What does section 30 BSIG require?
Essential and important entities must take appropriate, proportionate and effective technical and organisational measures to prevent disruption to the availability, integrity and confidentiality of the IT systems, components and processes they use to provide their services, and to keep the impact of security incidents low (subsection 1 sentence 1).
Proportionality depends on risk exposure, the size of the entity, the cost of implementation, the likelihood and severity of incidents and their societal and economic impact (sentence 2). The measures should follow the state of the art and take account of relevant European and international standards; they must rest on an all-hazards approach (subsection 2 sentence 1). Compliance must be documented (subsection 1 sentence 3).
Who does section 30 BSIG apply to?
Essential and important entities under section 28. Whether a company is one depends on its type of entity in Annex 1 or 2 and on its size; the thresholds are in the table. Partner and linked enterprises usually count under Commission Recommendation 2003/361/EC (section 28(4)).
Not covered: telecom providers, energy network and plant operators under sections 5c to 5e EnWG (section 28(5)) and financial entities under DORA (section 28(6)), unless they carry out further activities from Annex 1 or 2.
For device manufacturers, Annex 2 no. 5, manufacturing, applies. With at least 50 employees or more than 10 million euros in annual turnover and balance sheet, a manufacturer in these branches is an important entity:
- NACE C 26
- Computer, electronic and optical products
- NACE C 27
- Electrical equipment
- NACE C 28
- Machinery
- NACE C 29
- Motor vehicles and parts
| Entity | Who is in (section 28) |
|---|---|
| Essential | Operators of critical facilities; qualified trust service providers, TLD registries and DNS service providers regardless of size; telecom providers with at least 50 employees or more than 10 million euros turnover and balance sheet; Annex 1 entities with at least 250 employees, or more than 50 million euros turnover and more than 43 million euros balance sheet. |
| Important | Annex 1 and 2 entities with at least 50 employees or more than 10 million euros turnover and balance sheet, unless essential; plus trust service providers and smaller telecom providers. |
Which measures does section 30(2) BSIG list?
Subsection 2 sentence 2 lists what the measures must include at least. The list stays close to the wording.
- 1
Risk analysis
Policies on risk analysis and information security.
- 2
Incidents
Incident handling.
- 3
Business continuity
Backup management, disaster recovery and crisis management.
- 4
Supply chain
Supply chain security, including security aspects of the relationships with direct suppliers and service providers.
- 5
Acquisition, development, maintenance
Security in the acquisition, development and maintenance of IT systems, components and processes, including vulnerability handling and disclosure.
- 6
Effectiveness
Policies and procedures to assess the effectiveness of risk management measures.
- 7
Training
Basic training and awareness in information security.
- 8
Cryptography
Policies and processes for the use of cryptography.
- 9
Personnel and access
Personnel security, access control and asset management for ICT systems, products and processes.
- 10
Authentication and communication
Multi-factor or continuous authentication, secured voice, video and text communication and, where needed, secured emergency communication.
Do more detailed rules apply to IT service providers?
For DNS service providers, cloud and data centre providers, managed service providers, managed security service providers and some other digital providers, Commission Implementing Regulation (EU) 2024/2690 takes precedence (section 30(3)). It sets out the technical and methodological requirements for the ten measures for these types of entity in more detail.
Is management liable under section 38 BSIG?
Management must implement the measures under section 30 and supervise their implementation (section 38(1)). If it culpably breaches this duty, it is liable to the entity under the company law rules of its legal form (subsection 2). It must also attend training regularly so it can assess IT security risks and risk management (subsection 3).
What fines apply to breaches of section 30?
It is an administrative offence not to take a measure under section 30(1) sentence 1, or to take it incorrectly, incompletely or late, or not to document compliance, or to document it incorrectly or incompletely (section 65(2) no. 2 and 3).
| Entity | Fine up to |
|---|---|
| Essential | 10 million euros (section 65(5) no. 1(a)) |
| Essential, total turnover above 500 million euros | 2 % of worldwide total turnover (section 65(6)) |
| Important | 7 million euros (section 65(5) no. 1(b)) |
| Important, total turnover above 500 million euros | 1.4 % of worldwide total turnover (section 65(7)) |
Do I have to register and provide evidence?
Essential and important entities must register no later than three months after they first or again qualify, through the registration facility of the BSI and the BBK (section 33(1)). Entities that qualified on 6 December 2025 had until 6 March 2026.
Section 39 requires evidence towards the BSI only from operators of critical facilities: through security audits, inspections or certifications, first at a date the BSI sets and then every three years. Every entity must document compliance (section 30(1) sentence 3). The BSI can request evidence from other essential entities no earlier than three years after the law entered into force (section 61(3)).
What does firmware have to do with section 30 BSIG?
In many entities, controllers, gateways, routers and sensors are among the systems they provide their services with. Three of the ten measures therefore reach their firmware: no. 4 the supply chain, which includes what the supplier built into the device; no. 5 acquisition and maintenance including vulnerability handling, which includes which known vulnerabilities the built-in components have; no. 8 the use of cryptography in the device.
LegacyMind maps the findings from a firmware image to these numbers: for no. 5 and no. 8 the report makes a statement, for no. 4 it reads the bill of materials from the image. The other numbers are measures of the entity that no file contains.
What is the difference between section 30 BSIG and the CRA?
Section 30 BSIG obliges an entity to secure its own operations. The Cyber Resilience Act obliges the manufacturer of a product to develop it securely and handle its vulnerabilities over the support period. A manufacturer from Annex 2 can carry both: the CRA for its products, section 30 BSIG for its own IT and production.
Questions
Does section 30 BSIG apply to my company?
If your type of entity is listed in Annex 1 or 2 of the BSIG and you have at least 50 employees or more than 10 million euros in turnover and balance sheet, as a rule yes. For manufacturers, Annex 2 no. 5 is the first place to look.
Does section 30 BSIG require an SBOM?
The law does not name an SBOM. No. 4 (supply chain) and no. 5 (vulnerability handling in acquisition and maintenance) do assume that you know which components are in your systems. An SBOM of the devices you run is the direct way there.
Who checks compliance?
The BSI. Operators of critical facilities provide evidence every three years through audits, inspections or certifications (section 39). The BSI can order audits by independent bodies for individual essential entities (section 61(1)). For important entities it checks when facts suggest they do not implement section 30 correctly (section 62).