Security-relevant Laws and Industrial Standards

Released by the German Parliament which has the central role in the protection of critical infrastructures in Germany.

According to the IT Security Act, plant owners of critical infrastructures must establish and certificate an ISMS (Information Security Management System) as well as fulfill a set of minimum technical requirements in order to protect and maintain the provision of its essential services. The act states that the information technology (IT) builds the basis of all security measures in a company.

Hinweis Note that cyber security for IT and OT (Operational Technology also known as ICS, Industrial Control Systems) requires other measures and procedures. Refer to the topic "IT and OT/ICS: A Comparison".

"Critical infrastructures" are facilities, installations or parts thereof belonging to the sectors of energy, information technology and telecommunications, transport and traffic, health, water, nutrition as well as finance and insurance and are of great importance for the functioning of the community because their failure or impairment would result in considerable supply bottlenecks or threats to public safety. Since version 2, the municipal waste management sector is also considered as critical infrastructure. In addition, "companies in the special public interest" fall within the scope of the Act. These include, for example, defense manufacturers and manufacturers of IT components for use in critical infrastructures or for processing classified government information. This is intended to secure the entire supply chain.
Also affected since version 2 are companies that are of significant economic importance to the Federal Republic of Germany. The same applies to their suppliers, which are relevant due to their unique selling propositions.
Therefore, the sectors mentioned must meet industry-specific minimum standards, including in particular the introduction of an ISMS. Moreover, they must report relevant incidents concerning IT security to the BSI. The BSI recommends suitable procedures for identifying and implementing security measures for the company's own information technology (IT). The aim of basic protection is to achieve a medium, appropriate and sufficient level of protection for IT systems. To achieve this goal, the "IT-Grundschutz" catalogues recommend technical security measures and infrastructural, organizational and staff-oriented protection measures.

Put in place by the EU (with the participation of the European Union Agency for Network and Information Security, ENISA).
The NSI directive is the first piece of EU-wide cyber-security legislation which must be transposed into national law by all member states.

Its goal is to enhance cyber-security across the European Union by improving cyber-security capabilities at national level with better EU-crossing cooperation at the same time.

Released by the EU (with the participation of the European Union Agency for Network and Information Security, ENISA).

This act is a comprehensive set of regulations, technical requirements, standards and procedures for certification or conformity assessment of products. The act serves the following purposes: