What does section 30 of the BSIG require from German companies in scope?
Appropriate, proportionate and effective technical and organisational measures, documented, covering at least ten areas. Section 30(1) requires particularly important and important entities to take measures to avoid disruptions of the availability, integrity and confidentiality of the IT systems, components and processes they use to provide their services, and to keep the impact of security incidents as low as possible. Proportionality considers the degree of risk exposure, the size of the entity, implementation costs, and the likelihood and severity of incidents and their social and economic impact. Compliance must be documented. Section 30(2) says the measures should follow the state of the art and consider relevant European and international standards, and must rest on an all-hazards approach; it lists the minimum areas, mirroring Article 21(2) of NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., from risk analysis and incident handling to multi-factor authentication. For certain digital providers, the EU implementing act takes precedence (section 30(3)).
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What are the fines under the German BSIG?
- Are managing directors personally liable under the German BSIG?
- Must management in Germany attend cyber security training under the BSIG?
- What does the BSI do after we submit an incident report?
- Do banks and other DORA financial entities in Germany follow the BSIG duties?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.