Critical infrastructure (KRITIS) · § 30 BSIG
Firmware evidence for § 30 BSIG across your device fleet
Since 6 December 2025, § 30 BSIG (Germany's NIS2 implementation) requires important and particularly important entities to manage risk, explicitly including the supply chain and the vulnerability management of the components they use. LegacyMind reads the firmware of your devices and delivers, per device, the evidence on § 30(2) nos. 4, 5 and 8 that your proof builds on.
As of 20 October 2026 · BSI Act as amended by Germany's NIS2 Implementation Act (NIS2UmsuCG)
Per device
What the analysis delivers for each device
From the firmware, without an agent on the device and without access to your facility.
Components
Name and version of every component found, exportable as an SBOM.Vulnerabilities
Per component, with the CVE ID and a note on whether it is actively exploited. What is exploited comes first.Credentials and hardening
Accounts with weak passwords, keys and certificates in the image, missing protection mechanisms per binary.§ 30 BSIG
For each number, a finding with its basis, or a note that it is an action of the entity itself.
§ 30(2) BSIG
Three numbers the firmware has something to say about
Of the ten minimum measures, three concern directly what is inside your devices. The other seven are the entity's policies, processes and training, which an image cannot determine.
No. 4
Supply chain security
Security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers.No. 5
Security in acquisition, development and maintenance, including vulnerability management
Security measures in the acquisition, development and maintenance of IT systems, components and processes, including vulnerability management and disclosure.No. 8
Use of cryptography
Policies and procedures for the use of cryptography.
Proof and reporting
What the BSIG requires of you
Who falls under the act, how often you have to prove it and how fast you have to report. With references.
Important
Important entity: a type of entity from Annex 1 or 2, with 50 or more employees or with annual turnover and annual balance sheet total each above EUR 10 million (§ 28(2)).Particularly important
Particularly important entity: a type of entity from Annex 1, with 250 or more employees or with annual turnover above EUR 50 million and annual balance sheet total above EUR 43 million; operators of critical facilities regardless of size (§ 28(1)).Proof
Operators of critical facilities prove their implementation to the BSI every three years through security audits, inspections or certifications, including the security shortcomings uncovered (§ 39(1)).Management
Management must implement the measures, monitor their implementation and take part in training regularly (§ 38).
Reporting, § 32(1) BSIG
Three deadlines once you know of a significant security incident
- 24hours
- Early first report of a significant security incident (§ 32(1) no. 1)
- 72hours
- Notification with an initial assessment, its severity and impact (no. 2)
- 1month
- Final report after the notification (no. 4)
BSI Act as amended by Germany's NIS2 Implementation Act (NIS2UmsuCG), § 32(1). Checked on 20 October 2026.
One update, two versions
What changes with an update
Two shipped versions of the same controller, both analysed from the image. The update brings new components, and each of them belongs in the SBOM.
+33 more components in the SBOM
Questions from operators
What operators want to know first
Does the report replace the proof we owe under § 39 BSIG?
No. It supplies the technical evidence on the devices. The entity provides its proof through audits, inspections or certifications, and the organisational numbers of § 30 remain its own actions.
Are we an important or a particularly important entity?
§ 28 BSIG decides by type of entity (Annex 1 or 2) and size: important with 50 or more employees or with turnover and balance sheet total each above EUR 10 million, particularly important (essential, in NIS2 terms) with 250 or more employees or above EUR 50 million turnover and EUR 43 million balance sheet total. Operators of critical facilities are always particularly important.
How do we get the firmware of our devices?
From the manufacturer's download area, where there is one. For devices on the network, the Firmware Extractor reads the firmware over SSH; it is in closed beta.
Do you need access to our facility?
No. The analysis runs on the firmware file, without an agent on the device and without a connection into your network.
What happens when a new vulnerability becomes known?
New vulnerabilities and new entries in the catalogues of actively exploited vulnerabilities are matched to the firmware versions already analysed: the catalogues every two hours, new CVEs daily.
Which reporting deadlines apply to us?
For a significant security incident: an early first report within 24 hours, a notification within 72 hours and a final report one month after that (§ 32(1) BSIG).
Start with one device
In the free CRA readiness check we analyse the firmware of one of your devices. You get the report and SBOM within three working days.