Cyber risks have now become one of the central management issues in companies. They affect not only companies with a pronounced IT focus or operators of large data infrastructures, but also medium-sized and smaller companies that use digital services, networked systems or external IT services. Advancing digitalization, the use of artificial intelligence and geopolitical tensions are increasing both the opportunities for attacks and the requirements placed on protection and response structures.
For management boards and managing directors, this brings to the fore the question of which duties apply to them when organizing cybersecurity. In addition to the general organizational and duty-of-care obligations under company law, sector-specific statutory requirements are particularly relevant, above all the BSIG (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik, German Act on the Federal Office for Information Security) as amended by the implementation of NIS-2, DORA for the financial sector and the NIS-2 Implementing Regulation for certain digital services.
Cyber risks as a management responsibility of corporate leadership
Economic significance of cyberattacks
Surveys from 2025 show that a substantial proportion of German companies perceive cyberattacks as an existential threat. According to a Bitkom survey, 59 percent of companies considered their existence threatened by cyberattacks. In previous years, the figures were 65 percent in 2024, 52 percent in 2023 and 9 percent in 2021.
At the same time, only about half of the companies surveyed assumed that they were well prepared for cyberattacks. A large majority expected attacks to increase over the next twelve months. A global PWC study also classified cyber risks in 2025 as a particularly high-priority risk for corporate management bodies.
The losses quantified in studies are very substantial. The explanatory memorandum to the NIS-2 Implementation Act refers to losses of EUR 202.7 billion in 2022, EUR 205.9 billion in 2023 and EUR 266.6 billion in 2024. It should be noted that the underlying Bitkom study covers analogue and digital attacks such as data theft, industrial espionage and sabotage together.
According to the study, around 70 percent of the loss amount of EUR 289.2 billion stated for 2025 was attributable to cyberattacks in the narrower sense. Ransomware, distributed denial-of-service attacks, malware, phishing and password attacks were among the types of attack identified as particularly damaging. The significance of individual attack patterns changes comparatively quickly.
Cyber resilience and market standard
Companies are responding to this development with various measures to increase their cyber resilience. In particular, the use of artificial intelligence, cloud security, threat management, data protection measures, network security, endpoint security, identity and access management, and supply chain and third-party risk management are cited.
Such surveys may acquire indirect legal significance because they can provide indications of the current market standard. For management bodies, this may become relevant when assessing whether the organization of cybersecurity in the specific company was still defensible. At the same time, the share of IT security budgets in the overall IT budget is increasing significantly.
Legislative response to growing cyber threats
NIS-2 implementation and entry into force
A significant part of the requirements for corporate cybersecurity is based directly or indirectly on EU law. The NIS-2 Directive builds on the previous NIS Directive and aims to achieve a high common level of cybersecurity across the European Union. The German draft legislation was known as the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS-2 Implementation and Cybersecurity Strengthening Act).
The Bundestag (German Federal Parliament) adopted the NIS-2 Implementation Act on 13 November 2025. The Act was promulgated in the Bundesgesetzblatt (Federal Law Gazette) on 5 December 2025 and entered into force on 6 December 2025. No transitional periods were provided, meaning that the obligations generally applied immediately upon entry into force.
The Bundesamt für Sicherheit in der Informationstechnik (BSI, Federal Office for Information Security) is accompanying implementation as the competent authority. Following the reform, the BSI supervises around 29,500 entities; previously, the figure was approximately 4,500. The explanatory memorandum to the Act assumed approximately 8,250 particularly important entities and around 21,600 important entities in the economy.
DORA, NIS-2 Implementing Regulation and further regulatory frameworks
In addition to the BSIG, special requirements exist for individual sectors. The Digital Operational Resilience Act for the financial sector, DORA (Digital Operational Resilience Act), has applied to credit and financial institutions since 17 January 2025. For certain digital services with a particular cross-border connection, the NIS-2 Implementing Regulation specifies technical and methodological requirements.
