In Germany, cybersecurity is once again the focus of legislative attention. Following the IT failures of entire universities and hospitals in Germany and of the fuel supply in the USA, critical infrastructures and companies of special public interest are to be held more accountable. This is now ensured by the new IT Security Act 2.0 and the third “KRITIS” regulation. The linchpins of the amendments are the strengthening of the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik  ̶ "BSI") in the BSI Act (BSI-Gesetz  ̶ "BSIG") and a significant expansion of the group of obligated parties.

From now on, consumer protection will also be one of the BSI's tasks. A new IT security label for consumers shall clearly show whether a product complies with relevant IT security standards. In addition, the BSI will in future be allowed to perform port scans at interfaces to public telecommunications networks at certain companies.

Companies must start to consider what impact the changes may have, because unlike previous changes, there is no grace or transition period and violations can now result in hefty fines of up to €2 million.

Companies should now clarify whether:

• they fall within the extended group of obligated parties  ̶ in particular as “KRITIS” or “UNBÖFI” ̶ and which IT security compliance requirements they must fulfill;
• they use critical IT components that may need to be reported to the Federal Ministry of the Interior (BMI);
• there is a need for action with regard to their supply chain;
• already existing processes can be used for IT security compliance  ̶ especially from data protection  ̶ or whether new processes need to be set up; and whether
• an IT security certificate becomes necessary.

In the following, we (1) provide an overview of the background and the most important changes. We then take a closer look at (2) the changes to companies concerned and (3) the area of product safety and critical components. (4) Finally, we turn our attention to the BSI's expanded competence in security and market surveillance in the digital domain.

1. Background and scope of application of the BSIG

The basis for combating IT-specific threats such as cyber attacks and security incidents is the Cyber Security Strategy for Germany, the German government's Digital Agenda and the EU's NIS Directive (DIR EU 2016/1148). These sources are now combined in the BSIG.

The BSIG assigns the BSI, as the central cybersecurity authority, with the tasks and powers necessary to ensure IT security, both vis-à-vis federal government agencies and private companies. The tasks and powers are diverse and, overall, aim to ensure the functionality of IT systems critical to the state or the functioning of public life.

Operators of critical infrastructures ("KRITIS") are required to take technical and organizational measures to prevent disruptions to the availability, integrity, authenticity and confidentiality of their information technology systems, components or processes. This also includes systems for attack detection. They must provide evidence to the BSI that these measures have been implemented. In the event of security incidents that have occurred or are feared, there is an immediate obligation to report them.

The same applies to providers of relevant digital services, including search engines, online marketplaces, cloud computing and telemedia services.

2. The new obligated parties

The innovations in IT security law are primarily intended to expand the group of companies concerned. For the time being, the term KRITIS remains central. This is to be expanded by a category: municipal waste disposal. A regulation will define the scope of this category in more detail.

The KRITIS categories, which have already been defined and specified in more detail, will be further expanded by a second amending regulation: Until now, the BSIG covered approximately 1,600 operators of critical infrastructure. Due to changes in the respective assessment criteria and thresholds, an estimated 270 additional operators are now to be added here.

In addition to KRITIS, a completely new area is to be included in the BSIG's catalog of obligations: For this purpose, there is now the new concept of a Company in the Special Public Interest (Unternehmen im beonderen öffentlichen Interesse  ̶ "UNBÖFI"). In this way, the legislator wants to take account of the fact that the IT security of crucial German economic players is of central importance, even if they do not serve a critical infrastructure (KRITIS). UNBÖFIs are essentially three types of companies – including their central suppliers:

Producers of IT security products

Producers of IT security products are manufacturers or developers of goods within the meaning of Section 60 (1) no. 1 and 3 of the German Federal Foreign Trade and Payments Ordinance (Außenwirtschaftsverordnung). This includes companies that:

• Produce products with IT security functions for processing classified government information; or
• Manufacture or have manufactured components of such products that are essential for the IT security function, and still have the technology on which this is based;

and their products or, in the case of components essential to the IT security function, the entire products have been approved by the BSI.

Critical operators according to the German Federal Immission Control Act

Critical operators according to the German Federal Immission Control Act (Bundesimmissionsschutzgesetz  ̶  BImSchG) are those operators who fall into an operating area of the upper class according to the 12th BImSchV (the Major Accidents Regulation), as well as those operators of an operating area of the lower classes equivalent to those in the regulation, i.e. operators using substances designated as hazardous are present in quantities that reach or exceed the quantity thresholds specified in the regulation.

Companies of significant economic importance

Companies of significant economic importance are companies that are among the largest companies in Germany in terms of adding domestic value and are therefore of significant importance for the economy of Germany. However, which companies are covered by this exactly has still to be defined by a further regulation. An indication of a possible list is provided by the so-called main report of the Monopolies Commission of the German Federal Cartel Office, which lists the 100 largest companies in terms of their economic value. The current report can be viewed here; the list for the 2018 reporting year can be found in the tables in Chapter II.

Suppliers of companies of significant economic importance

Suppliers of companies of significant economic importance, which are essential because of their unique selling proposition. However, what is meant by “unique selling proposition” is to be defined by a new regulation too.

3. Product safety and critical components

With the IT Security Act 2.0, the digitalization of product law is advancing. 

IT security identifier

A voluntary IT security label will be introduced to inform consumers, which companies can use for marketing purposes, among other things. To this end, the BSI will introduce a uniform label to inform consumers about the IT security of products in certain product categories defined by the BSI. The label is likely to be of particular interest to foreign companies in order to convince German consumers that the IT product meets German security standards.

In implementation of European law, the planned amendments to the German Civil Code (Bürgerliches Gesetzbuch  ̶ BGB) will create an updated obligation for the distributing company in the event that digital products are provided to consumers. 

Intervention powers of the BSI

Further amendments relate to the creation of intervention powers for the BSI for the use and operation of critical components. A regulation prohibiting the use of such components from untrusted manufacturers is intended to increase product security in the area of critical infrastructures.

Both hardware and software that is of high importance for the functioning of the community is covered because disruptions to the availability, integrity, authenticity, and confidentiality of the IT product can lead to a failure or to a significant impairment of the functioning of critical infrastructures or to threats to public safety.

The new requirements for critical components are closely intertwined with the new Telecommunications Act. For more details, please refer to our Client Alert on the Telecommunications Modernization Act.

4. In the digital domain: security and market surveillance by the BSI  ̶  obligations for companies

The amended BSIG also serves to adapt protection mechanisms and defense strategies in view of a steady increase in IT malware. Specifically, it therefore provides for an improvement in the protection of IT products and systems made available on the market, among other things by giving the BSI further testing and monitoring powers and setting minimum standards:

• The BSI has been given the authority to detect malware. For example, the BSI is allowed to use so-called "port scans" to determine whether operators of publicly accessible information technology systems have closed security vulnerabilities that have become known to the BSI.
• If the BSI becomes aware of security vulnerabilities or risks emanating from a telecommunications or telemedia service, the authority can order the providers of such services to take measures to eliminate the risks (e.g., a software update).

The IT Security Act 2.0 also gives the BSI far-reaching powers to issue orders to telecommunications and telemedia providers to avert specific threats to information security. At the same time, the obligations for companies are also being expanded.