# Does the duty to use attack detection apply to SMEs in Germany?

Not directly: section 31(2) of the BSIG applies to operators of critical installations only. Other particularly important and important entities, which includes many mid-sized companies, fall under the general risk-management measures of section 30, which require appropriate, proportionate and effective measures to avoid disruptions and minimise the impact of incidents, including the handling of security incidents (section 30(2) no. 2). Section 30 does not name attack detection, but handling incidents and meeting the 24-hour reporting stage of section 32 is hard without some way of noticing them, so many entities use detection in proportion to their risk. Customers that are critical operators may also require detection from suppliers by contract. Document why the detection you chose fits your size and exposure. NetSenX offers network detection on every plan, Free included, and states what it does not see.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Germany: BSIG](https://netsenx.com/en/faq/germany) · https://netsenx.com/en/faq/does-the-attack-detection-duty-apply-to-smes-in-germany

## Read next

- https://netsenx.com/en/blog/2026-11-07_nis2-germany-bsig
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What does section 30 of the BSIG require from German companies in scope?](https://netsenx.com/en/faq/what-does-section-30-bsig-require)
- [What are the fines under the German BSIG?](https://netsenx.com/en/faq/what-are-the-fines-under-the-bsig)
- [Are managing directors personally liable under the German BSIG?](https://netsenx.com/en/faq/are-german-managing-directors-liable-under-the-bsig)
- [Must management in Germany attend cyber security training under the BSIG?](https://netsenx.com/en/faq/must-german-management-attend-cyber-security-training)
- [What does the BSI do after we submit an incident report?](https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report)