Frequently asked questions
IT infrastructure describes the component view of a company — hardware, software, networks, data centres, cloud services. Digital infrastructure is the broader term: it covers the wider economic view including connectivity, data platforms, edge nodes and regulatory frameworks. In the 2026 Mittelstand this distinction is budget-relevant: companies that calculate only IT infrastructure routinely underestimate the platform and integration layer. We recommend running both views in parallel in the definition — the component view for procurement, the architectural view for the management decision.
Pragmatically and hybridly. DSAG 2026 data shows 42 percent S/4HANA on-premises, 22 percent private cloud and only 6 percent public cloud. Mid-sized manufacturers with 100 to 500 employees typically operate three to five cloud providers in parallel plus at least one on-premises data centre at the main location. The definition follows not a cloud-first doctrine but an architectural logic that first sorts latency-critical processes and regulatory duties, then deploys cloud shares selectively where commercially sensible.
A complete 2026 definition covers six component groups: the network layer (fibre, mobile, SD-WAN), the compute layer (data centre, private/public cloud, edge), the platform layer (containers, databases, middleware), the application layer (ERP, MES, CRM, PIM), the data layer (data lake, MDM, analytics) and the security and compliance layer (identity, NIS2 docs, GDPR). Companies that omit one of these layers when defining build in a gap that becomes expensive later.
Both regulations reshape the definition substantially. NIS2 has been due for national transposition since October 2024; the German NIS2 implementation act has been in force since 2026. The Cyber Resilience Act applies from 2027. A 2026 infrastructure definition must document which components fall in scope, who carries responsibility, how incidents are reported, and which security requirements suppliers must meet. We recommend treating NIS2 mapping and supply-chain security as fixed parts of every definition.