During the annual audit of a medium-sized company, the auditor identifies serious security deficiencies in the IT-supported accounting. Access rights are not assigned in a traceable way, changes to booking-relevant data are not logged. The auditor cannot issue a clean opinion — with immediate consequences for the company’s creditworthiness.
Violations of laws or regulations (G 0.29) often arise where information security does not keep pace with legal requirements. BSI lists this threat as one of the broadest in the IT-Grundschutz catalogue.
What’s behind it?
The legal landscape around information security is complex and constantly evolving. Organisations must comply with a multitude of laws, regulations and contractual obligations simultaneously — and correctly assess their relevance to their specific situation.
Regulatory areas
- Data protection — GDPR, BDSG and the German federal state data protection acts govern the handling of personal data. Violations can lead to fines of up to 20 million euros or 4% of annual turnover.
- Commercial and tax law — HGB and AO require the proper processing of booking-relevant data, including traceability and audit-proof records.
- Corporate law — KonTraG, GmbHG and AktG establish due diligence obligations of management in the area of risk management and information security.
- Industry-specific regulation — Operators of critical infrastructure are subject to the IT Security Act, financial service providers to BAIT/VAIT, healthcare institutions to SGB V.
- Contractual obligations — In the automotive industry, for example, manufacturers require their suppliers to comply with certain security standards (TISAX). Violations can result in contractual penalties or loss of the business relationship.
Impact
Legal violations cause multi-dimensional damage: fines, contractual penalties, civil damage claims, criminal consequences for responsible persons and reputational loss. The reputational damage can exceed the financial damage in the long term — especially in data protection breaches that become public.
Practical examples
Data protection violation through missing deletion routines. A company stores customer data from contractual relationships that ended more than ten years ago. The data has never been deleted, and no deletion concept exists. During a supervisory audit, the violation of storage limitation (GDPR Art. 5) is identified. A six-figure fine follows.
Supplier loses TISAX approval. An automotive supplier fails to implement the security measures required by its client. In the TISAX assessment, the company fails. The client sets a three-month remediation deadline. If the requirements are not met, termination of the business relationship looms — an existential risk for the supplier.
Missing logging in financial audit. A company’s accounting uses an ERP system in which changes to booking entries are not logged in an audit-proof manner. The auditor cannot confirm the integrity of the financial data and refuses to issue an unqualified opinion. Banks and investors read this as an alarm signal.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 79 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.5.31 — Legal, statutory, regulatory and contractual requirements: Systematic identification and documentation of all relevant requirements.
- A.5.34 — Privacy and protection of personal identifiable information (PII): Specific measures for compliance with data protection requirements.
- A.5.36 — Compliance with policies, rules and standards for information security: Regular review of whether policies and standards are complied with.
- A.6.3 — Information security awareness, education and training: Training on legal requirements and consequences of non-compliance.
Detection:
- A.5.35 — Independent review of information security: Internal and external audits uncover compliance gaps.
- A.8.15 — Logging: Audit-proof logging as evidence for auditors and supervisory authorities.
Response:
- A.5.24 — Information security incident management planning and preparation: Notification duties for data breaches (72-hour deadline under GDPR Art. 33).
- A.5.5 — Contact with authorities: Established communication channels to supervisory authorities, data protection authorities and other relevant bodies.
BSI IT-Grundschutz
G 0.29 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- ORP.5 (Compliance management) — Requirements for systematic compliance with legal and contractual obligations.
- ORP.2 (Personnel) — Employment law aspects and duties of employees.
- CON.1 (Cryptographic concept) — Compliance with regulatory requirements for cryptography.
- DER.3.1 (Audits and inspections) — Internal and external review of compliance.
Sources
- BSI: The State of IT Security in Germany — Annual report with reference to regulatory developments
- BSI IT-Grundschutz: Elementary Threats, G 0.29 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 5.31 — Implementation guidance on legal and regulatory requirements