Which German companies fall under the new BSIG?
Mainly companies in the entity types listed in Annexes 1 and 2 of the BSIG that reach the size thresholds of section 28, plus some entities regardless of size. Under section 28(1), particularly important entities include operators of critical installations, qualified trust service providers, top-level domain registries and DNS service providers, and companies in an Annex 1 entity type with at least 250 employees or more than EUR 50 million turnover and more than EUR 43 million balance sheet total. Under section 28(2), important entities include other trust service providers and companies in an Annex 1 or 2 entity type with at least 50 employees or more than EUR 10 million in both turnover and balance sheet. Negligible side activities may be disregarded (section 28(3)), and partner or linked enterprises' figures are not added if the company is independent in its IT (section 28(4)). The BSI publishes a self-check on its website.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What is the difference between a particularly important and an important entity in Germany?
- Why does the BSI registration ask for our public IP address ranges?
- What happens if we do not register with the BSI?
- What is a system for attack detection (System zur Angriffserkennung) under the BSIG?
- Does the duty to use attack detection apply to SMEs in Germany?