Security & resilience of the networks<\/h1><\/div>Given the advancing digitalization and the associated risks of cyberattacks, the technical protection of networks is gaining increasing importance. TThis is not only about the technical protection against attacks on network components and IT systems, but also about the physical protection of network infrastructures from threats both domestic and foreign, as well as from natural disasters or pandemics. A key objective is to both complicate potential attack opportunities and effectively respond to attacks, thereby strengthening the overall resilience of networks.<\/p>\n<\/div>
For this reason, BREKO established the Project Group on Cybersecurity, AI, and Data Protection in the spring of 2024, where we focus on current legal frameworks, resulting obligations, and implementation options.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
FAQ<\/h2><\/div><\/i><\/i><\/span>Which standards give rise to cyber security obligations for me as a telecommunications company?<\/span><\/a><\/h4><\/div>\nThe Telecommunications Act (TKG) and the subsequent regulations from the Federal Network Agency (BNetzA) already require telecommunications companies to meet extensive security and resilience standards for their networks.<\/p>\n
The implementation of the European NIS2 Directive will obligate a large number of telecommunications companies to meet additional cybersecurity requirements. In addition, operators of critical infrastructure will face further obligations in the future under the KRITIS framework law.<\/p>\n<\/div><\/div><\/div>
<\/i><\/i><\/span>How does BREKO assess the current implementation status of the Nis2 Directive?<\/span><\/a><\/h4><\/div>\nThe prompt implementation of the Nis2 directive at national level is of great importance due to the increased cyber security requirements. The Federal Office for Information Security (BSI) has comprehensively considered the existing obligations of the telecommunications sector under the TKG in its latest drafts of the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2-UmsuCG), <\/strong>which, however, was not passed by the previous government, thereby avoiding potential double regulation. However, extensive changes between the individual drafts would have made early and comprehensive preparation for the affected companies more difficult. Furthermore, Section 41 of the NIS2-UmsuCG, concerning the use of critical components, would have needed urgent revision, as the economic risk of losing the manufacturer’s trustworthiness should not be solely imposed on telecommunications companies.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>When should my company address the issue of network security?<\/span><\/a><\/h4><\/div>\nEvery company operating in the telecommunications sector should immediately address the security of its networks and review any obligations under the TKG regarding cybersecurity requirements. Companies should also carry out the BSI’s “NIS-2 impact assessment”<\/a>. Regardless of whether the company is directly affected, the possibility of obligation through a supply chain should also be examined.<\/p>\nIn any case, at least one person within the company should be designated as responsible for cybersecurity and should monitor key developments related to the implementation of the NIS2 Directive. Management and employees should receive regular cyber security training<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Documents<\/strong><\/h2><\/div><\/div> \n \n <\/i>\n <\/div>\n \n\t\t\t\n 1. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (111 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 2. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (301 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 3. Stellungnahme: Nis2-UmsuCG<\/span>\n <\/span>\n \n\t\t\t\tDownload (225 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n
Given the advancing digitalization and the associated risks of cyberattacks, the technical protection of networks is gaining increasing importance. TThis is not only about the technical protection against attacks on network components and IT systems, but also about the physical protection of network infrastructures from threats both domestic and foreign, as well as from natural disasters or pandemics. A key objective is to both complicate potential attack opportunities and effectively respond to attacks, thereby strengthening the overall resilience of networks.<\/p>\n<\/div>
For this reason, BREKO established the Project Group on Cybersecurity, AI, and Data Protection in the spring of 2024, where we focus on current legal frameworks, resulting obligations, and implementation options.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
FAQ<\/h2><\/div><\/i><\/i><\/span>Which standards give rise to cyber security obligations for me as a telecommunications company?<\/span><\/a><\/h4><\/div>\nThe Telecommunications Act (TKG) and the subsequent regulations from the Federal Network Agency (BNetzA) already require telecommunications companies to meet extensive security and resilience standards for their networks.<\/p>\n
