Purpose
The BSIG obliges operators of Critical Infrastructures as well as — since the implementation of the NIS2 Directive — around 29,500 "particularly important" and "important" entities to implement technical and organizational security measures in accordance with the state of the art and to promptly report significant security incidents to the BSI. This skill classifies a specific entity within the scope of application, determines the applicable obligations and assesses the fine and liability risk.
Legal situation note: The NIS2 Implementation Act (NIS2UmsuCG) came into force on 6.12.2025 and has recast the BSIG. The KRITIS obligations previously regulated in Section 8a BSIG (security/state of the art) and Section 8b BSIG (reporting obligation of the central body) are found in the new version in Section 30 BSIG (risk management), Section 31 BSIG (special KRITIS requirements) and Section 32 BSIG (reporting obligations). The skill identifies both references because legacy contracts, audit evidence and older industry standards still refer to Sections 8a, 8b BSIG.
Inputs
- Sector (energy, water, health, transport, finance, digital infrastructure, ICT service providers, …)
- Company size (employees, annual revenue / balance sheet total)
- KRITIS thresholds met? (KRITIS Ordinance)
- Existing measures (ISMS, certification, B3S industry standard)
- Last audit/inspection evidence (date)
- Pending or occurred security incident (time, impact)
Sub-agent architecture
The processing follows three conceptual roles. A scoping agent uses the sector, size and KRITIS thresholds to check whether the entity qualifies as a KRITIS operator, as a particularly important entity or as an important entity (Section 28 BSIG) — this classification controls the scope of obligations and the fine framework. An obligations agent maps the measure obligations (Section 30 BSIG / formerly Section 8a BSIG), special KRITIS obligations (Section 31 BSIG), reporting (Section 32 BSIG / formerly Section 8b BSIG), registration and evidence obligations and compares them with the actual status. A risk agent assesses deadline violations, missing evidence and personal management liability and quantifies the fine risk. The roles work sequentially; scoping is a prerequisite for any further assessment. For case numbers or details of the KRITIS Ordinance, zero fabrication applies: unverified information is marked with [unverifiziert – prüfen] .
Process
1. Scope of application (Section 28 BSIG)
- KRITIS operator: facility meets the threshold of the KRITIS Ordinance.
- Particularly important entity: includes large companies in critical sectors, qualified trust service providers, TLD registries, telecommunications.
- Important entity: medium-sized enterprises in covered sectors (rule: from 50 employees or EUR 10 million turnover/balance sheet total).
- The result determines the supervisory regime (ex ante / reactive) and the fine framework.
2. Risk management / state of the art (§ 30 BSIG, formerly § 8a BSIG)
Appropriate, proportionate and effective technical and organisational measures, including:
- Risk analysis and security concepts, concepts for cryptography and encryption
- Handling of security incidents, business continuity / backup management
- Supply chain security, access control, multi-factor authentication
- Assessment of effectiveness (state of the art, relevant European standards)
KRITIS operators: additionally systems for attack detection and proof obligation every two years (§ 31 BSIG, formerly § 8a BSIG para. 3).
3. Reporting obligations (§ 32 BSIG, formerly § 8b BSIG)
Multi-stage reporting scheme for significant security incidents via the BSI portal:
- Initial report immediately, at the latest 24 hours after becoming aware
- Follow-up report (confirmation/update) within 72 hours
- Final report within one month
An incident is significant in particular in the case of a serious operational disruption or financial/non-material damage to third parties.
4. Registration and governance
- Obligation to register with the BSI (§ 33 et seq. BSIG); deadline after entry into force on 6.3.2026 has expired — new entities register in due time.
- Managing directors must approve, monitor and receive training on risk measures (§ 38 BSIG); personal responsibility.
5. Sanctions (§ 65 BSIG)
- Particularly important entities: up to EUR 10 million or 2 % of worldwide annual turnover.
- Important entities: up to EUR 7 million or 1.4 % of turnover.
Risks / typical mistakes
- Late reporting — failure to submit the 24-hour initial report breaches the reporting obligation under § 32 BSIG and is subject to a fine.
- State of the art not complied with — outdated or undocumented measures do not satisfy § 30 BSIG (formerly § 8a BSIG).
- Fine — infringements of § 30/§ 32 BSIG trigger the framework of § 65 BSIG (up to 2 % of group turnover).
- Managing director liability — failure to approve/monitor the measures establishes personal responsibility of the management (§ 38 BSIG).
Output format
IT-SICHERHEIT & MELDEPFLICHTEN — <Einrichtung> — <Datum>
I. Anwendungsbereich (§ 28 BSIG)
Einordnung: [KRITIS / besonders wichtig / wichtig / nicht erfasst]
Sektor / Schwelle: <…>
II. Risikomanagement (§ 30 BSIG / § 8a BSIG a.F.)
Stand der Technik: [✓ / ⚠️ / ❌] Lücken: <…>
KRITIS-Nachweis (§ 31): [aktuell / fällig / fehlt]
III. Meldepflicht (§ 32 BSIG / § 8b BSIG a.F.)
24h / 72h / 1 Monat: [eingehalten / versäumt / N/A]
IV. Registrierung & Governance
BSI-Registrierung: [✓ / 🔴]
Geschäftsleiterpflichten: [erfüllt / offen]
V. Bußgeldrisiko (§ 65 BSIG)
Rahmen: <bis 10 Mio. / 7 Mio. EUR>
Handlungsempfehlung: <…>
Sources
- § 30 BSIG, § 31 BSIG, § 32 BSIG, § 65 BSIG (new version, in force since 6.12.2025)
- § 8a BSIG, § 8b BSIG (old version) — IT-SiG 2.0, still referenced in legacy documentation
- NIS2 Directive (EU) 2022/2555
- KRITIS Ordinance (BSI-KritisV); B3S industry standards of the BSI