliance work begins.; OZG, ELSTER
Multi-factor authentication: A security control requiring two or more verification factors to access a system.; If you approved multi-factor authentication for staff logins, you use multi-factor authentication.NIS2 Management Training, Lesson 1.5: Your Duty to Approve and Oversee. Also in: Lesson 1.9
Multi-factor authentication (MFA): Login requiring two or more verification factors, such as a password plus a hardware token or phone; NIS2 asks for it where appropriate (Article 21(2)(j)), and the CIR names privileged accounts and the classification of the asset accessed (11.3.2, 11.7.1).; §30(2)(10) BSIG; The single biggest reason account takeovers succeed is that multi-factor authentication was not turned on.NIS2 Management Training, Lesson 2.15: Measure 10 - Multi-Factor Authentication and Secured Communications

N

NACE code: The Statistical Classification of Economic Activities in the European Community (Nomenclature statistique des Activités économiques dans la Communauté Européenne). NIS2 and the BSIG refer to NACE Rev. 2 codes only for a few entity types, such as pharmaceutical, chemical and certain manufacturing activities. Most sectors are defined by the type of activity. The BSI does not tell you whether you are in scope; you check that yourself.; Regulation (EC) No 1893/2006 (NACE Rev. 2); NIS2 Annex I point 5 and Annex II point 5; Anlage 1 and 2 BSIG
named insured: The specific person or entity listed on a policy as the one protected by the coverage.; That personal claim has to be defended by a policy that names you personally as the named insured.NIS2 Management Training, Lesson 4.3: Cyber Insurance vs D&O - Different Products, Different Coverage
nation-state: A country acting through its intelligence or military services to conduct cyber operations.; The acts-of-war or nation-state attack exclusion: Lloyd's tightened this wording in 2023 following the Mondelez case.NIS2 Management Training, Lesson 4.4: Common Policy Exclusions to Read For
NIS2 Annex I: High-criticality sectors: The list of sectors whose entities are classified as 'essential' (essential entities) when they exceed the ceilings for medium-sized enterprises, i.e. are large companies; medium-sized entities in these sectors are important entities. In the BSIG the essential class is called 'besonders wichtige Einrichtungen'. Includes: energy (electricity, oil, gas, hydrogen, district heating), transport (air, rail, water, road), banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.; NIS2 Directive Annex I and Art. 3(1)(a), Anlage 1 and §28(1) BSIG
NIS2 Annex II: Other critical sectors: The list of sectors whose entities are classified as 'important' (wichtige Einrichtungen) when they meet the size threshold. Includes: postal and courier services, waste management, chemical manufacturing and distribution, food production and distribution, manufacturing (medical devices, electronics, machinery, vehicles), digital providers (online marketplaces, search engines, social networks), and research organizations.; NIS2 Directive Annex II, §28(2) BSIG
NIS2 Directive: Directive (EU) 2022/2555, the EU-wide cybersecurity law for essential and important entities.; Directive (EU) 2022/2555; The formal name is Directive (EU) 2022/2555 - the NIS2 Directive.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists
NIS2UmsuCG: Germany's national transposition of the NIS2 Directive, officially the 'Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung', called the NIS-2 Implementation and Cybersecurity Strengthening Act in the drafts. Passed by the Bundestag on 13 November 2025, published on 5 December 2025 and in force since 6 December 2025. It introduces a new BSIG and brings the NIS2 obligations into German law. When German law refers to 'NIS2 compliance,' it means compliance with the BSIG.; Act of 2 December 2025, BGBl. 2025 I Nr. 301
non-conformance: A specific failure to meet a legal requirement; the formal name for a finding.; A finding is a non-conformance: something the law requires that you do not have or do not do.NIS2 Management Training, Lesson 3.7: What Happens During a Regulator Audit
Non-delegable: Cannot be transferred to or performed by someone else on your behalf.; The training duty is personal and non-delegable.NIS2 Management Training, Lesson 1.6: Your Training Duty. Also in: Lesson 0.1; Lesson 4.6
Non-delegable duty: A duty the law assigns to the management body itself: approving and overseeing the risk management measures (Art. 20(1)). The CISO or the compliance team can prepare and carry out the work, but the responsibility stays with management.; When the line is blurry, treat the decision as non-delegable and sign it yourself.NIS2 Management Training, Lesson 3.5: What You Cannot Delegate - The Checklist
Notification clause: The clause that requires you to tell the insurer within a tight deadline, or you risk losing coverage.; The late notification clause: voids coverage if you file the claim with the insurer after the policy's strict deadline.NIS2 Management Training, Lesson 4.4: Common Policy Exclusions to Read For
notification window: The strict deadline within which a claim must be reported to the insurer.