The implementation of the European NIS2 Directive will obligate a large number of telecommunications companies to meet additional cybersecurity requirements. In addition, operators of critical infrastructure will face further obligations in the future under the KRITIS framework law.<\/p>\n<\/div><\/div><\/div>
<\/i><\/i><\/span>How does BREKO assess the current implementation status of the Nis2 Directive?<\/span><\/a><\/h4><\/div>\nThe prompt implementation of the Nis2 directive at national level is of great importance due to the increased cyber security requirements. The Federal Office for Information Security (BSI) has comprehensively considered the existing obligations of the telecommunications sector under the TKG in its latest drafts of the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2-UmsuCG), <\/strong>which, however, was not passed by the previous government, thereby avoiding potential double regulation. However, extensive changes between the individual drafts would have made early and comprehensive preparation for the affected companies more difficult. Furthermore, Section 41 of the NIS2-UmsuCG, concerning the use of critical components, would have needed urgent revision, as the economic risk of losing the manufacturer’s trustworthiness should not be solely imposed on telecommunications companies.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>When should my company address the issue of network security?<\/span><\/a><\/h4><\/div>\nEvery company operating in the telecommunications sector should immediately address the security of its networks and review any obligations under the TKG regarding cybersecurity requirements. Companies should also carry out the BSI’s “NIS-2 impact assessment”<\/a>. Regardless of whether the company is directly affected, the possibility of obligation through a supply chain should also be examined.<\/p>\nIn any case, at least one person within the company should be designated as responsible for cybersecurity and should monitor key developments related to the implementation of the NIS2 Directive. Management and employees should receive regular cyber security training<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Documents<\/strong><\/h2><\/div><\/div> \n \n <\/i>\n <\/div>\n \n\t\t\t\n 1. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (111 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 2. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (301 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 3. Stellungnahme: Nis2-UmsuCG<\/span>\n <\/span>\n \n\t\t\t\tDownload (225 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n
<\/i><\/i><\/span>Which standards give rise to cyber security obligations for me as a telecommunications company?<\/span><\/a><\/h4><\/div>\nThe Telecommunications Act (TKG) and the subsequent regulations from the Federal Network Agency (BNetzA) already require telecommunications companies to meet extensive security and resilience standards for their networks.<\/p>\n
The implementation of the European NIS2 Directive will obligate a large number of telecommunications companies to meet additional cybersecurity requirements. In addition, operators of critical infrastructure will face further obligations in the future under the KRITIS framework law.<\/p>\n<\/div><\/div><\/div>
<\/i><\/i><\/span>How does BREKO assess the current implementation status of the Nis2 Directive?<\/span><\/a><\/h4><\/div>\nThe prompt implementation of the Nis2 directive at national level is of great importance due to the increased cyber security requirements. The Federal Office for Information Security (BSI) has comprehensively considered the existing obligations of the telecommunications sector under the TKG in its latest drafts of the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2-UmsuCG), <\/strong>which, however, was not passed by the previous government, thereby avoiding potential double regulation. However, extensive changes between the individual drafts would have made early and comprehensive preparation for the affected companies more difficult. Furthermore, Section 41 of the NIS2-UmsuCG, concerning the use of critical components, would have needed urgent revision, as the economic risk of losing the manufacturer’s trustworthiness should not be solely imposed on telecommunications companies.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>When should my company address the issue of network security?<\/span><\/a><\/h4><\/div>\nEvery company operating in the telecommunications sector should immediately address the security of its networks and review any obligations under the TKG regarding cybersecurity requirements. Companies should also carry out the BSI’s “NIS-2 impact assessment”<\/a>. Regardless of whether the company is directly affected, the possibility of obligation through a supply chain should also be examined.<\/p>\nIn any case, at least one person within the company should be designated as responsible for cybersecurity and should monitor key developments related to the implementation of the NIS2 Directive. Management and employees should receive regular cyber security training<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Documents<\/strong><\/h2><\/div><\/div> \n \n <\/i>\n <\/div>\n \n\t\t\t\n 1. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (111 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 2. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (301 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 3. Stellungnahme: Nis2-UmsuCG<\/span>\n <\/span>\n \n\t\t\t\tDownload (225 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n
