SMEs without a situation centre
The standard provides for a security situation report but does not require a department of its own. An automated situation report on your sites, markets and risks is a practical way to start.
Security situation report under DIN SPEC 14027 with OSINT monitoring
DIN SPEC 14027 counts the security situation report among the 16 fields of action of corporate security. The AegisSight Monitor analyses hundreds of open sources for it and keeps your organisation's situation report continuously up to date, with source references for every statement.
Made in GermanyDeveloped and operated in Germany
GDPR-compliantOnly publicly accessible sources
Hundreds of sourcesContent in dozens of languages, translated automatically
Built forCompanies, public authorities, newsrooms and security services
What is DIN SPEC 14027?
Origin and structure of the standard at a glance.
What does the standard cover?
DIN SPEC 14027:2026-04 is titled "Corporate Security. Requirements for strengthening the physical resilience of organizations". It describes corporate security as a management task with an all-hazards approach and condenses the practice of large security departments so that smaller organisations can work with it too. Each of the 16 fields of action comes with a requirements catalogue in the annex. The consortium also calls the standard corporate security baseline protection, following the German economic baseline protection framework of 2016. The document is in German.
Who is behind it?
The German Federal Ministry of the Interior initiated and funded the standard as part of the National Economic Security Strategy. It was drawn up by a consortium of companies, public authorities, associations and universities led by BioNTech, with the University of the Bundeswehr Munich as deputy. It was presented on 19 March 2026 at the security conference of the Federal Office for the Protection of the Constitution and the VSW association, and the edition is dated April 2026. It is a voluntary standard under the PAS procedure, not part of the German body of standards, and creates no legal obligation. The full text is available from DIN Media after free registration.
Who is this relevant for?
The standard applies to organisations of every size and sector.
Corporate security in large companies
Existing situation centres relieve their analysts of manual source work and gain time for assessment and advice. The report complements internal reporting lines with the outside view from open sources.
Crisis teams and business continuity
In an emergency the crisis team needs a verified set of facts. The Monitor keeps it continuously up to date and documents the course of events with source references.
Plant security, travel security, events
Site managers, travel security officers and event security receive situation reports on regions, dates and threats without following dozens of sources in foreign languages themselves.
What does the standard require of the security situation report?
The standard describes the security situation report as the continuous presentation and analysis of the organisation's security situation. It is meant to create transparency about threats, incidents and risk trends and provides the basis for protection requirement analysis, crisis management, event security and travel security.
| Requirement of the standard | What the Monitor covers | What stays with you |
|---|---|---|
| A monitoring system that continuously observes relevant developments and events and detects threats and incidents early | Monitors hundreds of open sources on your organisation's topics around the clock and reports new developments | Internal sources such as plant security, HR or IT complete the picture |
| A monitoring process with observation, source assessment, classification, production of the product and handover to the responsible units | Observation, source assessment, summary and delivery by email or in the portal run automatically | You define the criteria and thresholds for classification |
| Identify, define and document reporting sources | Source management with a rating per source, every statement is linked to the original source, the number of sources per analysis is visible | Naming your own sources, associations and contacts at public authorities |
| Continuously compile all information into a current situation report and distinguish short-, medium- and long-term developments | The report is updated continuously, with a timeline and figures per period | Medium- and long-term assessment, with our support if desired |
| Systematically collect information on potential threats in order to react early | Topics, keywords and regions per report are freely definable, notification of new developments | Response and measures |
| A system with thresholds by which all items are analysed, assessed and classified | Every item carries a source role and a fact check in four stages, confirmed, unconfirmed, contradictory or refuted | Thresholds and the internal assessment |
| Present the situation report in a way suited to its audience | Three levels per report, the key developments, the summary and the sources, in German and English | Distribution to the recipients |
| Interfaces to other management systems and existing situation reports | Export as PDF and Word, data interface in JSON format | Connection to your systems |
| Systematic recording of events and items for reporting | Reports per situation, exportable at any time, shareable by link and email | Defining report format and frequency |
| Make monitoring findings available for risk analysis and protection requirement analysis | Figures and developments per topic can be exported and analysed | Risk assessment and protection requirement matrix |
| Recognise recurring incidents and connections in order to derive preventive measures | All items, interim states and fact checks remain stored in the report and can be compared across periods | Recording and assessing internal incidents and losses |
| Responsibility of top management, a responsible function and a defined circle of recipients | Roles, tenants and recipients per report are configurable | Definition and responsibility rest with your management |
Frequently asked questions about DIN SPEC 14027
What prospective customers ask us about the standard and the Monitor.