O

Observation: An area the auditor notes for improvement that does not constitute a legal violation; no sanction follows by itself, but the authority can order audit recommendations to be implemented (Art. 32(4)(f) and 33(4)(f)), and ignoring it invites a finding next time.; An observation is an area that falls below good practice but does not violate the law.NIS2 Management Training, Lesson 3.7: What Happens During a Regulator Audit
OFAC: Office of Foreign Assets Control; the US Treasury office that administers sanctions lists.; The OFAC analysis ran in parallel with the payment decision - not before it.NIS2 Management Training, Lesson 4.6: Ransomware Payment Decisions
On-site inspection: The physical visit by the regulator's audit team to your premises, authorised under Article 32(2)(a) for Essential entities and Article 33(2)(a) for Important entities.; The BSI sends a letter announcing an on-site inspection.NIS2 Management Training, Lesson 3.7: What Happens During a Regulator Audit
orphaned account: An active user account that no longer belongs to a current employee - a common audit finding.
Out-of-band channel: An emergency communication path separate from the normal systems, used when those systems are compromised.; An out-of-band channel (a separate messaging tool, a dedicated phone line) exists for exactly that moment.NIS2 Management Training, Lesson 2.15: Measure 10 - Multi-Factor Authentication and Secured Communications
Oversight duty: The ongoing obligation to monitor whether approved measures are actually being implemented.

P

patch: A software update that fixes a known vulnerability.
Patch SLA: The written deadline for applying patches, set by severity level; the CIR asks for patches within a reasonable time, with documented reasons for any exception (6.6.1, 6.6.2).; Your team calls those deadlines patch SLAs.NIS2 Management Training, Lesson 2.10: Measure 5 - Acquisition, Development, and Maintenance
Personal civil liability: The legal exposure of a director to pay damages out of personal assets when a breached statutory duty culpably causes loss to the company.
Personal data: Any information about an identified or identifiable natural person. Defined in Article 4(1) GDPR.; DPO or data protection contact when personal data is involved.NIS 2 Tabletop Exercise Training, Lesson 1.2: Role Assignments: Who Must Be in the Room
personal liability: Legal responsibility that falls on the individual director, in addition to the company.; And personal liability under Article 20(1) is covered by D&O insurance, not cyber insurance - they are different products.NIS2 Management Training, Lesson 4.1: Insurance Is Not a Substitute for Controls
Phishing simulation: Periodic fake phishing emails sent to staff to test awareness; part of the training programme, with follow-up training for anyone who clicks.; How many phishing simulations has your own company sent to you, personally, in the last twelve months?NIS2 Management Training, Lesson 2.12: Measure 7 - Cyber Hygiene and Training
Privileged accounts: Administrator, root, and domain admin accounts with elevated access; require a dedicated policy and their own review cadence under CIR Annex 11.3.; On top of that, privileged accounts - administrators, root access, domain administrators - need their own rules with stronger controls.NIS2 Management Training, Lesson 2.14: Measure 9 - HR Security, Access Control, and Asset Management
Proactive supervision: The regulator can audit you without a specific trigger (applies to Essential entities).; The directive calls this proactive supervision under Article 32.NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
Product with digital elements: A software or hardware product and its remote data processing solutions, including components placed on the market separately (Article 3(1) CRA). The CRA applies to those whose intended purpose or reasonably foreseeable use includes a direct or indirect data connection to a device or network (Article 2(1)). Covers physical devices with firmware, standalone software, apps, and operating systems.; The CRA applies to any product with digital elements, hardware or software that can connect, directly or indirectly, to another device or network.CRA SBOM Fundamentals, Lesson 0.1: What an SBOM Is and Why CRA Made It Mandatory
Progress report: Used under Article 23(4)(e) NIS 2 when the incident is not yet resolved at the one-month deadline. The final report follows once the incident is closed.; You send a progress report instead.NIS 2 Tabletop Exercise Training, Lesson 1.1: The Article 23 Cascade Your Exercise Must Rehearse
Proportionality: The Article 21(1) principle that scales what you must implement to your size, your risk exposure, and the likelihood and severity of incidents.; Proportionality in Article 21(1) scales depth to your size, sector, and risk exposure.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
PURL: Package URL. A standard identifier for software components: `pkg:type/namespace/name@version`. For example, `pkg:npm/%40angular/core@17.0.0`. PURLs are the recommended unique identifier in both CycloneDX and SPDX, and the practical anchor for linking an SBOM component to a CVE database entry.; A PURL (Package URL) is the standard way to identify a component uniquely across registries and databases.CRA SBOM Fundamentals, Lesson 1.1: What Goes Into an SBOM: Components, Versions, and Identifiers. Also in: Lesson 2.1; Lesson 2.2; Lesson 4.1

