ITSicherheitsgesetz

The IT-Sicherheitsgesetz, or IT Security Act (often abbreviated IT-SIG), is a German federal law aimed at strengthening information technology security in critical infrastructure and in essential digital services. It was enacted in 2015 and later supplemented by a major reform in 2021, commonly referred to as IT-Sicherheitsgesetz 2.0. The act seeks to raise the security standard of IT systems, improve resilience to cyber threats, and enhance the ability of authorities to respond to incidents.

Scope and key obligations. The law applies to operators of critical infrastructures (KRITIS) in sectors designated by the government and by the Federal Office for Information Security (BSI), including energy, water, health, finance, IT and telecommunications, transport and traffic, and public administration. It also covers providers of essential digital services. Obligations include implementing appropriate technical and organizational security measures, establishing IT risk management, and maintaining governance and incident response capabilities. The act requires designated entities to align their security practices with standards published or endorsed by the BSI and to designate points of contact for IT security matters.

Incident reporting and enforcement. The IT-SIG imposes duties to classify, manage, and report significant IT security incidents to the BSI and, where applicable, to other relevant authorities. The BSI is empowered to issue security requirements, monitor compliance, provide assistance, and, if necessary, enforce measures through supervisory actions and penalties.

Impact and evolution. The IT-Sicherheitsgesetz marked a milestone in Germany’s cyber policy by codifying security obligations for critical sectors and strengthening state coordination of cyber defense. The 2.0 reform broadened the scope to include additional digital service providers and strengthened supply-chain and product-security considerations, reflecting an expanded approach to national IT resilience.