The Telecommunications Act (TKG) and the subsequent regulations from the Federal Network Agency (BNetzA) already require telecommunications companies to meet extensive security and resilience standards for their networks.<\/p>\n
The implementation of the European NIS2 Directive will obligate a large number of telecommunications companies to meet additional cybersecurity requirements. In addition, operators of critical infrastructure will face further obligations in the future under the KRITIS framework law.<\/p>\n<\/div><\/div><\/div>
<\/i><\/i><\/span>How does BREKO assess the current implementation status of the Nis2 Directive?<\/span><\/a><\/h4><\/div>\nThe prompt implementation of the Nis2 directive at national level is of great importance due to the increased cyber security requirements. The Federal Office for Information Security (BSI) has comprehensively considered the existing obligations of the telecommunications sector under the TKG in its latest drafts of the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2-UmsuCG), <\/strong>which, however, was not passed by the previous government, thereby avoiding potential double regulation. However, extensive changes between the individual drafts would have made early and comprehensive preparation for the affected companies more difficult. Furthermore, Section 41 of the NIS2-UmsuCG, concerning the use of critical components, would have needed urgent revision, as the economic risk of losing the manufacturer’s trustworthiness should not be solely imposed on telecommunications companies.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>When should my company address the issue of network security?<\/span><\/a><\/h4><\/div>\nEvery company operating in the telecommunications sector should immediately address the security of its networks and review any obligations under the TKG regarding cybersecurity requirements. Companies should also carry out the BSI’s “NIS-2 impact assessment”<\/a>. Regardless of whether the company is directly affected, the possibility of obligation through a supply chain should also be examined.<\/p>\nIn any case, at least one person within the company should be designated as responsible for cybersecurity and should monitor key developments related to the implementation of the NIS2 Directive. Management and employees should receive regular cyber security training<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Documents<\/strong><\/h2><\/div><\/div> \n \n <\/i>\n <\/div>\n \n\t\t\t\n 1. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (111 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 2. Stellungnahme: Nis2-UmsuCG <\/span>\n <\/span>\n \n\t\t\t\tDownload (301 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n \n \n <\/i>\n <\/div>\n \n\t\t\t\n 3. Stellungnahme: Nis2-UmsuCG<\/span>\n <\/span>\n \n\t\t\t\tDownload (225 KB) <\/span><\/span> <\/i><\/span>\n <\/a>\n <\/div>\n <\/div>\n
The prompt implementation of the Nis2 directive at national level is of great importance due to the increased cyber security requirements. The Federal Office for Information Security (BSI) has comprehensively considered the existing obligations of the telecommunications sector under the TKG in its latest drafts of the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2-UmsuCG), <\/strong>which, however, was not passed by the previous government, thereby avoiding potential double regulation. However, extensive changes between the individual drafts would have made early and comprehensive preparation for the affected companies more difficult. Furthermore, Section 41 of the NIS2-UmsuCG, concerning the use of critical components, would have needed urgent revision, as the economic risk of losing the manufacturer’s trustworthiness should not be solely imposed on telecommunications companies.<\/p>\n<\/div><\/div><\/div> Every company operating in the telecommunications sector should immediately address the security of its networks and review any obligations under the TKG regarding cybersecurity requirements. Companies should also carry out the BSI’s “NIS-2 impact assessment”<\/a>. Regardless of whether the company is directly affected, the possibility of obligation through a supply chain should also be examined.<\/p>\n In any case, at least one person within the company should be designated as responsible for cybersecurity and should monitor key developments related to the implementation of the NIS2 Directive. Management and employees should receive regular cyber security training<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/i><\/i><\/span>When should my company address the issue of network security?<\/span><\/a><\/h4><\/div>
Documents<\/strong><\/h2><\/div>
![\"\"](\"https:\/\/brekoverband.de\/wp-content\/uploads\/2025\/01\/lisa_1.jpg\")
<\/span><\/div>\n ![\"\"](\"https:\/\/brekoverband.de\/wp-content\/uploads\/2025\/01\/henning-hattendorf-brekofs23-benedikt.jpg\")
<\/span><\/div>\n