R

ransomware: Malware that encrypts data and demands payment for the decryption key.; On 19 March 2019, ransomware shut down forty Norsk Hydro production sites overnight.NIS2 Management Training, Lesson 3.8: Scenario - Ransomware Hits Friday Afternoon. Also in: Lesson 4.4; Lesson 4.6
RBAC: Role-Based Access Control - permissions assigned by job role, not individually.
reactive supervision: The regulator's power to audit Important entities when triggered by an incident, complaint, or intelligence.
Recipients of services: The directive's legal term for the entity's customers.; Article 23(1) of the NIS2 Directive says that, where appropriate, entities notify the recipients of services "without undue delay" of significant incidents that are likely to adversely affect the provision of those services.NIS2 Management Training, Lesson 1.12: The Customer Notification Duty
Recurring incidents: Incidents that are individually not significant but occur at least twice within six months, share the same apparent root cause and together meet the financial loss criterion; they count as one significant incident (CIR Article 4).
Recurring incidents rule: The Article 4 CIR rule (for the provider types the CIR covers) that treats small incidents with the same apparent root cause, occurring at least twice within six months, as one significant incident if they collectively cross the financial threshold.; Article 4 adds the recurring incidents rule: two or more incidents in six months sharing the same root cause that together cross the threshold count as one significant incident.NIS2 Management Training, Lesson 3.10: Scenario - Phishing Success: Significant or Not?
Registration: The administrative filing with the regulator under Article 3(4) NIS2 (in Germany Section 33 BSIG, due within three months after a company becomes covered by NIS2).; If you miss that window, the first thing the regulator sees when they pull up your file is a missing registration - and that, by itself, is a separate fine.NIS2 Management Training, Lesson 1.4: The Registration Obligation
Regulation: An EU law that applies directly in every country without transposition (e.g. GDPR, CIR).; NIS2 is a directive, not a regulation.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists
remediation: The process of fixing a gap or non-conformance identified during an audit or review.; Fifth: an audit finding requiring remediation.NIS2 Management Training, Lesson 3.3: When to Re-Sign-Off. Also in: Lesson 3.7; Lesson 3.10
Remediation order: A regulator's instruction to fix a specific gap within a defined timeline (Art. 32(4)(b) and (d)); it can come with or without a fine.; Good-faith disclosure typically results in a remediation order or warning, not a fine.NIS2 Management Training, Lesson 3.11: Scenario - Pre-Audit Gap Discovery
Remediation plan: The company's written response to findings: corrective action, named owner, deadline, and evidence of completion for each item.; It triggers a remediation order with a deadline.NIS2 Management Training, Lesson 3.7: What Happens During a Regulator Audit
removable media: USB drives, external hard disks, and similar portable storage; requires a dedicated policy under the CIR.
Residual risk: The risk that remains after you have put controls in place; the thing you are approving when you sign the risk register.; Whatever is left over after you have applied your controls is called residual risk.NIS2 Management Training, Lesson 2.3: Risk Treatment Options and Risk Appetite. Also in: Lesson 3.4; Lesson 3.5
Responsible disclosure: The published process for outside security researchers to report bugs to your company.; There is a fourth piece in the same clause: vulnerability disclosure.NIS2 Management Training, Lesson 2.10: Measure 5 - Acquisition, Development, and Maintenance
restore test: The process of recovering data from a backup to verify the backup works; an untested backup is not a backup.
Reverse burden of proof: The rule in German company law (for example Section 93(2) AktG) that the director must prove they acted carefully, rather than the plaintiff proving negligence.; In many EU countries, including Germany, the reverse burden of proof applies to director liability.NIS2 Management Training, Lesson 1.7: Personal Liability Under Your Country’s Corporate Law
Risk acceptance: Deciding to live with a risk instead of fixing it; under CIR 2.1.1 the management body or, where applicable, an accountable risk owner accepts it, with adequate reporting to management.
Risk analysis: The process of identifying threats, assessing likelihood and impact, and determining treatment.; Foundation: (a) risk analysis and information security policies, and (f) effectiveness testing.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview. Also in: Lesson 3.2
Risk analysis methodology: The documented procedure for identifying and scoring risks; part of the Measure 1 policies under Article 21(2)(a).; First, a written method your company follows for identifying and scoring risks - the risk analysis methodology (Lesson 2.1 covered the equation behind it).NIS2 Management Training, Lesson 2.6: Measure 1 - Risk Analysis and Information Security Policies
Risk appetite: The level of risk the company is willing to live with, set by the management body as the boundary the CISO operates within.; One more thing the CEO owns: the risk appetite - the level of risk the company is willing to live with overall.NIS2 Management Training, Lesson 2.3: Risk Treatment Options and Risk Appetite
Risk assessment: The evaluation of threats and their potential impact on the organisation.; If your risk assessment only lists cyber attacks, it does not meet the all-hazards standard.NIS2 Management Training, Lesson 1.10: All-Hazards Approach and State of the Art. Also in: Lesson 2.1
Risk management cycle: The continuous loop of identify, analyse, treat, monitor - it never stops because the inputs change faster than an annual review can keep up with.; If there is no documented trigger process, the risk management cycle is not running.NIS2 Management Training, Lesson 2.4: Why Risk Management Is Continuous
Risk matrix: The grid that plots likelihood against impact; each identified risk is placed on it, and the top-right corner is where the management body's job begins.; After this lesson you will be able to look at a risk matrix, find the corner that matters, and know where the budget conversation starts.NIS2 Management Training, Lesson 2.1: Risk = Likelihood x Impact
Risk register: The formal document listing identified risks, their assessments, and treatment decisions.; The dated sign-off, the training record, the meeting minutes, the risk register with your signature - those are the evidence you use to prove due care.NIS2 Management Training, Lesson 1.7: Personal Liability Under Your Country’s Corporate Law. Also in: Lesson 2.1; Lesson 3.5
Risk treatment: The decision about what to do with an identified risk: avoid, mitigate, transfer, or accept.; Without it, every risk treatment decision becomes an argument rather than a process.NIS2 Management Training, Lesson 2.3: Risk Treatment Options and Risk Appetite
Risk-management measures: The rules, people, and tools your company uses to manage risks to its network and information systems and to limit the impact of incidents, set out in Article 21.; §30(2) BSIG; Do our risk-management measures meet the law's requirements, and are they documented?NIS2 Management Training, Lesson 3.1: The Questions Every CEO Must Answer
Root cause: The underlying reason an incident occurred.; Two or more incidents with the same apparent root cause, occurring within six months, that together cross the financial threshold are treated as one significant incident.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents
RPO: Recovery Point Objective - the maximum acceptable data loss, measured in time.; RPO - Recovery Point Objective - is how much data you can afford to lose.NIS2 Management Training, Lesson 2.8: Measure 3 - Business Continuity
RTO: Recovery Time Objective - the maximum acceptable time to restore service after a disruption.; RTO - Recovery Time Objective - is how quickly you must be back up.NIS2 Management Training, Lesson 2.8: Measure 3 - Business Continuity

S

sanctions law: The rules that prohibit paying certain persons and groups; under US rules regardless of intent, under EU rules liability falls away only if you did not know and had no reasonable cause to suspect a breach (Council Regulation (EU) 2019/796, Article 10(2)). The first legal check before any ransom payment.; Correct answer: "not now, and only after legal review of sanctions law."NIS2 Management Training, Lesson 3.8: Scenario - Ransomware Hits Friday Afternoon. Also in: Lesson 4.6
sanctions list: A published register of individuals, groups, and organisations that are prohibited from receiving payments.; The sanctions question was live throughout.NIS2 Management Training, Lesson 4.6: Ransomware Payment Decisions
SBOM: Software Bill of Materials. A machine-readable inventory of every software component in a product: names, versions, suppliers, and identifiers. Required for products with digital elements under Annex I, Part II, point (1) CRA.; This course teaches you how to build, maintain, and retain a SBOM that satisfies the Cyber Resilience Act.CRA SBOM Fundamentals, Lesson 0.1: What an SBOM Is and Why CRA Made It Mandatory
Scoping assessment: The check whether NIS2 applies to you and which category you fall into. You can run it yourself; a lawyer can support it.; "Have we completed a scoping assessment, and which category are we in?"NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
secure development: A documented standard for writing software with security built in, not added afterwards.
Secured communications: Secured voice, video, and text communications for sensitive business use; Article 21(2)(j) lists them as a measure to apply where appropriate.; The second half of the clause covers secured communications.NIS2 Management Training, Lesson 2.15: Measure 10 - Multi-Factor Authentication and Secured Communications
security control: A technical or organisational measure applied to manage a specific risk.
Sign-off: Your formal approval, as part of the management body, of the company's cybersecurity measures, required under Article 20(1) of the NIS2 Directive. A dated record is how you prove it.; If you have no evidence that you tried to understand your duties - no training record, no documented sign-off, no meeting minutes showing you asked the questions - the factor that tips all three layers in the wrong direction.NIS2 Management Training, Lesson 1.3: Penalties and the Manager Ban. Also in: Lesson 0.1; Lesson 1.5; Lesson 1.7; Lesson 3.3; Lesson 3.4
Significant incident: An incident with a significant impact on the entity's services, reportable under Article 23. Article 23(3) defines it; CIR 2024/2690 sets exact thresholds only for certain entity types, such as cloud and DNS providers.; Art. 23(3) NIS2, §2 No. 11 BSIG, §32 BSIG, CIR 2024/2690 Art. 3 (for the entity types in its Art. 1); Article 23 of the NIS2 Directive requires covered companies to report significant incidents to their national CSIRT or competent authority.NIS2 Management Training, Lesson 1.11: The Reporting Cascade and Significant Incidents. Also in: Lesson 3.1; Lesson 3.10; NIS 2 Tabletop Exercise Training, Lesson 1.1
Size threshold: The headcount, annual turnover and balance sheet total that decide whether a company is covered by NIS2.; Most companies enter scope through a simple size threshold: fifty or more employees, or more than ten million euros each in annual turnover and balance sheet total.NIS2 Management Training, Lesson 1.2: Who Is in Scope: Essential vs Important Entities
SPDX: Software Package Data Exchange. ISO/IEC 5962:2021 standard for SBOMs, originated at the Linux Foundation. License-focused: built around open-source license compliance and attribution. Available in JSON, YAML, RDF, and tag-value formats. Both CycloneDX and SPDX are commonly used, machine-readable formats and are accepted by BSI TR-03183-2. The CRA itself names no format in Annex I, Part II, point (1); the Commission may specify one (Article 13(24)).; The formats, CycloneDX and SPDX, fill that gap.CRA SBOM Fundamentals, Lesson 1.1: What Goes Into an SBOM: Components, Versions, and Identifiers. Also in: Lesson 0.1; Lesson 2.1; Lesson 2.2; Lesson 4.1
