https://proauditmap.com/en/regulatory-radar/ What changed at BaFin, BSI, BBK and the EU and what it means for IT audits: dates and changes with primary sources, also as an RSS feed. en Thu, 05 Nov 2026 00:00:00 GMT https://proauditmap.com/en/regulatory-radar/#bsi-curriculum-geschaeftsleitung https://proauditmap.com/en/regulatory-radar/#bsi-curriculum-geschaeftsleitung Wed, 28 Oct 2026 00:00:00 GMT BSI published a sample curriculum for training management bodies. Section 38 of the German BSI Act requires the management of essential and important entities to attend training regularly. The curriculum is intended as a basis for initial training. For the audit: Check that attendance by all members of management is evidenced and how regularity was defined. The curriculum is a useful benchmark for the content, but it is not a binding requirement. https://proauditmap.com/en/regulatory-radar/#cra-meldepflichten https://proauditmap.com/en/regulatory-radar/#cra-meldepflichten Fri, 11 Sep 2026 00:00:00 GMT Manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents through the ENISA reporting platform. Deadlines: early warning within 24 hours, notification within 72 hours. The final report follows no later than 14 days after a corrective measure is available for vulnerabilities, and within one month of the notification for incidents. For the audit: This applies to manufacturers, not to every organisation using such products. First establish whether your own products are in scope. If so: are detection, responsibility and deputies covered at weekends too, and can the 24-hour deadline be evidenced in the process? https://proauditmap.com/en/regulatory-radar/#marisk-rundschreiben-06-2026 https://proauditmap.com/en/regulatory-radar/#marisk-rundschreiben-06-2026 Tue, 30 Jun 2026 00:00:00 GMT The new version entered into force on publication and is more principles-based. Where it creates additional requirements in individual cases, a transition period applies until 1 January 2027. According to BaFin, the general level of requirements has not been lowered. For the audit: Move the criteria in existing audit programs to the new version and replace old references. Because explanatory text was removed, record what you measure adequacy against in each case. https://proauditmap.com/en/regulatory-radar/#dora-meldehinweise-mai-2026 https://proauditmap.com/en/regulatory-radar/#dora-meldehinweise-mai-2026 Fri, 15 May 2026 00:00:00 GMT BaFin provides guidance on completing the reporting form for major ICT-related incidents, dated 15 May 2026. For the audit: Check that the incident process and templates reflect this version and that the mandatory details would be available quickly in a real incident. A trial run on the form reveals gaps sooner than the process on paper. https://proauditmap.com/en/regulatory-radar/#kritis-dachgesetz-in-kraft https://proauditmap.com/en/regulatory-radar/#kritis-dachgesetz-in-kraft Tue, 17 Mar 2026 00:00:00 GMT The act of 11 March 2026 was promulgated on 16 March (BGBl. 2026 I No. 66) and entered into force the following day (section 14(3) to (5) only in 2030). It governs the physical resilience of critical facilities. The registration duty depends on a facility counting as critical; according to BBK, the relevant regulation is still being coordinated. For the audit: Unless an individual determination exists, do not test registration yet. Instead check that someone is responsible, that classification is being prepared and that the periods after registration are planned: under section 8, duties under section 12 first apply nine months after registration, and those under sections 13, 18 and 20 ten months after it. Exception under section 4(2): these duties do not apply to DORA financial entities or the IT and telecoms sector; for municipal waste and social insurance only section 12 applies. https://proauditmap.com/en/regulatory-radar/#nis2-umsetzung-registrierung https://proauditmap.com/en/regulatory-radar/#nis2-umsetzung-registrierung Sat, 06 Dec 2025 00:00:00 GMT Entities register no later than three months after they count as essential or important (section 33 BSIG). BSI points out that the statutory registration deadline has expired and asks late entities to register immediately. For the audit: Ask to see the registration in the BSI portal and the documented scoping assessment. Also check who keeps changes to the registered details up to date. https://proauditmap.com/en/regulatory-radar/#dora-artikel-16-hinweise https://proauditmap.com/en/regulatory-radar/#dora-artikel-16-hinweise Thu, 21 Aug 2025 00:00:00 GMT BaFin addresses the supervisory notice to institutions outside the CRR, among others. They apply the simplified framework under Article 16 DORA from January 2027. For them it replaces the BAIT. For the audit: Stop planning 2027 audits against the BAIT. Check that the transition to Article 16 is planned and ownership assigned, and include third-party risk.