Berlin, 7 February 2022 – In light of the ongoing negotiations on the NIS2 Directive, the European counterpart to the German IT Security Act 2.0, Susanne Dehmel, Member of the Bitkom Executive Board, states:
"Negotiations are currently underway in Brussels for the new, more harmonised European regulatory framework for cyber security. Given growing threats in cyberspace we expressly welcome the new legislation. Especially the protection of our critical infrastructures, makes future-proof regulations essential for the European economy and society.
The compromise reached for the new directive is worthy of support and promises a holistic strengthening of cyber resilience in the EU. However, the ambitious goals, to an extent, lose sight of the actual feasibility in practice. Bitkom therefore sees a need for improvement in the current trialogue process - so that the subsequent national implementation of the directive via an IT Security Act 3.0 can succeed in achieving its goals in practice.
The envisaged extension of the scope of application to smaller companies in the main critical sectors (energy, water, food, health, transport, finance, digital infrastructure) as well as to additional sectors such as waste management, space and parts of the manufacturing industry is understandable and to be welcomed in principle. However, this must be applied in a more proportional way. The currently envisaged size-cap rule, according to which companies fall within the scope of application according to their size and less according to the criticality of the service they provide, runs counter to the previous understanding of critical infrastructures in Germany and will pose challenges to the German economy, which is characterised by small and medium-sized enterprises.
The lack of skilled personnel remains the key bottleneck for cyber security. There is a need for expert staff who have the time and knowledge to implement security-enhancing measures on site. An additional bureaucratic structure with reporting obligations of only 24 hours is hardly conducive to this.
