NIS 2 Implementation and Cybersecurity Strengthening Act: Germany tightens IT security requirements

At the end of 2022, the EU has adopted important regulations to protect network and information security in so-called "critical sectors" with the "NIS2" directive. Thus, the protection of certain facilities and services against cyber threats is to be strengthened. In Germany, the directive is implemented by the NIS 2 Implementation and Cybersecurity Strengthening Act (German). In doing so, the draft law goes beyond the EU requirements and thus brings about numerous innovations in national cyber security law.

The draft NIS 2 Implementation and Cybersecurity Strengthening Act is to be adopted by mid-2024. The obligations it entails are to apply from 1 October 2024.

Scope

Significantly more companies than before will be included in the IT security regime through the core piece of the draft NIS 2 Implementation and Cybersecurity Strengthening Act - the amendment of the BSI Act. A distinction is made between "important" and "particularly important facilities" as well as "critical installations" (cf. section 28 (3), (6), (7) Draft BSI Act). All covered entities must fulfil a number of obligations.

All companies operating in the following sectors must expect to be included in the new security regime (cf. section 57 (1) Draft BSI Act):

• Energy,
• Transport and traffic,
• Finance and insurance,
• Health care,
• Drinking water,
• Waste water,
• Nutrition,
• Information technology and telecommunications,
• Space,
• Disposal of municipal waste,
• Logistics,
• Production,
• Chemistry,
• manufacturing industry,
• Digital service providers,
• Research institutions.

Which companies will be specifically covered can only be conclusively determined after the issuance of a supplementary regulation in which corresponding threshold values (e.g. company size, number of users) are defined.

However, Annex I of the NIS 2 Directive already provides a list of entities which will definitely be covered.

Risk management, reporting, registration, verification and information obligations

Under the Draft BSI Act, the companies covered and their management bodies are subject to a number of obligations. These depend in detail on whether the company is a "critical installation" or an "important" or "especially important facility".

Risk management: safety measures and risk assessment (section 30 Draft BSI Act)

All institutions are required to implement technical and organisational measures to protect their IT systems and processes. These measures shall be state of the art and shall adequately address the risk of potential damage, considering factors such as the size of the institution and potential security incidents. The primary responsibility for implementing and monitoring cybersecurity measures lies with the managing directors. They are also liable for breaches and should regularly participate in training (section 38 Draft BSI Act).

Reporting obligations (section 31 Draft BSI Act)

In the event of a security incident, the institutions must submit various reports to the Federal Office for Information Security, including an initial report within 24 hours and a detailed report within 72 hours, as well as a final report. Security incidents are defined as events that impair the availability, authenticity, integrity or confidentiality of data stored, transmitted or processed or of services offered or accessible via information technology systems, components and processes (section 2 (1) no. 37 Draft BSI Act).

Other duties

Compliance with the security requirements must be regularly demonstrated to the Federal Office for Information Security. In the event of security deficiencies, the Office may require operators of critical facilities and particularly important facilities to take corrective measures (section 34 Draft BSI Act). In addition, all facilities are required to register with the Office and provide relevant information (sections 32, 33 Draft BSI Act). In the event of significant security incidents, they may be obliged to inform their customers about them (sections 35, 36 Draft BSI Act).

Enforcement and sanctions:

The Federal Office for Information Security is responsible for verifying compliance with and enforcement of the aforementioned obligations (sections 62-65 Draft BSI Act). In doing so, it can directly influence the companies and take measures. These remain in force until the institution has complied with the authority's orders.
Non-compliance can result in severe fines (section 64 Draft BSI Act). According to the wording of the draft law, these can amount to up to twenty million euros or two percent of the total worldwide turnover of the company concerned in the previous business year.

What to do now - Preparing for the NIS 2 Implementation Act

Important, particularly important institutions and operators of critical facilities must, among other things, take appropriate, proportionate and effective technical and organisational measures to prevent disruptions to the availability, integrity, authenticity and confidentiality of the information technology systems, components and processes they use to provide their services and to prevent or minimise the impact of security incidents on their services or on other services. The draft law is not yet final. However, the requirements are not expected to change fundamentally. Companies should therefore address the following topics:

• Create concepts related to risk analysis and security for information systems,
• Managing security incidents,
• Business continuity, such as backup management and disaster recovery, and crisis management,
• Supply chain security,
• Security measures in the acquisition, development and maintenance of information technology systems, components and processes, including vulnerability management and disclosure,
• Create concepts and procedures to evaluate the effectiveness of cyber security risk management measures,
• Cyber hygiene procedures and cyber security training,
• Creating concepts and procedures for the use of cryptography and encryption,
• Staff security, access control concepts and asset management,
• Use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications and, where appropriate, secure emergency communication systems within the facility.