--- title: About FAST LTA date: 2026-05-26T16:03:00+02:00 author: Hannes Heckel canonical_url: "https://www.fast-lta.de/en/fast/about" section: Corporate Pages --- [![E42796c6c46c8138f9f700b90cbb9964 MD5 | FAST LTA](https://fast-lta.transforms.svdcdn.com/production/images/blog/e42796c6c46c8138f9f700b90cbb9964_MD5.jpg?w=960&q=80&auto=format%2Cavif&fit=crop&dm=1776231152&s=50feaee01ec01f7db5ce202f8309699a)](https://www.fast-lta.de/en/blog/schatten-ki-im-unternehmen "Shadow AI in the workplace")[AI Knowledge Management](https://www.fast-lta.de/en/blog/ai-knowledge-management "AI Knowledge Management")[Data sovereignty](https://www.fast-lta.de/en/blog/data-sovereignty "Data sovereignty") [###### Article | 5/28/2026 Shadow AI in the workplace Risks, causes and what really helps [](https://www.fast-lta.de/en/blog/schatten-ki-im-unternehmen "Shadow AI in the workplace")](https://www.fast-lta.de/en/blog/schatten-ki-im-unternehmen "Shadow AI in the workplace")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 2/10/2026 EU-US Data Privacy Framework: How Stable Is the New Framework? The EU-US Data Privacy Framework (DPF) has been in effect since July 2023. It is intended to resolve the issues raised by Schrems II and once again permit transfers of personal data to the United States. But is it actually secure?In short: not fully. The framework survived its first court challenge in September 2025, but an appeal is pending before the EU Court of Justice, and the CLOUD Act still applies to US providers.--- [](https://www.fast-lta.de/en/blog/eu-us-data-privacy-framework-wie-stabil-ist-der-neue-rahmen "EU-US Data Privacy Framework: How Stable Is the New Framework?")](https://www.fast-lta.de/en/blog/eu-us-data-privacy-framework-wie-stabil-ist-der-neue-rahmen "EU-US Data Privacy Framework: How Stable Is the New Framework?")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 4/16/2026 Audit-Proof Archiving and GDPR: Retention vs. Right to Erasure Two legal obligations appear to collide. Retention law says: keep business records, unaltered, for years. The GDPR says: erase personal data when it is no longer needed (Art. 17). Companies that archive invoices, contracts, and correspondence hold personal data in both categories at once. So which rule wins, and how do you build an archive that satisfies both?--- [](https://www.fast-lta.de/en/blog/revisionssicherheit-und-dsgvo-aufbewahrung-vs-l%C3%B6schpflicht "Audit-Proof Archiving and GDPR: Retention vs. Right to Erasure")](https://www.fast-lta.de/en/blog/revisionssicherheit-und-dsgvo-aufbewahrung-vs-l%C3%B6schpflicht "Audit-Proof Archiving and GDPR: Retention vs. Right to Erasure")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 3/20/2026 Multi-Tier Backup Architecture: Best Practices 2026 The idea that "backup = one copy on external hardware" is sufficient is no longer defensible in 2026. Ransomware attacks backups just as aggressively as production systems: the Veeam Ransomware Trends Report 2025 found that 89 percent of attacks targeted backup repositories. A modern backup architecture requires multiple tiers that are isolated from each other and offer different trade-offs between performance, cost, and security.The 4-tier model is the practical standard for cyber resilience, and it maps directly onto what the NIS2 Directive (Directive (EU) 2022/2555) demands: backup management, disaster recovery, and crisis management as mandatory risk measures.--- [](https://www.fast-lta.de/en/blog/mehrstufige-backup-architektur-best-practices-2026 "Multi-Tier Backup Architecture: Best Practices 2026")](https://www.fast-lta.de/en/blog/mehrstufige-backup-architektur-best-practices-2026 "Multi-Tier Backup Architecture: Best Practices 2026")[IT resilience](https://www.fast-lta.de/en/blog/it-resilience "IT Resilience")[Ransomware protection](https://www.fast-lta.de/en/blog/ransomware-protection "Ransomware Protection") [###### Blog Post | 5/25/2026 Isolated Recovery Environment: Building a Protected Recovery Zone An Isolated Recovery Environment (IRE), sometimes called a cleanroom, is not a single device. It is an infrastructure zone that is completely isolated from the production network. It is the place where you restore, verify, and clean compromised systems before returning them to production.Without an IRE, recovery in a compromised network is a gamble: the restored server gets reinfected before you can use it.