https://www.a-r-c.me/fachartikel/en.html Articles on security governance and regulation. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/ai-act-omnibus-governance-inventory.html https://www.a-r-c.me/fachartikel/ai-act-omnibus-governance-inventory.html Changed timelines and selected simplifications do not replace control: a decision-ready inventory connects AI systems, roles, classifications and evidence. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/nis2-registration-is-not-compliance.html https://www.a-r-c.me/fachartikel/nis2-registration-is-not-compliance.html A practical 30-day plan for turning a completed NIS2 portal process into defensible governance, current evidence and management decisions. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/cra-reporting-24-72-hours.html https://www.a-r-c.me/fachartikel/cra-reporting-24-72-hours.html A practical implementation plan for manufacturers that separates CRA reportable events, roles, 24/72-hour stages and defensible evidence paths. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/tisax-isa2027-supplier-governance.html https://www.a-r-c.me/fachartikel/tisax-isa2027-supplier-governance.html The annual ISA cycle does not shorten label validity. The practical shift is stronger, demonstrable governance of suppliers and material changes. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/grundschutz-plus-plus-migration-ready.html https://www.a-r-c.me/fachartikel/grundschutz-plus-plus-migration-ready.html Grundschutz++ remains under development. Organisations can still complete reversible groundwork that strengthens today’s ISMS and reduces later migration effort. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/kritis-dachgesetz-integrated-resilience-model.html https://www.a-r-c.me/fachartikel/kritis-dachgesetz-integrated-resilience-model.html A practical model connects dependencies, scenarios, measures, evidence and decisions while keeping statutory reporting routes distinct. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/iso-27001-post-transition-operational-readiness.html https://www.a-r-c.me/fachartikel/iso-27001-post-transition-operational-readiness.html After the version change, operational consistency becomes the test: decisions, controls and evidence must align across the audit period. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/sbom-governance-not-just-component-list.html https://www.a-r-c.me/fachartikel/sbom-governance-not-just-component-list.html Effective SBOM practice connects standardised product data to quality rules, vulnerability triage, supplier governance and documented decisions. Sat, 01 Aug 2026 20:00:00 +0000 https://www.a-r-c.me/fachartikel/nis2-reporting-implementation-status-risk-decision.html https://www.a-r-c.me/fachartikel/nis2-reporting-implementation-status-risk-decision.html How to turn NIS2 implementation status into a defensible risk decision by connecting business impact, effectiveness, accountability and executive action. Mon, 27 Jul 2026 20:30:00 +0000 https://www.a-r-c.me/fachartikel/ai-grc-consulting-experience-accountability.html https://www.a-r-c.me/fachartikel/ai-grc-consulting-experience-accountability.html Why AI commoditizes standard GRC output while experience, accountability, and defensible evidence gain value. Sat, 18 Jul 2026 12:00:00 +0000 https://www.a-r-c.me/fachartikel/eu-cybersecurity-requirements-us-companies.html https://www.a-r-c.me/fachartikel/eu-cybersecurity-requirements-us-companies.html A practical guide to NIS2, DORA, the Cyber Resilience Act, TISAX and reuse of NIST, SOC 2 or ISO 27001 evidence for U.S. companies selling into Europe. Fri, 17 Jul 2026 12:00:00 +0000 https://www.a-r-c.me/fachartikel/what-to-do-after-security-questionnaire.html https://www.a-r-c.me/fachartikel/what-to-do-after-security-questionnaire.html Why SaaS teams should not improvise security questionnaires — and how structured buyer communication reduces friction. Sat, 11 Jul 2026 21:26:20 +0000 https://www.a-r-c.me/fachartikel/iso-27001-ciso-required-by-law.html https://www.a-r-c.me/fachartikel/iso-27001-ciso-required-by-law.html When ISO 27001 or a CISO function becomes relevant through law, contract or governance, with sources on the BSIG, NIS2, GDPR and German company law. Sat, 11 Jul 2026 21:26:20 +0000 https://www.a-r-c.me/fachartikel/gobd-source-code-retention.html https://www.a-r-c.me/fachartikel/gobd-source-code-retention.html What the GoBD, German Fiscal Code and Commercial Code actually require for source code, program versions, procedural documentation and build tools. Sat, 11 Jul 2026 21:26:20 +0000 https://www.a-r-c.me/fachartikel/dora-software-provider-responsibility.html https://www.a-r-c.me/fachartikel/dora-software-provider-responsibility.html DORA accountability, minimum contract terms, audit rights and exit rights: what financial entities and software providers need to address. Sat, 11 Jul 2026 21:26:20 +0000 https://www.a-r-c.me/fachartikel/regulatory-change-software-defect-change-request.html https://www.a-r-c.me/fachartikel/regulatory-change-software-defect-change-request.html When new regulatory requirements fall within existing software support obligations—and when they require renegotiation or a change request. Sat, 11 Jul 2026 21:26:20 +0000