# Germany: BSIG (FAQ)

> 15 questions on Germany: BSIG, in plain language: what to check, what NetSenX shows and what a sensor cannot see.

Source page: https://netsenx.com/en/faq/germany

## Where are NIS2 incidents reported in Germany?

To the joint reporting office (gemeinsame Meldestelle) of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), reached through the BSI portal. Section 32(1) of the BSIG sets the stages: an early first report within 24 hours of becoming aware of a significant incident, a report within 72 hours, an interim report when the BSI asks for one and a final report no later than one month after the 72-hour report. If the incident is still ongoing at that point, a progress report is due instead, and the final report follows once the incident has been handled (section 32(2)). The duty applies at the earliest once the reporting channel has been set up. Under section 36, the BSI confirms receipt without undue delay and, where possible, within 24 hours, and on request offers guidance on remedial measures.

https://netsenx.com/en/faq/where-are-nis2-incidents-reported-in-germany

## When must German companies register with the BSI?

Under section 33(1) of the BSIG, particularly important and important entities must register within three months. The clock starts when they first or again count as such, and they use the registration facility set up by the BSI and the BBK. They submit their name and legal form, address and contact data including public IP address ranges, their sector, the Member States they serve and their supervisory authorities. Operators of critical installations will register under section 8 of the KRITIS-Dachgesetz instead (section 33(2)), but only once the regulation identifying critical installations under that law is in force; until then, section 66 keeps the earlier wording of section 33(2) in effect, so follow the BSI's current instructions. Changes must be reported without undue delay and at the latest within two weeks of becoming known (section 33(5)). If an entity does not register, the BSI can register it itself in agreement with the supervisory authorities (section 33(3)), and failing to submit the details correctly or in time is an administrative offence that can be fined up to EUR 500,000 under section 65. Keep the registration confirmation with your NIS2 records.

https://netsenx.com/en/faq/when-must-german-companies-register-with-the-bsi

## Which German companies fall under the new BSIG?

Mainly companies in the entity types listed in Annexes 1 and 2 of the BSIG that reach the size thresholds of section 28, plus some entities regardless of size. Under section 28(1), particularly important entities include operators of critical installations, qualified trust service providers, top-level domain registries and DNS service providers, and companies in an Annex 1 entity type with at least 250 employees or more than EUR 50 million turnover and more than EUR 43 million balance sheet total. Under section 28(2), important entities include other trust service providers and companies in an Annex 1 or 2 entity type with at least 50 employees or more than EUR 10 million in both turnover and balance sheet. Negligible side activities may be disregarded (section 28(3)), and partner or linked enterprises' figures are not added if the company is independent in its IT (section 28(4)). The BSI publishes a self-check on its website.

https://netsenx.com/en/faq/which-german-companies-fall-under-the-bsig

## What is the difference between a particularly important and an important entity in Germany?

Mostly size, sector and supervision, not the core duties. The German law uses the terms besonders wichtige Einrichtung (particularly important entity) and wichtige Einrichtung (important entity) in section 28 of the BSIG; they correspond to NIS2's essential and important entities. Both must take the risk-management measures of section 30, report significant incidents under section 32, register under section 33 and meet the management duties of section 38. The differences lie in supervision and fines: the BSI can check particularly important entities proactively, order audits and require evidence (section 61), while for important entities it acts when facts suggest non-compliance (section 62); and the maximum fines under section 65 are higher for particularly important entities. Operators of critical installations, who are always particularly important, have additional duties, including systems for attack detection (section 31) and regular evidence (section 39).

https://netsenx.com/en/faq/what-is-a-particularly-important-entity-in-germany

## Why does the BSI registration ask for our public IP address ranges?

Because section 33(1) of the BSIG lists them among the contact data entities must submit, so that the BSI can match warnings to the right organisation. When the BSI or a partner learns that an address in your range is part of a botnet, runs a vulnerable service or is under attack, it needs to know whose address it is to warn you quickly. In practice, many companies do not know their ranges offhand: they may be assigned by an internet provider, split across sites or spread over cloud services. Collect them from your provider contracts and router configuration, record which belong to which site, and keep the list current, since changes must be reported within two weeks under section 33(5). The registration does not authorise anyone to scan or attack those addresses. NetSenX does not register you, but its network view shows which internal devices talk to the outside through which addresses.

