Law / Germany

Wertpapierhandelsgesetz (WpHG), Section 80 ICT Systems and Security Mechanisms of Investment Services Firms

WpHG § 80 Abs. 1 Satz 2 Nr. 1 und 4, as amended by Art. 4 Nr. 12 FinmadiG (BGBl. 2024 I Nr. 438)

In force since 30 Dec 2024.

A sector security regimes rule binding public and private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 12 October 2026.

What it requires

• If you are an investment services firm (Wertpapierdienstleistungsunternehmen) under the WpHG, Section 80(1) binds you alongside Regulation (EU) 2022/2554.
• Ensure the continuity and regularity of your investment services by relying on suitable and proportionate systems, including the ICT systems set up and managed under Article 7 of Regulation (EU) 2022/2554, and on suitable and proportionate resources and procedures (Section 80(1) sentence 2 number 1).NIST CSF 2.0PR.IR-03
• Have sound security mechanisms to meet the requirements of Regulation (EU) 2022/2554 that secure and authenticate the channels of information transfer, minimise the risk of data corruption and unauthorised access and prevent information leaks, so that the confidentiality of data is always ensured (Section 80(1) sentence 2 number 4).NIST CSF 2.0PR.DS-02

These lines are LexLint's reading of the law's text, as of 12 October 2026. Also read by: Federal Financial Supervisory Authority (BaFin), Bankenaufsicht, supervisory notice on implementing DORA in ICT risk management (guidance, recorded 12 October 2026).

In the frameworks

NIST Privacy Framework

• PR.DS-P2Data-in-transit are protected.
• PR.PT-P4Mechanisms (e.g., failsafe, load balancing, hot swap) are implemented to achieve resilience requirements in normal and adverse situations.

NIST CSF 2.0

• PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
• PR.IR-03Mechanisms are implemented to achieve resilience requirements in normal and adverse situations

CIS Controls

• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.

FINOS AIGF

• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance

1 more

• AIR-DET-001AI Data Leakage Prevention and Detection

ENISA NIS2 guidance

• 2.1Risk management framework
• 3.1Incident handling policy
• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure

2 more

• 9.1Cryptography
• 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

Who enforces it

When LexLint raises it

When your app profile says your app is a securities firm.

Back to the example  ·  Lint your app