The most important thing in brief:
- Expanded scope for KRITIS companies: The IT Security Act 3.0 expands the term critical infrastructure (KRITIS) so that more companies, such as larger food manufacturers or transport companies, now fall under this category if their failure would have a significant impact on public supply.
- Stricter reporting requirements and higher fines: Companies are required to report IT security incidents in more detail and more quickly; violations now face fines amounting to millions of euros, which represents a significant tightening compared to previous regulations.
- Expanded powers of the BSI: The IT Security Act 3.0 gives the Federal Office for Information Security (BSI) extended powers, including the right to carry out unannounced security checks on companies to ensure compliance with security standards.
In today's world, when digitization and connectivity play a dominant role in almost all areas of life and economy, the need to protect these digital structures is growing in parallel. Cyber threats have not only increased in recent years, but have also increased in their complexity and potential for damage. This is where the German IT Security Act comes in.
The origins of the IT Security Act date back to 2015, when the IT Security Act 1.0 was passed. This was a decisive step towards creating a basis for protecting critical infrastructures and introducing the obligation to report serious IT security incidents. As a result of rapidly changing technological developments and growing threats, the IT Security Act 2.0 was introduced, which already provided for stricter requirements and more extensive regulations.
Now, with the IT Security Act 3.0, Germany is faced with another, advanced set of rules. The law represents Germany's efforts to protect its digital infrastructure even more intensively and to be prepared for current and future cyber threats. It is a testament to the recognition that in an increasingly interconnected world, proactive measures and legislation are essential to ensure security and stability.
Comparison: IT Security Act 2.0 vs. 3.0
The IT-Sig 3.0 builds on its predecessor, the IT-Sig 2.0, and makes several significant changes and additions:
- Critical infrastructures (KRITIS): Under IT-sig 3.0, more companies fall under the term KRITIS. For example, in addition to energy suppliers, larger food manufacturers or transport companies could now be regarded as KRITIS if an outage would have far-reaching effects on public supply.
- Fines: For example, a company that repeatedly violates reporting requirements could now face a fine of up to several million euros, in contrast to previous, much lower penalties.
- Reporting requirements: An energy provider that detects a hacker attack must now report this incident in more detail and more quickly. This could mean that, in addition to the type of attack, the presumed origin and extent of damage must also be stated.
- BSI powers: Under IT-Sig 3.0, for example, the BSI could have the right to carry out unannounced security checks on companies to ensure their compliance.
- Certifications: A software company that offers a cloud solution for KRITIS companies may need to have this solution certified according to new, stricter standards.
Docusnap and the implementation of IT-Sig 3.0
Docusnap is the leading software for IT documentation. It can help companies to implement and prove the requirements of IT-SiG 3.0 in practice:
- Automatic inventory: Docusnap offers automatic recording of all IT components, which is essential for identifying and securing critical systems. This allows you to identify and address weak points more quickly.
- Safety analyses: Through detailed analyses, companies can identify security risks at an early stage. Docusnap provides recommendations to minimize these risks.
- Reporting features: Docusnap's reports are comprehensive and offer the opportunity to demonstrate compliance with IT-Sig 3.0 to regulatory authorities in detail.
- license management: Monitoring and managing software licenses is not only cost-effective, but also ensures that all programs used are legal and up-to-date, reducing security risks.
- Planning and emergency preparedness: The software makes it possible to develop and regularly review emergency plans. This allows companies to ensure that they can respond effectively in the event of a security incident.
With Docusnap, companies are therefore ideally equipped to meet the increased requirements of IT-Sig 3.0 and at the same time optimally manage and protect their IT infrastructure.
