Since 6 December 2025, Germany's NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG) has been in full legal force, establishing the modernized BSI-Gesetz (BSIG). While Directive (EU) 2022/2555 established the baseline European framework, German organizations answer directly to the provisions of the BSIG and the supervisory oversight of the Federal Office for Information Security (BSI).
1. Scope and Entity Classification under the German BSIG
Under the reformed BSIG, organizations operating in Germany are categorized into two primary regulatory tiers: Besonders wichtige Einrichtungen (§ 28 Abs. 1 BSIG, corresponding to Essential Entities) and Wichtige Einrichtungen (§ 28 Abs. 2 BSIG, corresponding to Important Entities).
The standard classification evaluates entities against the European SME definition (Commission Recommendation 2003/361/EC):
- Large Entities: At least 250 employees or an annual turnover exceeding €50 million and an annual balance sheet total exceeding €43 million.
- Medium Entities: At least 50 employees or an annual turnover and balance sheet total exceeding €10 million (up to the large-entity ceiling).
Crucial Exception — Scope Regardless of Size (größenunabhängig): Under § 28 BSIG and NIS2 Art. 2(2), certain organizations are in scope regardless of headcount or revenue. These include qualified trust service providers, top-level domain (TLD) name registries, DNS service providers, domain name registration service providers, providers of public electronic communications networks or publicly available electronic communications services, and critical infrastructure operators exceeding statutory capacity thresholds.
Besonders wichtige Einrichtungen (§ 28 Abs. 1 BSIG)
Sectors of High Criticality (Anlage 1)
- Energy (Electricity, Oil, Gas, Hydrogen, District Heating)
- Transport & Logistics (Air, Rail, Water, Road)
- Finance (Banking & Financial Market Infrastructures)
- Health & Pharmaceuticals
- Water (Drinking Water & Waste Water)
- Digital Infrastructure (DNS, TLD, Cloud, Datacenters, CDNs)
- Information Technology Service Management (B2B)
- Public Administration
Supervision: Proactive ex-ante auditing, security evidence submission, and on-site BSI inspections.
Wichtige Einrichtungen (§ 28 Abs. 2 BSIG)
Other Critical Sectors (Anlage 2)
- Postal and Courier Services
- Waste Management
- Chemicals Manufacturing, Production & Distribution
- Food Production, Processing & Distribution
- Manufacturing (Medical devices, electronics, machinery, vehicles)
- Digital Providers (Online marketplaces, search engines, social networks)
- Research Organizations
Supervision: Reactive ex-post supervision triggered by reported incidents or substantiated indications of non-compliance.
2. Cybersecurity Risk-Management Measures (§ 30 BSIG / Art. 21 NIS2)
Section 30 BSIG transposes the risk-management requirements of NIS2 Article 21. Regulated entities must implement appropriate, proportionate, and state-of-the-art technical, operational, and organizational measures to manage cybersecurity risks and minimize the impact of incidents:
Information Security Policies & Risk Analysis
Documented risk assessment frameworks, systematic threat analysis, and management-approved security governance guidelines.
Incident Handling & Operational Containment
Operational detection, logging, containment, and forensics procedures to mitigate security events without service disruption.
Business Continuity, Backup Management & Disaster Recovery
Verified off-site and immutable backups, periodic disaster recovery drills, and tested recovery time (RTO) and point (RPO) objectives.
Supply Chain Security & Direct Supplier Due Diligence
Technical and contractual risk evaluation of direct suppliers, cloud providers, and external software maintainers.
Security in Systems Acquisition, Development & Maintenance
Secure lifecycle management, coordinated vulnerability handling, and systematic patch deployment schedules.
Control Effectiveness Assessment & Security Auditing
Periodic internal and external security audits, penetration testing, and continuous technical posture verification.
Basic Cyber Hygiene & Employee Security Training
Mandatory staff training, role-based awareness drills, and documented security hygiene practices across the organization.
Cryptography & Encryption Standards
Enforced data-at-rest and data-in-transit encryption utilizing modern cipher suites (TLS 1.3) and managed key lifecycles.
Human Resources Security, Access Control & Asset Management
Principle of least privilege (PoLP), strict joiner-mover-leaver workflows, privileged access management (PAM), and maintained asset inventories.
Multi-Factor Authentication (MFA) & Secure Communications
Hardware-backed or phishing-resistant MFA for administrative, remote, and employee access, supplemented by out-of-band emergency communications.
3. Statutory Incident Reporting Timelines (§ 32 BSIG)
Under § 32 BSIG, any significant incident having a substantial impact on the availability, authenticity, integrity, or confidentiality of services must be reported to the BSI according to strict statutory deadlines:
Early Warning (Erstmeldung)
Initial notification to the BSI stating whether the incident is suspected of being caused by unlawful or malicious acts, or has cross-border impact.
Incident Notification (Meldung)
Comprehensive update detailing initial severity assessment, technical indicators of compromise (IOCs), and known operational impact.
Final Report (Abschlussbericht)
Detailed post-incident review covering root-cause analysis, applied mitigation measures, financial cost estimate, and long-term remediation.
4. Executive Management Duties & Personal Liability (§ 38 BSIG)
German transposition under § 38 BSIG places explicit legal obligations directly upon the members of executive management bodies (Geschäftsleiter):
"Die Geschäftsleiter von besonders wichtigen Einrichtungen und wichtigen Einrichtungen sind verpflichtet, die von diesen Einrichtungen nach § 30 zu ergreifenden Risikomanagementmaßnahmen zu billigen und ihre Umsetzung zu überwachen... Sie haften der Einrichtung für jeden Schaden, der ihr aus einer schuldhaften Pflichtverletzung entsteht. Auf Ersatzansprüche der Einrichtung kann die Einrichtung nicht verzichten." — § 38 Abs. 1 & 2 BSIG
Key governance requirements for executive leaders include:
- Approval & Oversight: Executive management must formally approve all § 30 risk management measures and continuously monitor their operational implementation.
- Mandatory Training: Managing directors must regularly participate in cybersecurity training to acquire the requisite technical knowledge to evaluate risks and assess their impact.
- Non-Waivable Civil Liability: If management culpable fails to perform these duties, they are personally liable to the corporate entity for resulting damages. The entity is legally prohibited from waiving or settling these damage claims in advance.
- Administrative Enforcement & Fines (§ 65 BSIG): Fines reach up to €10 million or 2% of total worldwide annual turnover for particularly important entities, and up to €7 million or 1.4% for important entities. In extreme cases, supervisory authorities may initiate formal administrative proceedings to enforce compliance.
5. Structuring Your Technical Posture File
Managing § 38 liability and § 30 measure compliance requires objective evidence. Security leaders must move beyond annual static attestations toward tamper-evident configuration archives and automated posture telemetry mapped directly to § 30 BSIG technical controls.