Reporting obligations in the event of a security incident

Security incidents must be reported

Security incidents entail a lot of work. Traditionally, of course, the first thing you think of is the entire process of cleaning up and eliminating the incident at a technical level. However, the entire incident response management process also includes non-technical aspects such as crisis management and the reporting obligation. We would like to take a closer look at the latter at this point.

The most important things at a glance

What needs to be reported?

• Significant IT incidents

• Personal data breaches

Who has to report?

• KRITIS operators

• Digital service providers

Who must be notified?

• Bundesamt für Sicherheit in der Informationstechnik (BSI)

• Federal Network Agency (BNetzA) for telecommunications companies

• Federal Commissioner

• Supervisory authority

When must the notification be made?

• Within 24-72 hours

How must the report be made?

• Through a registered contact point to the BSI

• reporting template

Mandatory reporting?

In fact, there are statutory reporting obligations from various bodies in the event of a security incident. And these can be quite confusing at first glance - who has to report when, what, where and how? Basically, the following applies: Exceptional incidents can always be reported voluntarily via the reporting centre of the Alliance for Cyber Security . This form of reporting serves as the basis for the Federal Office for Information Security (BSI) to issue warnings and for the overall statistical picture. A quick word of advice: as the stress level during a security incident is generally very high, you should be prepared for the relevant organisational duties.

IT Security Act

The IT Security Act (IT-SiG) is an article law which, in addition to the BSI Act (BSIG), also amends the Energy Industry Act, the Atomic Energy Act, the Telemedia Act, the Telecommunications Act and other laws. What remains unchanged here under the BSIG is that KRITIS operators must report significant IT disruptions to the BSI if these could have an impact on the availability of critical services.

Telecommunications companies must also report significant IT disruptions to the Federal Network Agency (BNetzA). In addition, they are obliged to warn their customers if they notice that the customer's connection is being misused for IT attacks.

The BSI is notified via a designated contact point. This contact point must be registered with the BSI beforehand. A contact point is a functional mailbox that can be reached 24/7 at any time.

Operators belonging to the same sector have the option of appointing a joint superordinate contact point (GÜAS). Information is then exchanged between the operator and the BSI via the common point of contact.

Content of the notification

The notification to the BSI should always contain the following information:

• Information on the incident

• Information on technical conditions

• Suspected or actual cause

• Information on the type of system affected

The template for the notification from the BSI. The company only needs to be named if the disruption has led to a failure or impairment.

Ordinary or extraordinary disruption

Not every disruption needs to be reported. The IT-SiG and the BSIG only provide for the reporting of exceptional or significant IT disruptions. How do you decide which disruption is significant and which is not?

Ordinary IT disruption

• Disk failure

• Hardware failure

• Spam

• Malware detected by antivirus

• Untargeted phishing

Significant IT malfunction

• Exceptional & unexpected IT-related technical defects

• new, previously undisclosed security vulnerabilities

• unknown malware

• Spear-Phishing

The following graphic describes as clearly as possible which reporting criteria apply and what to look out for in case of doubt:

After reporting to the BSI, the further flow of information is the responsibility of this central office. Companies and KRITIS operators are obliged to provide information for the rest of the process. The following graphic illustrates the further process following a report of a significant IT disruption.

NIS Directive, BDSG and GDPR

In addition to the reporting obligations under the BSIG and the IT Security Act, other laws apply in this context that must not be ignored:

NIS Directive

Other directives apply at EU level. At this point, it should be noted that it is always beneficial to comply with the GDPR, as this directive applies throughout Europe. The Law on the NIS Directive passed in 2017 is the law implementing the European directive to ensure a high level of network and information security. It supplements the IT-SiG to the effect that providers of digital services are also subject to reporting obligations in the event of significant IT disruptions. This includes operators of:

• Online marketplaces

• online search engines

• cloud computing services

In addition, according to European Data protection the reporting of data breaches of personal data of all business sectors to the respective national supervisory authorities within 24 hours is mandatory.

Here is the next important aspect: Personal data breaches!

Federal Data Protection Act (BSDG) and General Data Protection Regulation (GDPR)

In addition to the IT-SiG, the BSDG and the GDPR also apply. According to §65 and §66 of the BSDG, data controllers must report a personal data breach to the Federal Commissioner within 72 hours. The same applies according to Articles 33 and 34 of the GDPR. Here, the notification is made to the supervisory authority within the same time frame.

The notification should include the following:

• Description of the type of injury

• Information on the categories and categories of data concerned

• Information on the number of data subjects and data sets concerned

• Name and contact details of the data protection officer/contact point for information

• Description of the likely consequences

• Description of the handling measures taken

The reporting obligations for security incidents are extensive. If in doubt, it is better to report too much than too little. If there is uncertainty as to whether a report is necessary or really relevant, it can be made either voluntarily or anonymously. In principle, it is advisable to consult the legal situation of the GDPR and the IT Security Act and act accordingly. If you have any questions, the BSI or suresecure.