The German government today presented the draft for the national implementation of the European NIS 2 Directive. The aim of the law is to adapt German IT security law to the increased threat situation in cyberspace. Key changes concern the expansion of the scope of application and a strengthening of the role of the Federal Office for Information Security (BSI).

The draft bill to amend the BSI Act provides for so-called "important facilities" and "particularly important facilities" to be regulated in addition to critical infrastructure operators. This will increase the number of organizations covered by the law from around 4,500 to around 29,500.

In future, these facilities will have to report IT security incidents, register with the BSI and implement risk management, among other things. Technical and organizational measures such as risk analyses, security concepts, training, multi-factor authentication and measures to secure the supply chain are required.

Particular attention is paid to the responsibility of company management: Managers of affected organizations are obliged to undergo training in cyber risk management and to monitor compliance with security measures.

The draft also contains new requirements for the federal administration. In future, federal institutions should at least meet the requirements of the IT baseline protection compendium and existing BSI minimum standards. This is intended to create a uniform IT governance structure across all departments and authorities.

BSI President Claudia Plattner emphasized the importance of the project: "With today's government draft, Germany is taking an important step towards becoming a resilient cyber nation. In order to continue to secure prosperity and stability, the economy and state must be better armed against cyber threats. The economy needs planning security: companies must be able to determine quickly and with legal certainty whether they are affected by the NIS 2 Directive."

To support potentially affected organizations, the BSI offers advice and an interactive online test, available at: www.bsi.bund.de/dok/nis-2.