CSIRT (BSI)
Computer Security Incident Response Team
TL;DR
The CSIRT is the national point of contact for cyber security incidents. Under Art. 11 NIS2 and § 32 BSIG, the BSI is the German CSIRT — it receives notifications, coordinates the response and warns other entities.
What is the CSIRT (BSI)?
Tasks of the BSI CSIRT:
- Receiving incident notifications (24/7)
- Early warning to other entities
- Incident coordination nationally and at EU level
- Forensic support on request
- Threat intelligence sharing
Notifications to: bsi.bund.de/meldungen or by telephone on 0800-274-1000.
The national CSIRT in Germany and Austria
The NIS2 Directive (Directive (EU) 2022/2555) requires each Member State to designate or establish competent authorities and a single point of contact (Art. 8 NIS2 Directive) as well as one or more CSIRTs (Art. 10(1) NIS2 Directive). Germany and Austria implement the CSIRT function through separate national laws and authorities. The three-stage notification deadlines (24 hours / 72 hours / 1 month) are identical in both countries, however, because they follow directly from Art. 23 of the NIS2 Directive.
Germany
- Competent authority / CSIRT: The Federal Office for Information Security (BSI) is the central body for information security at national level (§ 1 BSIG) and performs tasks in the Cooperation Group and in the CSIRTs network under Articles 14 and 15 of the NIS2 Directive (§ 3(1) no. 3 BSIG).
- Notification of significant security incidents: to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — early warning within 24 hours, notification with an initial assessment within 72 hours, and a final report no later than one month after the 72-hour notification (§ 32(1) BSIG).
Austria
- Competent authority: the Federal Office for Cybersecurity (Cybersecurity Authority (Cybersicherheitsbehörde, Austria)), an authority directly subordinate to the Federal Minister of the Interior and based in Vienna (§ 3a NISG 2026, BGBl. I Nr. 94/2025).
- Notification of significant security incidents: to the competent sector-specific or national CSIRT, which forwards the notification to the Cybersecurity Authority — early warning within 24 hours, notification with an initial assessment within 72 hours, and a final report no later than one month after the 72-hour notification (§ 34(2) NISG 2026).
Practical example
A ransomware incident: the initial notification within 24 hours is made through the BSI portal. The CSIRT offers advice by telephone. For critical infrastructure, on-site support is possible.