State of the art: The current level of proven best practice, to which recognised standards contribute; Article 21(1) names both. The auditor's yardstick moves as practice and standards move.; Article 21(1) requires measures that "take into account the state of the art."NIS2 Management Training, Lesson 1.10: All-Hazards Approach and State of the Art
Statutory duty: Something the law makes you personally do, as opposed to an ordinary business decision. NIS2 Article 20 creates statutory duties for the management body.; Every EU country's corporate law gives the company a mechanism to recover damages from a director who breached a statutory duty - something the law makes you personally do, different from an ordinary business decision.NIS2 Management Training, Lesson 1.7: Personal Liability Under Your Country’s Corporate Law. Also in: Lesson 1.8; Lesson 4.2
Sufficient knowledge: The standard in Article 20(2): enough knowledge and skills to identify risks and assess measures and their impact on services. The law requires neither an exam nor a certification.
Supervisory board: The oversight body in a two-tier corporate structure that can bring claims against directors.; Your supervisory board meets the next morning.NIS2 Management Training, Lesson 1.7: Personal Liability Under Your Country’s Corporate Law. Also in: Lesson 3.6
Supplier inventory: The maintained list of all suppliers with what they access and their risk classification.; One: a supplier inventory - who they are, what they do, what they can access.NIS2 Management Training, Lesson 2.9: Measure 4 - Supply Chain Security
Supply chain: The network of suppliers and service providers your company depends on.; Supply chain and systems: (d) supply chain security and (e) security in how you buy, build, and maintain IT systems, including vulnerability handling.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview. Also in: Lesson 2.9
Supply chain attack: An attack that targets a manufacturer through a compromised dependency or supplier, rather than attacking the manufacturer's own systems directly. SolarWinds and XZ Utils are examples. The SBOM is your map for identifying which supply chain components are present and therefore which supply chain attacks can reach your product.; Supplier matters for the supply chain attack risk picture.CRA SBOM Fundamentals, Lesson 1.1: What Goes Into an SBOM: Components, Versions, and Identifiers
Supply chain incident: A security event at a vendor that can create a legal obligation for your company under Articles 21 and 23.
Supply chain security: The requirement to assess and manage cybersecurity risks in your supply chain, especially IT service providers, cloud providers, and any supplier with access to your systems or data. Measures can include security requirements in supplier contracts, assessing supplier practices, and monitoring them over time; contract terms are mandatory only for the entity types covered by CIR 2024/2690.; §30(2)(4) BSIG
Support period: The time during which a manufacturer provides security updates for a product. CRA Article 13(8) requires the support period to be at least five years, or the expected use time if the product is expected to be in use for less than five years. The SBOM retention period runs for 10 years or until the end of this support period, whichever is longer.; Or the support period, whichever is longerCRA SBOM Fundamentals, Lesson 1.3: The 10-Year Retention Rule and Who Gets Access
Syft: An open-source SBOM generator by Anchore. Scans container images, filesystems, and language-specific package manifests. Outputs CycloneDX or SPDX. The fastest way to generate an initial SBOM for an existing product.; Syft by Anchore produces CycloneDX 1.6 JSON by default:CRA SBOM Fundamentals, Lesson 2.1: CycloneDX: The Security-Focused SBOM Format. Also in: Lesson 3.1; Lesson 4.1

