![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2025\/08\/bsi-logo-400x300_TEXT.jpg\"){kind=logo}
<\/p>\n<\/p>\n
The draft bill provides, among other things, for the BSI Act (BSIG) to be amended and the group of regulated organizations to be expanded to include the categories of “important institutions” and “particularly important institutions”. To date, around 4,500 organizations have been covered by the BSIG: Critical infrastructure operators, digital service providers and companies in the special public interest. With the expansion, the BSI will in future supervise around 29,500 facilities for which new legal obligations in IT security apply.<\/p>\n
For example, particularly important and important facilities must register, report significant security incidents and implement technical and organizational risk management measures. These include risk analyses, concepts for dealing with security incidents, supply chain security, training and awareness-raising measures, multi-factor authentication and secure communication. In addition, the NIS 2 directive makes cyber security a management issue: the management of affected institutions are obliged to implement the risk management measures, monitor their implementation and receive training on issues relating to the assessment and management of cyber risks.<\/p>\n
The draft law requires federal administration institutions to meet minimum information security requirements, which are derived from the BSI’s IT baseline protection compendium and minimum standards for security in federal information technology, among other things.<\/p>\n
BSI President Claudia Plattner: “With today’s government draft, Germany is taking an important step towards becoming a resilient cyber nation. In order to continue to secure prosperity and stability, the economy and the state must be better equipped against cyber threats. The economy needs planning security: companies must be able to determine quickly and with legal certainty whether they are affected by the NIS 2 Directive. The BSI is already supporting them with advisory services and will make the implementation of the legal requirements as smooth as possible. The government draft is also an important milestone for the state’s cyber protection: the implementation of BSI standards such as IT baseline protection by federal administration institutions is an essential prerequisite for this. The constantly growing threat situation in cyberspace must also be countered with an effective response in the form of a robust IT governance structure, particularly in the federal administration. This structure should extend across all departments, authorities and institutions of the federal administration and serve the goal of jointly organizing and continuously improving IT security.”<\/p>\n
In order to inform institutions that are potentially affected by new legal obligations, the BSI continuously provides support services and extensive information – including a website available on the BSI website at www.bsi.bund.de\/dok\/nis-2.<\/p>\n
– – – – – –<\/p>\n