What changed under NIS2, DORA, MaRisk, the German KRITIS act and the Cyber Resilience Act, what comes next and what it means for your audit. Every entry links to the primary source.
German KRITIS umbrella act: operators register no later than three months after their facility counts as critical. According to BBK, the regulation this depends on is still being coordinated.
BSI presents a sample curriculum for NIS2 management training
BSI published a sample curriculum for training management bodies. Section 38 of the German BSI Act requires the management of essential and important entities to attend training regularly. The curriculum is intended as a basis for initial training.
For the audit: Check that attendance by all members of management is evidenced and how regularity was defined. The curriculum is a useful benchmark for the content, but it is not a binding requirement.
Cyber Resilience Act: reporting obligations for manufacturers apply
Manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents through the ENISA reporting platform. Deadlines: early warning within 24 hours, notification within 72 hours. The final report follows no later than 14 days after a corrective measure is available for vulnerabilities, and within one month of the notification for incidents.
For the audit: This applies to manufacturers, not to every organisation using such products. First establish whether your own products are in scope. If so: are detection, responsibility and deputies covered at weekends too, and can the 24-hour deadline be evidenced in the process?
The new version entered into force on publication and is more principles-based. Where it creates additional requirements in individual cases, a transition period applies until 1 January 2027. According to BaFin, the general level of requirements has not been lowered.
For the audit: Move the criteria in existing audit programs to the new version and replace old references. Because explanatory text was removed, record what you measure adequacy against in each case.
DORA: guidance on the major ICT incident reporting form, May 2026 version
BaFin provides guidance on completing the reporting form for major ICT-related incidents, dated 15 May 2026.
For the audit: Check that the incident process and templates reflect this version and that the mandatory details would be available quickly in a real incident. A trial run on the form reveals gaps sooner than the process on paper.
The act of 11 March 2026 was promulgated on 16 March (BGBl. 2026 I No. 66) and entered into force the following day (section 14(3) to (5) only in 2030). It governs the physical resilience of critical facilities. The registration duty depends on a facility counting as critical; according to BBK, the relevant regulation is still being coordinated.
For the audit: Unless an individual determination exists, do not test registration yet. Instead check that someone is responsible, that classification is being prepared and that the periods after registration are planned: under section 8, duties under section 12 first apply nine months after registration, and those under sections 13, 18 and 20 ten months after it. Exception under section 4(2): these duties do not apply to DORA financial entities or the IT and telecoms sector; for municipal waste and social insurance only section 12 applies.
German NIS2 implementation act in force since 6 December 2025
Entities register no later than three months after they count as essential or important (section 33 BSIG). BSI points out that the statutory registration deadline has expired and asks late entities to register immediately.
For the audit: Ask to see the registration in the BSI portal and the documented scoping assessment. Also check who keeps changes to the registered details up to date.
DORA: guidance on the simplified ICT risk management framework
BaFin addresses the supervisory notice to institutions outside the CRR, among others. They apply the simplified framework under Article 16 DORA from January 2027. For them it replaces the BAIT.
For the audit: Stop planning 2027 audits against the BAIT. Check that the transition to Article 16 is planned and ownership assigned, and include third-party risk.
The radar is a selection for IT audits and does not claim to be complete. The “For the audit” sections are our own assessment, not legal advice and not a statement by the authorities. The current version of the source always prevails. Most sources are in German. Abbreviations: BaFin is the German financial supervisor, BSI the federal cyber security office, BBK the federal civil protection office; BAIT and MaRisk are BaFin requirements for banks, CRR is the EU Capital Requirements Regulation.