![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2025\/11\/bitkom-logo-400x300_3_TEXT.jpg\"){kind=logo}
<\/p>\n<\/p>\n
“The implementation of the European NIS 2 Directive was overdue. Cyber attacks threaten the economy, administration and society. German companies recently suffered an annual loss of 202 billion euros as a result,” says Bitkom President Dr. Ralf Wintergerst. The aim of the NIS 2 Directive is to strengthen resilience and cyber security in the member states. Among other things, the definition of critical infrastructure has been expanded to this end, obliging a large number of companies to take special security precautions.<\/p>\n
Bitkom considers it extremely positive that downstream federal authorities are included in the scope of NIS-2 in the law that has now been passed. Especially in sensitive areas of the federal administration, security breaches can cause considerable financial damage and damage trust in democratic institutions. “An effective and credible cyber security architecture requires that the state itself adheres to the highest security standards. It is only logical and right that federal authorities should in future be subject to the same risk management requirements as regulated companies,” says Wintergerst.<\/p>\n
In contrast, Bitkom believes that the new regulations on so-called critical components recently introduced into the legislative process are rather harmful. It is now planned that the Federal Ministry of the Interior will define critical components in coordination with other ministries and will also be able to independently prohibit their use in future. “Companies need reliable framework conditions; bans can have a significant impact on business activities. It is essential that those affected are consulted in advance before such important decisions are made,” says Wintergerst. In Bitkom’s opinion, critical components should continue to be defined on the basis of technical criteria by the Federal Network Agency and the Federal Office for Information Security (BSI).<\/p>\n
In order to protect Germany from cyber attacks and create a holistic approach to digital security, companies should be supported by the BSI in the practical implementation of the NIS 2 requirements. In addition, the KRITIS Umbrella Act must now also be adapted to the NIS-2 Implementation Act and implemented promptly.<\/p>\n
– – – – – –<\/p>\n