Risk management ● ISO/IEC 27001, Risk management: covered. Assessing and treating information security risks is the core of the management system. ◐ ISO 9001, Risk management: partly covered. Risks and opportunities for quality and customer satisfaction, not for information security. ● ISO/IEC 42001, Risk management: covered. Assessing and treating AI risks, supplemented by an impact assessment for affected persons. ● NIS2, Risk management: covered. Measures under § 30 BSIG follow a risk-based approach with policies for risk analysis. ◐ GDPR, Risk management: partly covered. Assess risks to data subjects; where the risk is high, with a data protection impact assessment. ● BSI C5:2026, Risk management: covered. Risk management for the cloud service is part of the organisational criteria. ● DORA, Risk management: covered. Comprehensive framework for ICT risk management with clear responsibility of the management body. ● NIST CSF 2.0, Risk management: covered. Risk strategy and risk assessment in the Govern and Identify functions. ● SOC 2, Risk management: covered. A criteria group of its own for risk assessment, including fraud risks. ◐ HACCP, Risk management: partly covered. Hazard analysis for food, not for information or IT. – § 390 SGB V, Risk management: not a topic of its own. A fixed catalogue of requirements by practice size instead of a risk analysis of your own. ● EU AI Act, Risk management: covered. Risk management system across the life cycle of high-risk AI systems. Access control ● ISO/IEC 27001, Access control: covered. Identities, access rights and authentication are covered in detail. – ISO 9001, Access control: not a topic of its own. Not a topic of its own in this framework. – ISO/IEC 42001, Access control: not a topic of its own. For AI systems, usually covered via the ISMS. ● NIS2, Access control: covered. Access control policies and, where appropriate, multi-factor authentication. ◐ GDPR, Access control: partly covered. Confidentiality as part of the technical and organisational measures. ● BSI C5:2026, Access control: covered. A separate area for identity and access management. ● DORA, Access control: covered. Access and authorisation control as part of protecting ICT systems. ● NIST CSF 2.0, Access control: covered. Identity management, authentication and access control in the Protect function. ● SOC 2, Access control: covered. Logical and physical access form a criteria group of their own. – HACCP, Access control: not a topic of its own. Not a topic of its own in this framework. ● § 390 SGB V, Access control: covered. User accounts, passwords and screen locks in the practice. – EU AI Act, Access control: not a topic of its own. Not a topic of its own in this framework. Vendors and service providers ● ISO/IEC 27001, Vendors and service providers: covered. Security in supplier relationships and for cloud services. ● ISO 9001, Vendors and service providers: covered. Selecting, evaluating and monitoring external providers. ◐ ISO/IEC 42001, Vendors and service providers: partly covered. Responsibility towards third parties and suppliers in the AI life cycle. ● NIS2, Vendors and service providers: covered. Supply chain security is one of the ten measures. ● GDPR, Vendors and service providers: covered. Choose processors carefully and bind them by contract. ● BSI C5:2026, Vendors and service providers: covered. Management of the cloud provider’s service providers and subcontractors. ● DORA, Vendors and service providers: covered. ICT third-party risk with a register of information and contractual requirements. ● NIST CSF 2.0, Vendors and service providers: covered. A category of its own for supply chain risk in the Govern function. ● SOC 2, Vendors and service providers: covered. Assess and manage risks from vendors and business partners. ◐ HACCP, Vendors and service providers: partly covered. Requirements for raw materials and suppliers as part of basic hygiene. ◐ § 390 SGB V, Vendors and service providers: partly covered. Requirements for the practice’s IT service providers. ◐ EU AI Act, Vendors and service providers: partly covered. Obligations along the value chain between providers and deployers. Incident management and reporting ● ISO/IEC 27001, Incident management and reporting: covered. Detect, assess and handle incidents and learn from them. The standard does not set statutory reporting deadlines. ◐ ISO 9001, Incident management and reporting: partly covered. Nonconformities and corrective actions, not security incidents. ◐ ISO/IEC 42001, Incident management and reporting: partly covered. Handling incidents and informing interested parties. ● NIS2, Incident management and reporting: covered. Incident handling and staged reporting to the BSI under § 32 BSIG. ● GDPR, Incident management and reporting: covered. Report data breaches to the supervisory authority within 72 hours; where the risk is high, inform data subjects. ● BSI C5:2026, Incident management and reporting: covered. A separate area for security incidents, including informing customers. ● DORA, Incident management and reporting: covered. Classify incidents and report major ICT-related incidents to the supervisory authority. ● NIST CSF 2.0, Incident management and reporting: