On June 12, 2015, the German Parliament (Deutscher
Bundestag) passed an Act to Improve the Security of Information
Technology Systems ("IT-Security Act").
The new legislation requires operators of so-called critical
infrastructure to meet minimum standards for IT security and to
report significant IT security incidents to the Federal Office for
Information Security ("BSI").
This is an important development for both German and non-German
entities that provide critical infrastructure products and service
in Germany (the law applies to both), and because it imposes a
reporting obligation on such companies in the event of a security
incident.
Background
The objective of the IT-Security Act is to improve the
security of information and IT-systems in Germany by increasing the
level of protection regarding the availability, integrity,
confidentiality and authenticity of IT-infrastructure. In
particular, providers of critical infrastructure (as
defined below) will be