Is DIN SPEC 14027 mandatory?
No. DIN SPEC 14027 is a voluntary specification, not a law or a regulation. It was developed under the PAS procedure and is not part of the German body of standards. It only becomes binding when an organisation adopts it for itself or when a client, insurer or association makes it the basis of their requirements. Clients can use it as a common yardstick in tenders and supplier assessments.
Which 16 fields of action does DIN SPEC 14027 cover?
Clauses 5 to 20 of the standard each describe one field of action. Protection requirement analysis, security situation report, security culture and communication, internal investigation, disruption, emergency and crisis management, business continuity management, site security, close protection, event security, threat management, travel security, integrity screening, know-how protection, supply chain security, selection and management of security-related services, and the design and operation of a security management system. Each field comes with a requirements catalogue in Annex A. Information security, occupational safety, classified information protection, plant fire brigades and fraud prevention are deliberately left out.
What is a security situation report under DIN SPEC 14027?
Under clause 6, the security situation report is the continuous collection, assessment and presentation of all information that matters for the security situation of the organisation, from potential threats and risks to incidents that have occurred. It is meant to enable management to take informed decisions. The standard describes five phases for it. Determine the need, collect information, assess information, produce situation products and evaluate the process regularly. Scope and depth depend on the organisation's security level.
What do security levels A to D mean?
The requirements catalogues in Annex A distinguish four security levels from A (very high protection requirement) to D (low protection requirement). Which level applies results from the protection requirement analysis in clause 5. There, asset criticality and threat intensity are rated on four levels per asset and combined in a matrix. For the security situation report this means, for example, that a monitoring system is mandatory at levels A and B and recommended at levels C and D.
How does DIN SPEC 14027 differ from ISO 27001 and ISO 22301?
ISO 27001 covers information security and ISO 22301 business continuity management, and both are certifiable management system standards. DIN SPEC 14027 sits alongside them and describes physical corporate security with its 16 fields of action. It explicitly excludes information security and refers to ISO 27001 for it. Business continuity management is a field of action of its own in clause 10 that builds on ISO 22301. Organisations that use the standards together cover information, operations and physical security.
Can a company be certified to DIN SPEC 14027?
No. There is no certification procedure for organisations or for products. The standard is intended as a tool for self-assessment and names three user groups. Organisations building corporate security from scratch, organisations adding to existing structures, and organisations that want to benchmark where they stand. It can be used as a whole or in modules, meaning for individual fields of action only.
Does DIN SPEC 14027 also apply to small and medium-sized enterprises?
Yes. The standard is explicitly aimed at organisations of every size and sector. Through security levels A to D the effort adapts to the actual protection requirement. Companies without a situation centre of their own in particular can use an automated situation report as a starting point.
Where can I get DIN SPEC 14027?
DIN SPEC 14027:2026-04 is available free of charge as a PDF from DIN Media, and its development was funded by the German Federal Ministry of the Interior. A free customer account is required. The document has 202 pages and is available in German. The rights rest with DIN and the PDF may not be redistributed, which is why we link to the source and summarise the standard here in our own words.
Is the AegisSight Monitor certified to DIN SPEC 14027?
No. DIN SPEC 14027 is a voluntary standard with no certification procedure, neither for products nor for organisations. The AegisSight Monitor supports the implementation of the security situation report field of action by obtaining situational information from open sources, assessing it and providing it as an up-to-date situation report.
For which fields of action of DIN SPEC 14027 does the Monitor provide information?
Primarily for the security situation report (clause 6). Beyond that, for threat intensity in the protection requirement analysis (clause 5), disruption, emergency and crisis management (clause 9), event security (clause 13) and travel security (clause 15). The standard names site security, know-how protection, supply chain security and the security management system as further interfaces of the security situation report. The mapping shows the contributions in detail.