Section 30 BSIG: ten mandatory areas and how to evidence them

For an overview of all NIS2 obligations, see NIS2 requirements; for the order in which to proceed, see the NIS2 implementation plan.

Short answer: who does Section 30 BSIG apply to, and what does it require?

Section 30 BSIG applies to essential and important entities. Whether your organisation is one of them, you clarify with the NIS2 applicability check. Under Section 28(5) and (6), Section 30 does not apply to some entities, for example telecoms providers (telecoms providers under NIS2 and the TKG), certain energy companies and financial entities under DORA; the applicability check explains these exemptions and their limits.

It requires three things:

• Take measures that are appropriate, proportionate and effective to avoid disruption to the availability, integrity and confidentiality of your IT and to keep the impact of security incidents low (subsection 1 sentence 1).
• Cover ten areas: “The measures must at least include the following”, says subsection 2 sentence 2 (our translation), followed by points 1 to 10. The measures should comply with the state of the art, take relevant standards into account and must be based on an all-hazards approach (subsection 2 sentence 1).
• Document compliance (subsection 1 sentence 3). Missing measures and missing documentation are each separate administrative offences under Section 65 BSIG.

The obligation has applied since the BSIG entered into force on 6 December 2025 through the NIS2 implementation act, without a general transition period and regardless of whether you have registered yet.

The act measures how much effort is appropriate by the entity’s risk exposure, its size, the cost of implementation and the likelihood, severity and impact of security incidents (subsection 1 sentence 2). For a company with 60 employees, a different level of measures may therefore be appropriate than for a large group. It should, however, be able to explain why its measures fit its risk.

The ten areas with suitable evidence examples

The table separates three levels. Only the wording of Section 30(2) sentence 2 BSIG is a legal obligation; the English text in the table is our translation of the German statute. Section 30 does not prescribe which documents prove implementation. The suitable evidence examples are our professional recommendation; where the BSI, the Federal Office for Information Security, recommends something, this is stated. The Blackfort example shows how a fictitious machinery manufacturer with 180 employees has evidenced each area.

Points 1 to 10 correspond, in the same order, to points (a) to (j) of Article 21(2) of the NIS2 Directive (EU) 2022/2555. The German wording differs in places: point 7 speaks of training and awareness, while the Directive also mentions cyber hygiene; point 9 requires “drawing up concepts”. For your documentation, the BSIG wording is what counts.

Section 30 BSIG checklist in Excel

The checklist maps the ten areas and the documentation duty onto a table. For each area you enter the person responsible, status, evidence and the date of the latest evidence. A second sheet shows the same table filled in for the fictitious example company.

Version 1.1 of 6 November 2026, legal status: BSIG as amended on 22 October 2026. Download: German-language checklist (Excel). The file is in German; its sheets and columns are explained in English below.

You may use and adapt this template within your own organisation. Publication or resale is not permitted.

Contents of the file:

• Deckblatt (cover sheet): version, date, legal status, instructions in five steps, a note that the checklist is not legal advice, terms of use.
• Checkliste (checklist): columns for number, area, short wording, status (drop-down: offen = open, in Arbeit = in progress, umgesetzt = implemented, geprüft (wirksam) = verified (effective)), person responsible, evidence, location, date.
• Beispiel (example): completed version, marked as fictitious.

Preview of the “Beispiel” sheet (extract, fictitious company, translated):

How to use the checklist: First enter a responsible person for each area. Then list the existing documents for each area with title, version and storage location. Where nothing exists, the status stays “open”. Present the list to the management body at least quarterly: under Section 38(1) BSIG it must oversee implementation, and the updated list shows that it does. More on this on the page on management duties.

The checklist is a working aid. It does not replace a risk analysis, and a fully completed list does not by itself prove that the measures are appropriate and effective.

Example: a machinery manufacturer works through the ten areas

Fictitious example, not a client. A machinery manufacturer with 180 employees, its own production IT, an ERP system and an IT department of three people is classified as an important entity (Annex 2, machinery). In autumn 2026, the managing director has the checklist used to check what exists for each area.

Result: three areas are evidenced (1, 7, 10), five are in progress (2, 3, 5, 9 and documentation), three are open (4, 6, 8). IT had implemented a lot but written little down. The managing director decides to add the open areas, with owners and dates, to the implementation plan, starting with the supply chain because contracts with long terms are affected there.

Typical gaps under Section 30 BSIG

Who is subject to different rules?

Digital entity types: For eleven digital entity types, such as cloud providers, data centres and managed service providers, Implementing Regulation (EU) 2024/2690 takes precedence (Section 30(3)); the sector directory lists them. Its annex sets out the ten areas in 13 chapters and in much more detail, for example an at least annual review of the security policy by the management bodies. An entity that does not apply a requirement which applies there “where appropriate” must document its reasons in a comprehensible way.

Operators of critical facilities: For them, measures beyond the protection level of essential entities are also considered proportionate, and they must use attack detection systems (Section 31 BSIG). They provide evidence every three years under Section 39 BSIG.

All other entities only provide evidence of implementation if the BSI orders it. The documentation should nevertheless be available at all times, because Section 30 requires it regardless of any audit.

Does Section 30 prescribe a standard?

No. The risk analysis method is your choice, and according to the BSI, its IT-Grundschutz methodology is not mandatory for everyone. According to the BSI, a comprehensively implemented ISO 27001 regularly covers a large part of the measures under Section 30, yet it does not automatically fulfil all obligations: registration, reporting deadlines, management responsibility and management training are not part of the standard. How IT-Grundschutz and NIS2 fit together is explained at Grundschutz-Readiness: NIS2 and IT-Grundschutz (in German).

There is no “NIS2 certification”. Certificates under ISO 27001 or IT-Grundschutz can make evidence easier, but they have to be checked against the ten areas and supplemented where necessary.

This page provides general information and is not legal advice. Whether and to what extent Section 30 BSIG applies to your entity has to be assessed in the individual case.