GermanyBSI-Gesetz (BSIG), Risk-Management Measures for Essential and Important Entities
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds a besonders wichtige Einrichtung (essential entity) or wichtige Einrichtung (important entity) under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider (Anlage 2 Nummer 6) among the digital-service providers it reaches expressly, at the wichtige Einrichtung threshold of at least 50 employees or an annual turnover and balance-sheet total each over EUR 10 million; the wider sector classes Section 28 also reaches (critical-facility operators, large telecommunications and digital-infrastructure providers including cloud computing, and public administration) are reached too, by declaring that you are an essential or important entity.
- Adopt technical and organisational measures adequate and proportionate to the risks facing the network and information systems you use to provide your services, and to minimise the impact of a security incident on your services and on others.NIST CSF 2.0ID.RA-06
- Cover at least: risk analysis and information-security policy; incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security; security in the acquisition, development and maintenance of your systems, including vulnerability management and disclosure; evaluation of your measures' effectiveness; basic cyber-hygiene training; cryptography; personnel security and access control; and multi-factor or continuous authentication.NIST CSF 2.0GV.PO-01
- Document your compliance with this duty.NIST CSF 2.0GV.PO-01
- Have your management body implement and oversee these measures and attend regular risk-management training; expect it to be liable to your organisation for culpable damage from a breach of that duty under the ordinary rules of company law.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Bundesamt für Sicherheit in der Informationstechnik (BSI) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 65's penalty regime for a Section 30 infringement is an administrative fine (Ordnungswidrigkeit); the Act creates no criminal offence for the infringement, its Part 8 consisting of Section 65 alone.
Penalty structure
Section 65(5) No. 1(a) sets the standard maximum fine for a besonders wichtige Einrichtung's infringement of Section 30(1) at EUR 10,000,000; Section 65(6) raises that to up to 2 percent of total worldwide annual turnover for an essential entity whose group turnover exceeds EUR 500,000,000, which is mathematically the higher of the two thresholds throughout, mirroring NIS2 Article 34(4). Section 65(5) No. 1(b) and Section 65(7) apply the same mechanism to a wichtige Einrichtung at a EUR 7,000,000 fixed cap or up to 1.4 percent of turnover above the same EUR 500,000,000 group-turnover gate, mirroring NIS2 Article 34(5).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Bundesamt für Sicherheit in der Informationstechnik (BSI), as the zuständige Aufsichtsbehörde (competent supervisory authority) for Part 3 of the BSIG over wichtige and besonders wichtige Einrichtungen established in Germany, Betreiber kritischer Anlagen whose critical facilities lie in Germany, and Einrichtungen der Bundesverwaltung.
Settledness
- As of
- Guidance link
- https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html
- Guidance body
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Open questions
- Does the Bundesministerium des Innern's Rechtsverordnung under Section 30(5), or a still-pending European Commission implementing act under NIS2 Article 21(5), narrow the ten baseline risk-management measure categories in Section 30(2) as they apply specifically to an online marketplace, online search engine or social-networking-platform provider?
What this law does
Section 30 requires a besonders wichtige Einrichtung or wichtige Einrichtung, as Section 28 defines them against the Anlage 1 and Anlage 2 sector lists, to adopt appropriate, proportionate and effective technical and organisational measures to avoid disruption to the availability, integrity and confidentiality of the network and information systems it uses to provide its services, and to minimise the impact of a security incident, weighing risk exposure, size, implementation cost, and the likelihood and severity of incidents.
The measures must cover at least ten baseline categories: risk analysis and information-security policy, incident handling, business continuity and crisis management, supply-chain security, security in system acquisition and development including vulnerability management and disclosure, evaluation of measures' effectiveness, basic cyber-hygiene training, cryptography, personnel security and access control, and multi-factor or continuous authentication, transposing NIS2 Article 21.
Anlage 2 Nummer 6 names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers this duty reaches expressly. Section 38 places implementation and oversight of these measures on the entity's management body, which is liable to the entity for culpable damage under the ordinary rules of company law and must attend regular training on recognising and assessing risk and risk-management practice.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .