New: EU CAPTCHA – GDPR-compliant bot protection. Try it free for 3 months!
Home>
IT Security Act: Rules and Obligations Under IT-SiG 2.0
At a
Glance
- 1. What is the IT Security Act – Short Explanation?
- 2. What is the purpose of the IT Security Act?
- 3. Who is subject to the IT Security Act?
- 4. What has changed with the IT Security Act 2.0?
- 5. How are IT-SiG 2.0 and NIS-2 related?
- 6. What specific obligations do companies have?
- 7. Conclusion: IT security is shifting from a luxury to a necessity
01
What is the IT Security Act – Short Explanation?
The IT Security Act is designed as an omnibus bill. This means that it amends and supplements several existing laws simultaneously—including the Federal Office for Information Security Act, the Energy Industry Act, the Telecommunications Act, and the Telemedia Act. This results in a comprehensive legal framework for information security in Germany.
The law addresses three target groups: operators of critical infrastructure (KRITIS) with particularly strict obligations, companies of special public interest (UBI/UNBÖFI) such as defense contractors or corporations of significant economic importance, and federal authorities and public administration.
Key Information on the IT-SiG
IT-SiG in effect since July 2015; IT-SiG 2.0 since May 2021
Central supervisory authority: BSI
Applicable to: KRITIS operators, UBI/UNBÖFI federal administration
Fines: up to €20 million or 4% of global annual turnover
In parallel: NIS-2 expands the requirements of the IT-SiG
04
What has changed with the IT Security Act 2.0?
The IT-SiG 2.0 came into effect in May 2021 and updated the list of requirements to reflect the current threat landscape. At its core, the IT-SiG 2.0 provides for an active protective role for the BSI on behalf of the state, the economy, and the public. The most significant changes concern, on the one hand, the expanded powers of the BSI and, on the other hand, stricter obligations for KRITIS operators, including significantly higher fines.
Expanded BSI Powers
The BSI is being restructured into a proactive cybersecurity agency that identifies and closes relevant security vulnerabilities in the systems of the business sector and society. To this end, the BSI is to monitor the internet for vulnerable or unsecured devices (IoT / IIoT / ICS) and notify affected companies and users.
Port scans to identify vulnerable systems on the German network
Authority to deploy security patches to proactively disrupt botnets and eliminate malware from compromised devices
Use of sinkhole servers to block communication between bots and C&C servers
Establishment of binding minimum standards for the federal administration
Introduction of a voluntary IT security label for consumer products
Stricter Requirements for KRITIS Operators
Since the IT-SiG 2.0 came into effect, KRITIS operators have been required to comply with a significantly more extensive set of obligations. These focus on technical protective measures, increased transparency toward the BSI, and stricter requirements for the use of critical components.
Use of intrusion detection systems is mandatory
Expanded reporting requirements for IT security incidents
Declaration of guarantee for the use of critical components
Mandatory reporting for the initial use of critical components
Drastically Increased Fines
Under the IT Security Act 2.0, fines for cybersecurity violations are based on the European General Data Protection Regulation (GDPR). Serious violations can be punished with fines of up to 20 million euros or up to 4 percent of the organization’s total worldwide annual revenue from the previous year—whichever amount is higher. The previous penalty range capped at 100,000 euros per violation.
FAQ – Frequently Asked Questions About the IT Security Act
The German IT Security Act (IT-SiG) has been in force since July 2015. The revised and significantly expanded version, IT-SiG 2.0, came into force in May 2021.
About the author
Stefan Bordel
Senior Editor
About the author
Stefan Bordel has been working as Editor and Technical Writer at Myra Security since 2020. He is responsible for the strategic development and editorial management of all content formats – from website content and specialist publications to whitepapers, social media communication, and technical documentation. In this role, he combines solid expertise from IT journalism with in-depth technical understanding in the field of cybersecurity. As a long-time Linux enthusiast, he closely follows developments in the IT industry both professionally and personally.