Translate requirements into implementable measures.
Standards help when they fit actual risks and processes. I support technical inventories, map requirements to systems, prioritise gaps and implement selected measures with verifiable documentation. Applicability depends on the organisation, sector, size, product, processing and contract. Legal interpretation, formal audits and certification belong with qualified specialists.
Privacy and personal data
GDPR, BDSG and Articles 25/32
Map data flows, permissions, encryption and logging. Implement deletion and backup processes and data-minimising websites and forms.
BSI IT-Grundschutz
BSI Standards 200-1 to 200-4
Support system inventories, modelling, implementation evidence, risk analysis and continuity planning within this information-security framework.
ISO/IEC 27001:2022
Information security management
Provide technical inventory, risk input, control implementation, access/change/backup procedures and audit documentation. Technical support is offered, not certification.
Secure software development
OWASP ASVS, Top 10 and NIST SSDF
Use threat-oriented requirements, code review, automated checks, dependency/secret/container scans, security headers, CSP and input validation.
Digital accessibility
WCAG 2.2, EN 301 549, BITV 2.0 and BFSG
Applicability differs for public bodies and certain private services. Review semantics, keyboard and screen-reader use, contrast and forms with automated and manual tests and documented findings.
Further primary sources
Links point to the responsible legislators, standards bodies or publishers. Some German legal sources are available in German only. Paid ISO standards remain copyrighted and can be obtained from ISO.
ASLR on Linux
Address Space Layout Randomization makes addresses harder to predict but does not remove memory vulnerabilities. Read the technical article on ASLR, PIE and read-only checks.
Review carefully. Implement according to risk.
- Clarify applicability and contractual scope.
- Inventory systems, data and dependencies.
- Turn requirements into testable measures.
- Prioritise risk and effort.
- Implement and test.
- Document decisions, deviations and evidence.
I provide analysis, technical implementation and evidence, not legal advice or certification. Open interpretation questions are discussed with the relevant specialists.
When isolated systems make sense.
Self-hosted models can process inputs and documents within your own or dedicated infrastructure. Plan permissions, permitted network connections, updates and backups. Internet-isolated operation is a separately designed profile.
Privacy: GDPR Articles 25 and 32 require appropriate measures for privacy by design and risk-based security. Isolated processing can help limit access and data flows. BfDI guidance.
Trade secrets and confidentiality: section 2(1)(b) GeschGehG requires appropriate secrecy measures and section 4 addresses unlawful use and disclosure. Contracts may also limit third-party disclosure. Trade Secrets Act.
Professional secrecy: activities covered by section 203 StGB have specific disclosure limits and requirements for participating persons. Controlled infrastructure can support technical implementation.
Competition-sensitive information: section 1 GWB may matter where cross-business information handling leads to anticompetitive coordination. Separate systems and permissions can limit unwanted flows; legality requires separate assessment.
These rules do not universally require self-hosted models or offline operation. Specific protection or contractual requirements may call for isolation. Self-hosting alone does not ensure compliance. Relevant specialists assess legal obligations; Informatik Baums implements the agreed technical measures.