Where are NIS2 incidents reported in Germany?
To the joint reporting office (gemeinsame Meldestelle) of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), reached through the BSI portal. Section 32(1) of the BSIG sets the stages: an early first report within 24 hours of becoming aware of a significant incident, a report within 72 hours, an interim report when the BSI asks for one and a final report no later than one month after the 72-hour report. If the incident is still ongoing at that point, a progress report is due instead, and the final report follows once the incident has been handled (section 32(2)). The duty applies at the earliest once the reporting channel has been set up. Under section 36, the BSI confirms receipt without undue delay and, where possible, within 24 hours, and on request offers guidance on remedial measures.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- When must German companies register with the BSI?
- Which German companies fall under the new BSIG?
- What is the difference between a particularly important and an important entity in Germany?
- Why does the BSI registration ask for our public IP address ranges?
- What happens if we do not register with the BSI?