--- [](https://www.fast-lta.de/en/blog/isolated-recovery-environment-aufbau-einer-gesch%C3%BCtzten-recovery-zone "Isolated Recovery Environment: Building a Protected Recovery Zone")](https://www.fast-lta.de/en/blog/isolated-recovery-environment-aufbau-einer-gesch%C3%BCtzten-recovery-zone "Isolated Recovery Environment: Building a Protected Recovery Zone")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance")[Ransomware protection](https://www.fast-lta.de/en/blog/ransomware-protection "Ransomware Protection") [###### Blog Post | 2/6/2026 Ransomware-as-a-Service (RaaS): How the Shadow Economy Works Ransomware is no longer the work of lone hackers. The business model behind it operates like a tech startup: with customer service, affiliate programmes, and version updates. This model is called Ransomware-as-a-Service (RaaS), and it is why attacks have scaled so dramatically. The European Union Agency for Cybersecurity (ENISA) consistently ranks ransomware among the top threats in its Threat Landscape reports, with RaaS as a key driver.For IT decision-makers, understanding this is essential: ransomware gangs today are organised, well-funded criminal operations with development teams. That makes their attacks more efficient, more targeted, and harder to defend against than ever before.--- [](https://www.fast-lta.de/en/blog/ransomware-as-a-service-so-funktioniert-die-schattenwirtschaft "Ransomware-as-a-Service (RaaS): How the Shadow Economy Works")](https://www.fast-lta.de/en/blog/ransomware-as-a-service-so-funktioniert-die-schattenwirtschaft "Ransomware-as-a-Service (RaaS): How the Shadow Economy Works")[IT resilience](https://www.fast-lta.de/en/blog/it-resilience "IT Resilience")[Ransomware protection](https://www.fast-lta.de/en/blog/ransomware-protection "Ransomware Protection") [###### Blog Post | 5/28/2026 Recovery Time Objective: How to Calculate Your RTO Realistically RTO is one of the most important concepts in backup and disaster recovery management. But most organisations get it wrong. They say "our RTO is 4 hours," then when an attack hits, recovery takes 2 days. This article explains how to calculate RTO realistically and, more importantly, how to test it.--- [](https://www.fast-lta.de/en/blog/recovery-time-objective-so-berechnen-sie-ihr-rto-realistisch "Recovery Time Objective: How to Calculate Your RTO Realistically")](https://www.fast-lta.de/en/blog/recovery-time-objective-so-berechnen-sie-ihr-rto-realistisch "Recovery Time Objective: How to Calculate Your RTO Realistically")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 1/7/2026 NIS2 Explained: Who Is Affected and What Do You Need to Do? NIS2 is here. Directive (EU) 2022/2555 on network and information security applies across the European Union. Member states had to transpose it into national law by 17 October 2024. Many did so on time, some later: Germany, for example, brought its implementation act (NIS2UmsuCG) into force on 6 December 2025, without a general transition period. The result across the EU: tens of thousands of organisations must implement concrete IT security measures. Those that do not risk fines of up to EUR 10 million or 2% of global annual turnover.This article explains who is affected, what the directive requires, and what you need to do now.--- [](https://www.fast-lta.de/en/blog/nis2-einfach-erkl%C3%A4rt-wer-ist-betroffen-und-was-muss-ich-tun "NIS2 Explained: Who Is Affected and What Do You Need to Do?")](https://www.fast-lta.de/en/blog/nis2-einfach-erkl%C3%A4rt-wer-ist-betroffen-und-was-muss-ich-tun "NIS2 Explained: Who Is Affected and What Do You Need to Do?")