covered. The Respond function for analysis, containment and communication. ● SOC 2, Incident management and reporting: covered. Evaluate security events, respond to incidents and recover. ◐ HACCP, Incident management and reporting: partly covered. Corrective actions for deviations at critical control points. – § 390 SGB V, Incident management and reporting: not a topic of its own. Not a topic of its own in this framework. ◐ EU AI Act, Incident management and reporting: partly covered. Report serious incidents involving high-risk AI. Emergency and business continuity ◐ ISO/IEC 27001, Emergency and business continuity: partly covered. Information security during disruption and ICT readiness, not full business continuity management. – ISO 9001, Emergency and business continuity: not a topic of its own. Not a topic of its own in this framework. – ISO/IEC 42001, Emergency and business continuity: not a topic of its own. Not a topic of its own in this framework. ● NIS2, Emergency and business continuity: covered. Business continuity, backup management, recovery and crisis management. ◐ GDPR, Emergency and business continuity: partly covered. Availability and timely restoration of personal data. ● BSI C5:2026, Emergency and business continuity: covered. A separate area for emergency and continuity management. ● DORA, Emergency and business continuity: covered. ICT business continuity with plans, backups and regular tests. ◐ NIST CSF 2.0, Emergency and business continuity: partly covered. The Recover function for restoration after incidents. ◐ SOC 2, Emergency and business continuity: partly covered. Recovery and availability, covered in depth by the optional Availability criterion. – HACCP, Emergency and business continuity: not a topic of its own. Not a topic of its own in this framework. ◐ § 390 SGB V, Emergency and business continuity: partly covered. Data backup and emergency documentation for the practice. – EU AI Act, Emergency and business continuity: not a topic of its own. Not a topic of its own in this framework. Training and awareness ● ISO/IEC 27001, Training and awareness: covered. Competence, awareness and training in information security. ● ISO 9001, Training and awareness: covered. Competence and awareness of employees regarding quality. ● ISO/IEC 42001, Training and awareness: covered. Competence and awareness for the responsible use of AI. ● NIS2, Training and awareness: covered. Cyber hygiene and training, plus a training obligation for management. ◐ GDPR, Training and awareness: partly covered. Awareness-raising and training are among the tasks of the data protection officer. ● BSI C5:2026, Training and awareness: covered. Security training and awareness of staff. ● DORA, Training and awareness: covered. ICT security training, including for the management body. ● NIST CSF 2.0, Training and awareness: covered. Awareness and training as a category of its own. ◐ SOC 2, Training and awareness: partly covered. Competence and communication of security responsibilities. ◐ HACCP, Training and awareness: partly covered. Hygiene training and instruction of employees. ◐ § 390 SGB V, Training and awareness: partly covered. Instruction of the practice team. ● EU AI Act, Training and awareness: covered. AI literacy of employees who work with AI systems. Document control ● ISO/IEC 27001, Document control: covered. Create, approve, distribute and retain documented information. ● ISO 9001, Document control: covered. Create, approve, distribute and retain documented information. ● ISO/IEC 42001, Document control: covered. Documented information following the common structure of ISO standards. ◐ NIS2, Document control: partly covered. Compliance with the measures must be documented; the law does not specify how documents are controlled. ◐ GDPR, Document control: partly covered. Accountability and the record of processing activities. ◐ BSI C5:2026, Document control: partly covered. Document, review and update policies and procedures. ◐ DORA, Document control: partly covered. A documented framework with policies and procedures. ◐ NIST CSF 2.0, Document control: partly covered. Establish and communicate policies, with no requirements on document control. ◐ SOC 2, Document control: partly covered. Policies and procedures as the basis of control activities. ● HACCP, Document control: covered. Documentation and records are one of the seven principles. ◐ § 390 SGB V, Document control: partly covered. Evidence of implemented requirements. ● EU AI Act, Document control: covered. Technical documentation for high-risk AI systems. Internal audit ● ISO/IEC 27001, Internal audit: covered. Planned internal audits of the management system. ● ISO 9001, Internal audit: covered. Planned internal audits of the management system. ● ISO/IEC 42001, Internal audit: covered. Planned internal audits of the management system. ◐ NIS2, Internal audit: partly covered. Assess the effectiveness of the measures. Operators of critical facilities must also provide regular evidence. ◐ GDPR, Internal audit: partly covered. Regularly review the effectiveness of measures; monitoring by the data protection officer. ● BSI C5:2026, Internal audit: covered. Internal reviews of compliance with policies and