In mid-June 2022, the German Federal Office for Information Security (BSI) published a draft guidance document on the implementation of Systems for Attack Detection (SzA). Until August 19, 2022, the public was invited to submit comments and proposed revisions.
The community draft further specifies the requirements introduced by Germany’s IT Security Act 2.0, which came into force in May 2021.
The legislation requires organizations to plan, implement, and operate effective attack detection systems covering three key areas:
The guidance outlines the minimum requirements for each of these areas.
Organizations operating Critical Infrastructure (KRITIS), energy facilities, and energy supply networks—as well as accredited auditing bodies—were required to implement appropriate organizational and technical security measures by May 1, 2023. Their information systems, components, and processes must ensure integrity, authenticity, and confidentiality. The effectiveness of deployed security measures is assessed using a multi-level maturity model.
Organizations must also demonstrate compliance with the legal requirements every two years through standardized compliance documentation, such as the reporting requirements under Section 8a (1a) BSIG and Section 11 (1d) EnWG.
To support implementation, the BSI recommends establishing an Information Security Management System (ISMS) certified in accordance with DIN EN ISO/IEC 27001, ideally with the support of experienced cybersecurity specialists.
The BSI defines the following minimum requirements for logging:
The BSI specifies the following minimum requirements:
The guidance requires organizations to meet all fundamental requirements for handling security incidents.
Attack detection systems should be capable of automatically initiating measures to prevent, contain, and eliminate attack-related disruptions without affecting the availability of critical services.
For operators of critical infrastructure, the BSI recommends the following three-step approach:
A proven implementation model combines:
Where appropriate, the SIEM environment can be enhanced with an Intrusion Prevention System (IPS) to provide automated threat prevention.
For more information and expert support, visit: https://www.secusys.de/it-sicherheit/
Contact: security-experts@oediv.de
Subscribe to our newsletter to receive regular insights into Identity & Access Management.
By subscribing, you agree to our Privacy Policy.
Learn how Privileged Access Management (PAM) protects privileged accounts, reduces cyber risk, and helps organizations securely manage sensitive…
read more →Learn how Zero Trust protects your organization against modern cyber threats and why Identity & Access Management plays…
read more →Cybersecurity trends for 2026 make one thing clear: more security tools do not automatically create better security. The…
read more →Let's assess together how resilient and future-ready your Identity & Access Management strategy really is.