T

tabletop exercise: A structured walkthrough of a realistic incident scenario with the people who would respond.; A paper rehearsal against a scenario is called a tabletop exercise.NIS2 Management Training, Lesson 2.7: Measure 2 - Incident Handling. Also in: Lesson 5.1; NIS 2 Tabletop Exercise Training, Lesson 0.1
Technical and organisational measures: The universal compliance shorthand (TOMs) for the combination of tools, processes, and rules required for each measure.; Your CISO will call these technical and organisational measures, or TOMs.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
Technical documentation: The set of documents a manufacturer must compile and keep under CRA Article 31 and Annex VII. Includes the SBOM, risk assessment, secure design decisions, test results, and the EU declaration of conformity. Must be retained for 10 years after the product is placed on the market, or for the support period, whichever is longer.; This lesson covers the retention period, where the SBOM fits in the broader technical documentation package, and who can request it and under what conditions.CRA SBOM Fundamentals, Lesson 1.3: The 10-Year Retention Rule and Who Gets Access. Also in: Lesson 0.1; Lesson 4.1
The ten measures: The ten categories listed in Article 21(2), representing the EU minimum scope of risk-management measures every covered company must have.
Third-party liability: The part of a policy that pays out to people outside the company when the company's failure damaged them.
Top-level dependency: A component that your product directly imports or links against. The CRA minimum in Annex I, Part II, point (1) requires the SBOM to cover at least these. If your code has `import requests` or `<dependency>spring-boot</dependency>`, those are top-level dependencies.; This lesson explains the difference between top-level and transitive dependencies, why the distinction exists in the law, and why best practice diverges from the legal minimum.CRA SBOM Fundamentals, Lesson 1.2: Top-Level vs Transitive Dependencies. Also in: Lesson 4.1
Training duty: The legal obligation under Article 20(2) NIS2 that every member of the management body must personally undertake cybersecurity training.; The training duty is personal and non-delegable.NIS2 Management Training, Lesson 1.6: Your Training Duty. Also in: Lesson 0.1
Transitive dependency: A component pulled in by one of your top-level dependencies, not by your code directly. Log4Shell (CVE-2021-44228) was a transitive dependency in thousands of applications whose teams had no idea it was there. The CRA minimum does not require listing these, but best practice does.; This lesson explains the difference between top-level and transitive dependencies, why the distinction exists in the law, and why best practice diverges from the legal minimum.CRA SBOM Fundamentals, Lesson 1.2: Top-Level vs Transitive Dependencies. Also in: Lesson 4.1
Transposition: The process where each EU country turns an EU directive into its own national law.; This IS a regulation, so it applies directly in all 27 member states without transposition - but only to the digital providers listed in its Article 1: DNS service providers, TLD name registries, cloud, data centre and CDN providers, managed and managed security service providers, online marketplaces, search engines, social networks, and trust service providers.NIS2 Management Training, Lesson 1.1: What NIS2 Is and Why It Exists. Also in: Lesson 0.1
Transposition law: The national law a country enacts to implement an EU directive.

V

VEX: Vulnerability Exploitability eXchange. A statement attached to an SBOM that documents whether a known CVE actually affects your product and why. Supported natively in CycloneDX. The CRA does not mention VEX, but a 'not affected' statement with a justification records why a known vulnerability needed no fix (Annex I, Part II).; CycloneDX has native VEX support.CRA SBOM Fundamentals, Lesson 2.2: SPDX and Choosing Your Format. Also in: Lesson 1.2; Lesson 2.1; Lesson 3.2; Lesson 4.1
Vulnerability: A weakness in a system that could be exploited by a threat.; Supply chain and systems: (d) supply chain security and (e) security in how you buy, build, and maintain IT systems, including vulnerability handling.NIS2 Management Training, Lesson 1.9: The Ten Measures: Overview
Vulnerability handling: The continuous process of finding, rating, and patching known vulnerabilities.; Article 21(2)(e) of the NIS2 Directive requires "security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure."NIS2 Management Training, Lesson 2.10: Measure 5 - Acquisition, Development, and Maintenance

W

Without undue delay: As soon as reasonably possible; the legal standard for the speed of customer notification.; Article 23(1) of the NIS2 Directive says that, where appropriate, entities notify the recipients of services "without undue delay" of significant incidents that are likely to adversely affect the provision of those services.NIS2 Management Training, Lesson 1.12: The Customer Notification Duty

Sources

BSIG, Act on the Federal Office for Information Security and on the Security of Information Technology of Entities (version of 2 December 2025): https://www.gesetze-im-internet.de/bsig_2025/
NIS2 Directive (EU) 2022/2555, Official Journal of the European Union: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
Commission Implementing Regulation (EU) 2024/2690, Official Journal of the European Union: https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj
Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal of the European Union: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
Regulation (EU) 2016/679 (GDPR), Official Journal of the European Union: https://eur-lex.europa.eu/eli/reg/2016/679/oj
BSI, IT-Grundschutz Standards BSI-200-1 through BSI-200-4
BSI, IT-Grundschutz Kompendium (current edition)

Been asked to handle NIS2?

In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.

Try 30 days, money back

Book a call

Free training for your Managing Director Pricing and terms

The NIS2 walkthrough: your path step by step, the first items done