Are managing directors personally liable under the German BSIG?
Yes, towards the company, under the rules of company law. Section 38(1) of the BSIG obliges the management of particularly important and important entities to implement the risk-management measures of section 30 and to monitor their implementation. Under section 38(2), managers who breach these duties are liable to their entity for culpably caused damage according to the company-law rules that apply to its legal form; only where company law contains no such rule does the BSIG itself provide the liability. For a GmbH or an AG, that means the familiar standards of a diligent manager. In addition, for particularly important entities, the supervisory authority can, as a last resort, temporarily prohibit unreliable managers from exercising their function if BSI orders are not followed (section 61(9)). Document approvals, reviews and training, and check whether your D&O insurance covers these claims.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.