What is the difference between a particularly important and an important entity in Germany?

Mostly size, sector and supervision, not the core duties. The German law uses the terms besonders wichtige Einrichtung (particularly important entity) and wichtige Einrichtung (important entity) in section 28 of the BSIG; they correspond to NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.'s essential and important entities. Both must take the risk-management measures of section 30, report significant incidents under section 32, register under section 33 and meet the management duties of section 38. The differences lie in supervision and fines: the BSI can check particularly important entities proactively, order audits and require evidence (section 61), while for important entities it acts when facts suggest non-compliance (section 62); and the maximum fines under section 65 are higher for particularly important entities. Operators of critical installations, who are always particularly important, have additional duties, including systems for attack detection (section 31) and regular evidence (section 39).

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 15 questions on Germany: BSIGAll topics