Digitalization: BSI NIS2 board training, Grundschutz++ standard, EU vs online scams

This week was about accountability: who in a company answers for cybersecurity, and who on online platforms answers for scams and illegal goods. Germany's federal cybersecurity agency gave management practical tools, while Brussels pushed banks and platforms to work together.

Germany: a curriculum for NIS2 management training

On 28 October, at the it-sa trade fair in Nuremberg, Germany's Federal Office for Information Security (BSI) presented a sample curriculum for NIS2 management training. It is aimed at the management of "particularly important" and "important" entities as defined by law. Section 38 of the German BSI Act provides for this training, and the curriculum is one possible way to meet that requirement.

It covers the legal, organisational and technical links that matter most to management, and was developed with associations in Germany's Alliance for Cyber Security. It is not mandatory: the BSI calls it a basis for orientation and work, both for companies and for training providers. The PDF is on the BSI website, and the German Informatics Society published a checklist for reviewing existing courses against it.

Germany: Grundschutz++ becomes BSI Standard 300-1

On 26 October the BSI published its Grundschutz++ methodology as the new BSI Standard 300-1. It builds on the established IT-Grundschutz approach, with three main changes:

• it puts securing core business processes first;
• organisations can choose their own methods for identifying, assessing and treating risk, as long as they meet minimum criteria;
• all requirements are available in a machine-readable format.

The methodology now enters an early-adopter phase. An information security management system (ISMS) built on Grundschutz++ can be certified from 2027 and is compatible with ISO/IEC 27001.

EU: banks and platforms against online scams

The European Commission is consulting on whether to develop a voluntary code of conduct on online fraud under Article 45 of the Digital Services Act (DSA). It held a roundtable with banks and payment providers on 23 October and a workshop with trusted flaggers, civil society and consumer groups on 26 October. Meetings with very large platforms and search engines follow in early November.

The ideas under discussion include sharing scam signals between banks and platforms, verifying advertisers, especially those offering financial services, and closer work with trusted flaggers. Signal sharing would build on the upcoming Payment Services Regulation (PSR), which still awaits formal adoption.

EU: Temu's action plan accepted

On 26 October the Commission accepted Temu's action plan. In May 2026 it had found that Temu failed its DSA risk assessment obligations and fined it 200 million euros. The plan includes a platform-specific risk analysis, reliable metrics to show whether measures work, a review of whether recommender systems amplify illegal goods, and a look at sellers who misuse platform features. Temu has four months to implement it.

What it means for your business

1. If you serve German clients, expect NIS2 questions. Entities covered by NIS2 also check their suppliers. Keep a short, current description of your security measures ready.
2. Start security from your processes. Grundschutz++ shows the direction: protect the processes your revenue depends on first, then the rest.
3. Selling on marketplaces? Review your listings. The EU is watching sellers and advertisers more closely. Complete product and seller information lowers the risk of being blocked.

If you want to bring your processes and data security in line with EU rules, see our digitalization service or get in touch.