Runs an essential service, in Germany

TKG § 165, Technische und organisatorische Schutzmaßnahmen · Read the law's page

• If you provide telecommunications services or contribute to them, take appropriate technical precautions and other measures, taking the state of the art into account, to protect the secrecy of telecommunications and against personal-data breaches (Section 165(1)).
• If you operate a public telecommunications network or provide a publicly available telecommunications service, take appropriate technical and organisational measures against disruptions that significantly impair networks and services and to control the risks to their security, including encryption where appropriate and measures that secure systems against unauthorised access and limit the effects of security breaches (Section 165(2)).
• If you are an essential or important entity under Section 28 of the BSI Act, base those measures on an all-hazards approach that covers at least risk analysis and security concepts, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability management and disclosure, effectiveness assessment, basic cyber hygiene and training, cryptography, personnel security and access control, and multi-factor or continuous authentication (Section 165(2a)); have your management implement and monitor them and take part in regular training (Section 165(2b) and (2d)).
• If you operate a public network or provide a public service with increased hazard potential, use attack-detection systems that capture and evaluate threats continuously and automatically (Section 165(3)); as a network operator, use critical components only after a recognised certification body has examined and certified them (Section 165(4)), and undergo a review by a qualified independent body or competent national authority every two years, sending a copy of the report to the Bundesnetzagentur and the BSI and bearing the cost (Section 165(9)).
• If you operate a public telecommunications network, take measures to keep it operating properly and its services continuously available (Section 165(5)).

BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I Nr. 318), § 32 · Read the law's page

• This binds a besonders wichtige Einrichtung or wichtige Einrichtung under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
• Notify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect.
• Follow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it.
• Where you operate a critical facility (Betreiber kritischer Anlagen), additionally report the type of facility and critical service affected and the incident's effect on that service.

BSI-Gesetz (BSIG) vom 2. Dezember 2025, as last amended by Article 8 of the Act of 22 October 2026 (BGBl. 2026 I Nr. 318), §§ 28, 30, 38 · Read the law's page

• Adopt technical and organisational measures adequate and proportionate to the risks facing the network and information systems you use to provide your services, and to minimise the impact of a security incident on your services and on others.
• Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.
• Document your compliance with this duty.
• Have your management body implement and oversee these measures and attend regular risk-management training; expect it to be liable to your organisation for culpable damage from a breach of that duty under the ordinary rules of company law.
• This binds a besonders wichtige Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider (Anlage 2 Nummer 6) among the digital-service providers it reaches expressly, at the wichtige Einrichtung threshold of at least 50 employees or an annual turnover and balance-sheet total each over EUR 10 million; the wider sector classes Section 28 also reaches (critical-facility operators, large telecommunications and digital-infrastructure providers including cloud computing, and public administration) are reached too, by declaring that you are an essential or important entity.