Section 30 BSIG

10 areas of mandatory measures for NIS2 risk management

26 April 2026 · Category: NIS2 · Compliance-Kit

TL;DR

Section 30 BSIG (German BSI Act (BSIG) – Act on the Federal Office for Information Security, in force since 6 December 2025 by virtue of the NIS2UmsuCG) requires particularly important and important entities to take appropriate, proportionate and effective technical and organisational measures to prevent disruptions to the availability, integrity and confidentiality of their IT systems and to keep the impact of security incidents low — covering at least 10 expressly named areas of mandatory measures. Compliance must be documented: what has to be recorded is not only which measures are planned, but that they are actually complied with.

What is Section 30 BSIG?

The 10 areas of mandatory measures under § 30(2) BSIG:

Policies on risk analysis and assessment and on information system security
Incident handling
Business continuity (backup, disaster recovery, crisis management)
Supply chain security
Security in the acquisition, development and maintenance of network and information systems
Policies to assess the effectiveness of the measures
Cyber hygiene and cybersecurity training
Policies on cryptography and encryption
Personnel security, access control policies
MFA, continuous authentication, secured voice, video and text communications

Section 30 BSIG in Germany and Austria

NIS2 is implemented in Germany and Austria in separate national acts. The risk-management obligations are each based on Art. 21 of the NIS2 Directive (Directive (EU) 2022/2555), but are governed with their own numbering of provisions and their own supervisory authority.

Germany

The relevant provision is § 30 BSIG (Act on the Federal Office for Information Security – BSI Act). Particularly important entities and important entities must take appropriate, proportionate and effective technical and organisational measures (§ 30(1)); the minimum catalogue comprises the ten areas under § 30(2) nos. 1 to 10. Supervision: Federal Office for Information Security (BSI).

Austria

The counterpart is § 32 NISG 2026 (Austrian Network and Information Systems Security Act 2026, BGBl. I Nr. 94/2025). Essential and important entities must implement appropriate and proportionate risk-management measures in technical, operational and organisational terms (§ 32(1)); the minimum catalogue is set out in § 32(4)(a) to (j). Supervision: Cybersecurity Authority (Cybersicherheitsbehörde, Austria).

Practical example

A mechanical engineering company (350 employees, an 'important entity' under § 28 BSIG) implements § 30 as follows:

Area 1: ISMS policy plus risk analysis methodology in line with ISO 27005 (annual review)
Area 2: incident response policy plus 24h/72h/30d reporting templates
Area 3: BCP, backup, DR plan, crisis management
Area 4: supplier questionnaire plus cybersecurity contractual clauses
Area 7: annual cyber hygiene training, quarterly phishing simulation
Area 10: MFA for all admin access, secure communication via S/MIME

Frequently asked questions

Is ISO 27001 sufficient as evidence?

ISO 27001 covers the ten areas of § 30 BSIG structurally, but none of them congruently. According to the BSI, a certification can make it easier to provide evidence, but it has to be checked against the statutory catalogue of measures and supplemented where necessary. Additions are required for: NIS2 reporting obligations (24 h / 72 h / 1 month), supply chain clauses, sector-specific BSI requirements. Mapping workbooks help.

What is the difference from § 8a BSIG (old, KRITIS)?

§ 30 is broader and, according to the BSI, applies to around 29,500 entities; previously, about 4,500 organisations were regulated by the BSI Act. The catalogue of obligations is derived from Art. 21 of the NIS2 Directive, with additional German specification.

Who checks compliance?

The BSI as the central supervisory authority. Checks: prompted by a specific occasion, without a specific occasion, and in connection with incident reports. The obligation to provide evidence lies with the company concerned.