Law / Germany

Telekommunikationsgesetz (TKG), Section 165 Technical and Organisational Protective Measures

TKG § 165, Technische und organisatorische Schutzmaßnahmen

In force since 1 Dec 2021.

A sector security regimes rule binding public and private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you provide telecommunications services or contribute to them, take appropriate technical precautions and other measures, taking the state of the art into account, to protect the secrecy of telecommunications and against personal-data breaches (Section 165(1)).NIST CSF 2.0PR.DS-02
• If you operate a public telecommunications network or provide a publicly available telecommunications service, take appropriate technical and organisational measures against disruptions that significantly impair networks and services and to control the risks to their security, including encryption where appropriate and measures that secure systems against unauthorised access and limit the effects of security breaches (Section 165(2)).NIST CSF 2.0PR.IR-01
• If you are an essential or important entity under Section 28 of the BSI Act, base those measures on an all-hazards approach that covers at least risk analysis and security concepts, incident handling, business continuity, supply-chain security, security in acquisition, development and maintenance including vulnerability management and disclosure, effectiveness assessment, basic cyber hygiene and training, cryptography, personnel security and access control, and multi-factor or continuous authentication (Section 165(2a)); have your management implement and monitor them and take part in regular training (Section 165(2b) and (2d)).NIST CSF 2.0GV.PO-01NIST CSF 2.0GV.RR-01
• If you operate a public network or provide a public service with increased hazard potential, use attack-detection systems that capture and evaluate threats continuously and automatically (Section 165(3)); as a network operator, use critical components only after a recognised certification body has examined and certified them (Section 165(4)), and undergo a review by a qualified independent body or competent national authority every two years, sending a copy of the report to the Bundesnetzagentur and the BSI and bearing the cost (Section 165(9)).NIST CSF 2.0DE.CM-01NIST CSF 2.0ID.RA-09
• If you operate a public telecommunications network, take measures to keep it operating properly and its services continuously available (Section 165(5)).NIST CSF 2.0PR.IR-03

These lines are LexLint's reading of the law's text, as of 12 October 2026. Also read by: Bundesnetzagentur (Federal Network Agency), catalogue of security requirements under Section 167 TKG (guidance, recorded 12 October 2026).

In the frameworks

NIST Privacy Framework

• PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
• PR.DS-P5Protections against data leaks are implemented.
• PR.PT-P4Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.

NIST CSF 2.0

• GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
• GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
• ID.RA-09The authenticity and integrity of hardware and software are assessed prior to acquisition and use
• PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
• PR.IR-01Networks and environments are protected from unauthorized logical access and usage
• PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

1 more

• DE.CM-01Networks and network services are monitored to find potentially adverse events

CIS Controls

• 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.
• 8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-006Data Quality & Classification/Sensitivity
• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest

7 more

• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance
• AIR-PREV-024Human-in-the-Loop Action Approval Gate
• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-011Human Feedback Loop for AI Systems
• AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

• 1.1Policy on the security of network and information systems
• 1.2Roles, responsibilities and authorities
• 2.1Risk management framework
• 2.2Compliance monitoring
• 3.1Incident handling policy
• 3.2Monitoring and logging

7 more

• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure
• 9.1Cryptography
• 11.2Management of access rights
• 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app provides telecom services or runs an essential service.

Back to the example  ·  Lint your app