requirements. ● DORA, Internal audit: covered. Internal audit regularly reviews the ICT risk management framework. ◐ NIST CSF 2.0, Internal audit: partly covered. Improvement based on assessments and tests. ◐ SOC 2, Internal audit: partly covered. Ongoing and separate monitoring of controls. ◐ HACCP, Internal audit: partly covered. Verification of whether the plan works. – § 390 SGB V, Internal audit: not a topic of its own. Not a topic of its own in this framework. ◐ EU AI Act, Internal audit: partly covered. Quality management and post-market monitoring by the provider. Management review ● ISO/IEC 27001, Management review: covered. Top management reviews the management system at planned intervals. ● ISO 9001, Management review: covered. Top management reviews the management system at planned intervals. ● ISO/IEC 42001, Management review: covered. Top management reviews the management system at planned intervals. ◐ NIS2, Management review: partly covered. Management implements the measures and monitors their implementation under § 38 BSIG. – GDPR, Management review: not a topic of its own. Not a topic of its own in this framework. ◐ BSI C5:2026, Management review: partly covered. Reports to management on the state of information security. ◐ DORA, Management review: partly covered. The management body bears responsibility and reviews the framework regularly. ◐ NIST CSF 2.0, Management review: partly covered. Oversight of the cybersecurity strategy in the Govern function. ◐ SOC 2, Management review: partly covered. Oversight by management and the board within the control environment. – HACCP, Management review: not a topic of its own. Not a topic of its own in this framework. – § 390 SGB V, Management review: not a topic of its own. Not a topic of its own in this framework. – EU AI Act, Management review: not a topic of its own. Not a topic of its own in this framework. Data protection ◐ ISO/IEC 27001, Data protection: partly covered. Protection of personal data as one control, not a privacy management system. – ISO 9001, Data protection: not a topic of its own. Not a topic of its own in this framework. ◐ ISO/IEC 42001, Data protection: partly covered. Provenance, quality and handling of data for AI systems. – NIS2, Data protection: not a topic of its own. Data protection is governed by the GDPR. In an incident, both reporting obligations can apply at the same time. ● GDPR, Data protection: covered. Principles, data subject rights, legal bases and technical measures. ◐ BSI C5:2026, Data protection: partly covered. Data location, transparency and handling of investigation requests. – DORA, Data protection: not a topic of its own. Not a topic of its own in this framework. – NIST CSF 2.0, Data protection: not a topic of its own. NIST covers data protection in a separate framework. ◐ SOC 2, Data protection: partly covered. Optional Privacy criterion for personal data. – HACCP, Data protection: not a topic of its own. Not a topic of its own in this framework. ◐ § 390 SGB V, Data protection: partly covered. Protection of patient data in the practice’s IT. ◐ EU AI Act, Data protection: partly covered. Data governance for training, validation and test data. Cryptography ● ISO/IEC 27001, Cryptography: covered. Rules for the use of cryptography and key management. – ISO 9001, Cryptography: not a topic of its own. Not a topic of its own in this framework. – ISO/IEC 42001, Cryptography: not a topic of its own. Not a topic of its own in this framework. ● NIS2, Cryptography: covered. Policies on cryptography and, where appropriate, encryption. ◐ GDPR, Cryptography: partly covered. Encryption as an explicitly named example of appropriate measures. ● BSI C5:2026, Cryptography: covered. A separate area for cryptography and key management. ● DORA, Cryptography: covered. Encryption and key management as part of the protective measures. ◐ NIST CSF 2.0, Cryptography: partly covered. Data security at rest and in transit, without a category of its own. ◐ SOC 2, Cryptography: partly covered. Encryption as part of access and transmission controls. – HACCP, Cryptography: not a topic of its own. Not a topic of its own in this framework. ◐ § 390 SGB V, Cryptography: partly covered. Encrypted transmission and storage in specific places. – EU AI Act, Cryptography: not a topic of its own. Not a topic of its own in this framework. Logging and monitoring ● ISO/IEC 27001, Logging and monitoring: covered. Logging of events and monitoring of systems. – ISO 9001, Logging and monitoring: not a topic of its own. Not a topic of its own in this framework. ◐ ISO/IEC 42001, Logging and monitoring: partly covered. Event logs during the operation of AI systems. ◐ NIS2, Logging and monitoring: partly covered. Detection of incidents; for operators of critical facilities, with attack detection systems. – GDPR, Logging and monitoring: not a topic of its own. Not a topic of its own in this framework. ● BSI C5:2026, Logging and monitoring: covered. Logging and monitoring in regular operation. ● DORA, Logging and monitoring: covered. Mechanisms to detect anomalous activities. ● NIST CSF 2.0, Logging and monitoring: covered. The Detect function with continuous monitoring. ● SOC 2, Logging and monitoring: covered. Monitoring of systems to detect anomalies. – HACCP, Logging and monitoring: not a topic of its own. Measurement records at control points, not IT logging. – § 390 SGB V, Logging and monitoring: not a topic of its own. Not a topic of its own in this framework. ● EU AI Act, Logging and monitoring: covered. Automatic logging for high-risk AI systems. Vulnerabilities and patches ● ISO/IEC 27001, Vulnerabilities and patches: covered. Identify, assess and remediate technical vulnerabilities. – ISO 9001, Vulnerabilities and patches: not a topic of its own. Not a topic of its own in this framework. – ISO/IEC 42001, Vulnerabilities and patches: not a topic of its own. Not a topic of its own in this framework. ● NIS2, Vulnerabilities and patches: covered. Security in acquisition, development and maintenance, including vulnerability handling. – GDPR, Vulnerabilities and patches: not a topic of its own. Not a topic of its own in this framework. ● BSI C5:2026, Vulnerabilities and patches: covered. Vulnerability and patch management in regular operation. ● DORA, Vulnerabilities and patches: covered. Vulnerabilities and patches as well as regular resilience testing. ● NIST CSF 2.0, Vulnerabilities and patches: covered. Identify and document vulnerabilities in assets. ● SOC 2, Vulnerabilities and patches: covered. Continuously monitor configurations and vulnerabilities. – HACCP, Vulnerabilities and patches: not a topic of its own. Not a topic of its own in this framework. ● § 390 SGB V, Vulnerabilities and patches: covered. Current updates for operating systems and programs. ◐ EU AI Act, Vulnerabilities and patches: partly covered. Robustness and cybersecurity for high-risk AI systems. Asset management ● ISO/IEC 27001, Asset management: covered. Inventory of information and other assets with owners. ◐ ISO 9001, Asset management: partly covered. Infrastructure and measuring equipment, not an information inventory. ◐ ISO/IEC 42001, Asset management: partly covered. Document the resources of AI systems. ● NIS2, Asset management: covered. Asset management as part of the ten measures. ◐ GDPR, Asset management: partly covered. Record of processing activities instead of an asset inventory. ● BSI C5:2026, Asset management: covered. Inventory, classification and return of assets. ● DORA, Asset management: covered. Identify and document ICT assets and dependencies. ● NIST CSF 2.0, Asset management: covered. Asset management as a category of its own in the Identify function. ◐ SOC 2, Asset management: partly covered. Inventory as the basis for access controls. – HACCP, Asset management: not a topic of its own. Not a topic of its own in this framework. ◐ § 390 SGB V, Asset management: partly covered. Overview of the practice’s devices, large medical equipment and telematics infrastructure (TI) components. ◐ EU AI Act, Asset management: partly covered. Inventory of AI systems as a prerequisite for classification. AI governance – ISO/IEC 27001, AI governance: not a topic of its own. Not a topic of its own in this framework. – ISO 9001, AI governance: not a topic of its own. Not a topic of its own in this framework. ● ISO/IEC 42001, AI governance: covered. Management system for the responsible development and use of AI. – NIS2, AI governance: not a topic of its own. Not a topic of its own in this framework. ◐ GDPR, AI governance: partly covered. Rules on automated individual decision-making. – BSI C5:2026, AI governance: not a topic of its own. Not a topic of its own in this framework. – DORA, AI governance: not a topic of its own. Not a topic of its own in this framework. – NIST CSF 2.0, AI governance: not a topic of its own. Not a topic of its own in this framework. – SOC 2, AI governance: not a topic of its own. Not a topic of its own in this framework. – HACCP, AI governance: not a topic of its own. Not a topic of its own in this framework. – § 390 SGB V, AI governance: not a topic of its own. Not a topic of its own in this framework. ● EU AI Act, AI governance: covered. Obligations per risk class for providers and deployers of AI systems. Food safety – ISO/IEC 27001, Food safety: not a topic of its own. Not a topic of its own in this framework. ◐ ISO 9001, Food safety: partly covered. Quality management as a framework, without requirements on food safety. – ISO/IEC 42001, Food safety: not a topic of its own. Not a topic of its own in this framework. – NIS2, Food safety: not a topic of its own. Food businesses can be affected, but the obligations concern IT. – GDPR, Food safety: not a topic of its own. Not a topic of its own in this framework. – BSI C5:2026, Food safety: not a topic of its own. Not a topic of its own in this framework. – DORA, Food safety: not a topic of its own. Not a topic of its own in this framework. – NIST CSF 2.0, Food safety: not a topic of its own. Not a topic of its own in this framework. – SOC 2, Food safety: not a topic of its own. Not a topic of its own in this framework. ● HACCP, Food safety: covered. Hazard analysis, critical control points, monitoring and verification. – § 390 SGB V, Food safety: not a topic of its own. Not a topic of its own in this framework. – EU AI Act, Food safety: not a topic of its own. Not a topic of its own in this framework. 
