GermanyBSI-Gesetz (BSIG), Incident Notification
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds a besonders wichtige Einrichtung or wichtige Einrichtung under Section 28, which names an online marketplace, an online search engine and a social-networking-platform provider among the digital-service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
- Notify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect.NIST CSF 2.0RS.CO-02
- Follow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.NIST CSF 2.0RS.CO-02
- Submit an intermediate report on the BSI's request, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once you have finished handling it.NIST CSF 2.0RS.CO-03
- Where you operate a critical facility (Betreiber kritischer Anlagen), additionally report the type of facility and critical service affected and the incident's effect on that service.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Bundesamt für Sicherheit in der Informationstechnik (BSI) (guidance, recorded ).
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 65's penalty regime for a Section 32 infringement is an administrative fine (Ordnungswidrigkeit); the Act creates no criminal offence for a failure to report, its Part 8 consisting of Section 65 alone.
Penalty structure
The same Section 65(5) No. 1(a) and (b), Section 65(6) and Section 65(7) tiers that govern a Section 30 infringement govern a Section 32(1) or 32(2) infringement: EUR 10,000,000 or, above EUR 500,000,000 group turnover, up to 2 percent of turnover for an essential entity, and EUR 7,000,000 or up to 1.4 percent of turnover for an important entity.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Bundesamt für Sicherheit in der Informationstechnik (BSI), as the zuständige Aufsichtsbehörde (competent supervisory authority) for Part 3 of the BSIG over wichtige and besonders wichtige Einrichtungen established in Germany, Betreiber kritischer Anlagen whose critical facilities lie in Germany, and Einrichtungen der Bundesverwaltung.
Settledness
- As of
- Guidance link
- https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html
- Guidance body
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
What this law does
Section 32 requires a besonders wichtige Einrichtung or wichtige Einrichtung to notify a joint reporting office run by the BSI and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe of a significant security incident on a graduated clock.
It requires an early warning within 24 hours of becoming aware of the incident, stating whether it may be unlawful or malicious or have cross-border effect, followed by a full notification within 72 hours that confirms or updates that assessment with the incident's severity, impact and any indicators of compromise, and an intermediate report on the BSI's request.
A final report is due within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report after its resolution, transposing NIS2 Article 23. A Betreiber kritischer Anlagen must additionally report the type of critical facility and critical service affected and the incident's effect on that service. Section 32(1) provides that the duty applies at the earliest from the establishment of the reporting channel.
The BSI states that the reporting duties have applied since . The BSI-Portal serves as the reporting office for serious security incidents, and an entity affected from that suffers a significant incident before it has registered there reports it through an online form.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .