Cyber Risk Management – Obligatory For Every Corporate Management

With the extension of the German Act on the Federal Office for Information Security [Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, BSI-Gesetz] ("BSI Act"), the federal legislator is reacting to increased duties of managers of critical infrastructure and is implementing the NIS-2 Directive¹ with its draft.

In the course of constantly advancing digitisation, more and more companies are dependent on (networked) IT systems. This means that IT security is becoming increasingly important for companies. At the same time, the threat to IT systems from cyber criminals is on the rise, as can be seen from several sensational cases from the business world. Most recently, for example, the civilian division of the armaments group and automotive supplier Rheinmetall was the victim of a hacker attack in April 2023, when its systems were shut down entirely.²