https://netsenx.com/en/faq/why-does-bsi-registration-ask-for-public-ip-ranges

## What happens if we do not register with the BSI?

The BSI can register you itself, ask for documents, and a fine is possible. Under section 33(3) of the BSIG, the BSI may carry out the registration in agreement with the competent supervisory authorities if an entity fails to do so. Under section 33(4), if facts suggest that an entity has not met its registration duty, it must, on request, provide the records and information the BSI needs for the assessment. Failing to submit the required details, or submitting them incorrectly, incompletely or late, is an administrative offence under section 65(2) no. 6, which can be fined up to EUR 500,000 under section 65(5). Not registering also does not suspend the other duties: the risk-management measures and reporting obligations apply because you meet the criteria, not because you registered. If you are unsure whether you are in scope, use the BSI's self-check and document the result.

https://netsenx.com/en/faq/what-happens-if-we-do-not-register-with-the-bsi

## What is a system for attack detection (System zur Angriffserkennung) under the BSIG?

It means processes, supported by technical tools and organisational integration, that detect attacks on IT systems. They do so by comparing the data processed in those systems with information and technical patterns that indicate attacks. That is the definition in section 2 no. 41 of the BSIG. Section 31(2) requires operators of critical installations to use such systems for the IT systems, components and processes that are decisive for the functioning of their critical installations; the systems must continuously and automatically collect and evaluate suitable parameters and features from ongoing operation, should be able to identify and avoid threats and provide remedies, and should follow the state of the art at a cost proportionate to the consequences of a failure. The definition stresses organisational integration: a tool nobody watches does not meet it. Network detection such as NetSenX can be one technical component; the processes, roles and response around it are yours.

https://netsenx.com/en/faq/what-is-a-system-for-attack-detection-under-the-bsig

## Does the duty to use attack detection apply to SMEs in Germany?

Not directly: section 31(2) of the BSIG applies to operators of critical installations only. Other particularly important and important entities, which includes many mid-sized companies, fall under the general risk-management measures of section 30, which require appropriate, proportionate and effective measures to avoid disruptions and minimise the impact of incidents, including the handling of security incidents (section 30(2) no. 2). Section 30 does not name attack detection, but handling incidents and meeting the 24-hour reporting stage of section 32 is hard without some way of noticing them, so many entities use detection in proportion to their risk. Customers that are critical operators may also require detection from suppliers by contract. Document why the detection you chose fits your size and exposure. NetSenX offers network detection on every plan, Free included, and states what it does not see.

https://netsenx.com/en/faq/does-the-attack-detection-duty-apply-to-smes-in-germany

## What does section 30 of the BSIG require from German companies in scope?

Appropriate, proportionate and effective technical and organisational measures, documented, covering at least ten areas. Section 30(1) requires particularly important and important entities to take measures to avoid disruptions of the availability, integrity and confidentiality of the IT systems, components and processes they use to provide their services, and to keep the impact of security incidents as low as possible. Proportionality considers the degree of risk exposure, the size of the entity, implementation costs, and the likelihood and severity of incidents and their social and economic impact. Compliance must be documented. Section 30(2) says the measures should follow the state of the art and consider relevant European and international standards, and must rest on an all-hazards approach; it lists the minimum areas, mirroring Article 21(2) of NIS2, from risk analysis and incident handling to multi-factor authentication. For certain digital providers, the EU implementing act takes precedence (section 30(3)).

https://netsenx.com/en/faq/what-does-section-30-bsig-require

## What are the fines under the German BSIG?

Up to EUR 10 million for particularly important entities and EUR 7 million for important entities for the main breaches, with turnover-based maximums for large companies. Section 65(5) of the BSIG sets these ceilings for breaches such as not taking the risk-management measures of section 30, not documenting them, not reporting incidents correctly or on time under section 32, and certain information duties under section 35. For entities with a total worldwide turnover of more than EUR 500 million, the maximum rises to 2% of turnover for particularly important and 1.4% for important entities (section 65(6) and (7)). Other breaches carry lower ceilings, for example up to EUR 500,000 for failing to register correctly or on time, and up to EUR 100,000 for some others. These are maximums: the actual amount depends on the case. Managers' liability to the entity under company law comes in addition, through section 38.

https://netsenx.com/en/faq/what-are-the-fines-under-the-bsig

## Are managing directors personally liable under the German BSIG?

Yes, towards the company, under the rules of company law. Section 38(1) of the BSIG obliges the management of particularly important and important entities to implement the risk-management measures of section 30 and to monitor their implementation. Under section 38(2), managers who breach these duties are liable to their entity for culpably caused damage according to the company-law rules that apply to its legal form; only where company law contains no such rule does the BSIG itself provide the liability. For a GmbH or an AG, that means the familiar standards of a diligent manager. In addition, for particularly important entities, the supervisory authority can, as a last resort, temporarily prohibit unreliable managers from exercising their function if BSI orders are not followed (section 61(9)). Document approvals, reviews and training, and check whether your D&O insurance covers these claims.

https://netsenx.com/en/faq/are-german-managing-directors-liable-under-the-bsig

## Must management in Germany attend cyber security training under the BSIG?

Yes, regularly. Section 38(3) of the BSIG requires the management of particularly important and important entities to attend training regularly, in order to gain sufficient knowledge and skills to recognise and assess risks and risk-management practices in information security, and to judge their impact on the services the entity provides. The law sets no number of hours, format or certificate, so choose training that fits your sector and size and repeat it at a sensible interval, for example yearly and after major changes in the threat picture or the law. The duty is personal to the members of management, so delegating it to the IT manager does not satisfy it. Keep certificates of attendance and the agenda: the BSI can include compliance with section 38(3) in audits it orders for particularly important entities under section 61(1), and act on it for important entities under section 62.

https://netsenx.com/en/faq/must-german-management-attend-cyber-security-training

## What does the BSI do after we submit an incident report?

It confirms receipt and can help, and in some cases it can require you or itself to inform the public. Under section 36(1) of the BSIG, the BSI sends the reporting entity a confirmation of receipt without undue delay and, where possible, within 24 hours, and on request provides guidance or operational advice on remedial measures; it can also offer additional technical support on request. Under section 36(2), if public awareness is needed to prevent or handle a significant incident, or disclosure is otherwise in the public interest, the BSI can, after hearing the entity, oblige it to inform the public, or inform the public itself. The BSI also uses reports to warn others and to build the national picture. Reporting does not create new obligations that would not apply otherwise: section 30(7) says so for voluntary reports and information exchange. Keep your own copy of everything you submitted.

https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report

## Do banks and other DORA financial entities in Germany follow the BSIG duties?

Largely not, for the core NIS2 duties: they follow DORA instead. Section 28(6) of the BSIG states that sections 30, 31, 32, 35, 36, 38 and 39, covering risk-management measures, attack detection, incident reporting, information duties, management duties and evidence, do not apply to financial entities under Article 2(2) of Regulation (EU) 2022/2554 (DORA) and to companies for which DORA's requirements apply through the German Banking Act or Insurance Supervision Act. Their ICT risk management and incident reporting are governed by DORA and supervised by the financial supervisor. Other BSIG provisions, such as registration under section 33, are not in that list, so check them separately. ICT providers to these financial entities are not exempted by this rule: if they are in scope of the BSIG themselves, they follow it, and DORA reaches them through their contracts.

https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties

## Can the BSI audit our company?

Yes, if you are in scope, in ways that depend on your category. For particularly important entities, the BSI can order audits, checks or certifications by independent bodies to verify the risk-management measures, the reporting duties and management training (section 61(1) BSIG); from three years after the law entered into force it can require evidence of compliance from other particularly important entities (section 61(3)); and it can inspect compliance itself, with the right to enter business premises during normal hours and to see records (section 61(5)). For important entities, the BSI checks compliance and can take the same measures when facts suggest that duties are not being met (section 62). Operators of critical installations must provide evidence through audits, checks or certifications every three years (section 39). Keep your documentation of section 30 measures ready, as section 30(1) requires it anyway.

https://netsenx.com/en/faq/can-the-bsi-audit-our-company

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: https://netsenx.com/en/faq