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 2/11/2026 Compliance with WORM Storage: What External Financial Auditors Expect Every year, external financial auditors examine the annual accounts of companies across the EU. The statutory audit, harmonised by the EU Audit Directive (2006/43/EC, as amended), is conducted under International Standards on Auditing (ISA). One part of that audit regularly catches IT departments off guard: the auditor's assessment of the systems that store accounting records. If archived records can be altered or deleted, the auditor cannot rely on them as evidence.This article explains what auditors actually check in your archiving systems, why WORM storage (Write Once Read Many) has become the reference answer, and what documentation you should have ready before the audit team arrives.--- [](https://www.fast-lta.de/en/blog/compliance-mit-worm-speicher-was-wirtschaftspr%C3%BCfer-erwarten "Compliance with WORM Storage: What External Financial Auditors Expect")](https://www.fast-lta.de/en/blog/compliance-mit-worm-speicher-was-wirtschaftspr%C3%BCfer-erwarten "Compliance with WORM Storage: What External Financial Auditors Expect")[IT resilience](https://www.fast-lta.de/en/blog/it-resilience "IT Resilience")[Ransomware protection](https://www.fast-lta.de/en/blog/ransomware-protection "Ransomware Protection") [###### Blog Post | 5/27/2026 Recovery Runbook: What Goes in It and Who Maintains It A recovery runbook is not an IT philosophy. It is an operational handbook. It is the document your IT team reaches for during an actual disaster and uses to work through, step by step, how to bring systems back up.A good runbook is specific enough that someone who does not normally maintain the system could still restore it. That is the quality benchmark.--- [](https://www.fast-lta.de/en/blog/recovery-runbook-was-hineingeh%C3%B6rt-und-wer-es-pflegt "Recovery Runbook: What Goes in It and Who Maintains It")](https://www.fast-lta.de/en/blog/recovery-runbook-was-hineingeh%C3%B6rt-und-wer-es-pflegt "Recovery Runbook: What Goes in It and Who Maintains It")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance")[Ransomware protection](https://www.fast-lta.de/en/blog/ransomware-protection "Ransomware Protection") [###### Blog Post | 1/22/2026 Hybrid Backup Architecture: Best Practices for European Organizations Planning backup infrastructure with the goal of recovering in an emergency already puts you ahead of most. But failing to consider who else can access that data means planning incompletely. For European organizations, data sovereignty is not an optional feature; it is a prerequisite for regulatory compliance and operational independence.This article describes a 4-tier reference architecture for hybrid backup environments, with an explicit sovereignty assessment for each tier.--- [](https://www.fast-lta.de/en/blog/hybride-backup-architektur-datensouveraenitaet "Hybrid Backup Architecture: Best Practices for European Organizations")](https://www.fast-lta.de/en/blog/hybride-backup-architektur-datensouveraenitaet "Hybrid Backup Architecture: Best Practices for European Organizations")[Compliance](https://www.fast-lta.de/en/blog/compliance "Compliance") [###### Blog Post | 4/15/2026 Audit-Proof Archiving vs. Immutability: The Difference Matters A common misconception: "We use WORM storage, so we have audit-proof archiving." That is incorrect. Immutability is a necessary but not sufficient condition for audit-proof archiving.**Immutability** is the technical property that data cannot be deleted or altered after writing.**Audit-proof archiving** is the business and legal guarantee that an auditor or regulator can find, read, verify, and understand the data throughout the retention period.The distinction is critical, and it costs companies real money when they discover it during an audit.--- [](https://www.fast-lta.de/en/blog/revisionssicherheit-vs-unver%C3%A4nderlichkeit-der-unterschied-z%C3%A4hlt "Audit-Proof Archiving vs. Immutability: The Difference Matters")](https://www.fast-lta.de/en/blog/revisionssicherheit-vs-unver%C3%A4nderlichkeit-der-unterschied-z%C3%A4hlt "Audit-Proof Archiving vs. Immutability: The Difference Matters")