NIS 2 Implementation And Cybersecurity Strengthening Act: Germany Tightens IT Security Requirements

At the end of 2022, the EU has adopted important regulations to protect network and information security in so-called "critical sectors" with the "NIS2" directive. Thus, the protection of certain facilities and services against cyber threats is to be strengthened. In Germany, the directive is implemented by the NIS 2 Implementation and Cybersecurity Strengthening Act (German). In doing so, the draft law goes beyond the EU requirements and thus brings about numerous innovations in national cyber security law.

The draft NIS 2 Implementation and Cybersecurity Strengthening Act is to be adopted by mid-2024. The obligations it entails are to apply from 1 October 2024.

Scope

Significantly more companies than before will be included in the IT security regime through the core piece of the draft NIS 2 Implementation and Cybersecurity Strengthening Act - the amendment of the BSI Act. A distinction is made between "important" and "particularly important facilities" as