I will work in German and treat this as a preliminary technical assessment, not a binding legal classification. Based on the supplied evidence, the first high-priority issues are incomplete privileged-MFA coverage, missing proof of Tier-1 restore tests, and an undefined awareness-to-reporting escalation path. I will now produce the scope review, critical-system map, evidence matrix with E0–E4 evidence levels, reporting templates, management decisions, and prioritized remediation tickets. Any unresolved sector or entity-classification question will be listed separately for qualified legal review.