There are also sector-specific rules, for example in telecommunications law and energy industry law. § 165 TKG (Telekommunikationsgesetz, German Telecommunications Act) contains requirements for technical and organizational protective measures, including systems for attack detection. Comparable special obligations exist for energy supply undertakings under the EnWG (Energiewirtschaftsgesetz, German Energy Industry Act).
In addition, the KRITIS-Dachgesetz (German Critical Infrastructure Umbrella Act) of 11 March 2026 entered into force; it had already been amended by the Act of 21 July 2026. It implements the EU CER Directive and creates cross-sector minimum requirements for the physical protection of critical facilities. Politically, the NIS-2 implementation, the KRITIS-Dachgesetz and civil protection were described in the Bundestag as a coherent protective framework.
Scope of application of the BSIG following NIS-2 implementation
Operators of critical facilities
The BSIG was significantly expanded by the NIS-2 implementation. Operators of critical facilities form a category with particularly extensive obligations. A critical facility is a facility that is significant for the provision of a critical service.
Critical services concern the supply of the general public in areas including energy, transport and traffic, finance, healthcare, water, food, information technology and telecommunications. The decisive factor is that an outage or impairment would cause significant supply shortages or risks to public safety.
Particularly important and important entities
Particularly important entities include, among others, operators of critical facilities, qualified trust service providers, top-level domain name registries and DNS service providers. Providers of publicly available telecommunications services or operators of public telecommunications networks are covered from 50 employees or upon exceeding certain turnover and balance sheet total thresholds.
Higher thresholds apply to paid providers of goods and services in the sectors listed in Annex 1 to the BSIG. Particularly important entities may include, in particular, large companies listed in Annex 1, for example from 250 employees or from EUR 50 million in turnover and EUR 43 million in balance sheet total.
Important entities include, among others, trust service providers as well as smaller providers of publicly available telecommunications services or operators of public telecommunications networks. In addition, medium-sized companies listed in Annexes 1 and 2 may be covered, in particular from 50 employees and upon reaching the relevant turnover or balance sheet total thresholds. The sectors named in the annexes are not limited to classic digital infrastructure.
Registration obligation and actual registration
Affected entities were required to register within three months pursuant to § 33 para. 1 BSIG. For entities that were already covered on 6 December 2025, this period ended on 6 March 2026. After expiry of the deadline, an extension was set until 31 July 2026.
According to specialist reports, only around 38.5 percent of companies subject to registration had been recorded in the portal by the expiry of the statutory deadline in March 2026. According to official BSI statistics, a total of 17,729 companies were registered as of 30 June 2026, including 11,501 important and 6,215 particularly important entities. By 30 September 2026, the number of registered entities had risen to 20,141; including secondary and cross-border branches, the total number was 20,373.
Breaches of registration obligations may be treated as administrative offences and trigger fines. The fine framework may amount to up to EUR 10 million for particularly important entities and up to EUR 7 million for important entities. For companies with turnover exceeding EUR 500 million, percentage limits of 2 percent or 1.4 percent of worldwide annual turnover may alternatively be considered.
Substantive requirements for cyber risk management
Risk management measures under § 30 BSIG
For management boards and managing directors, § 30 BSIG and § 38 BSIG are particularly significant. § 30 para. 1 sentence 1 BSIG obliges the covered entities to take appropriate, proportionate and effective technical and organizational measures. These are intended to prevent disruptions to the availability, integrity and confidentiality of information technology systems, components and processes and to keep the impact of security incidents as low as possible.
§ 30 para. 2 BSIG identifies ten components that can be understood as minimum requirements of a cybersecurity architecture:
- policies for risk analysis and information technology security,
- measures for handling security incidents,
- precautions for maintaining operations, such as backup management,
- supply chain security measures,
- security measures in the acquisition, development and maintenance of IT systems,
- policies and procedures for evaluating the effectiveness of risk management measures,
- basic cyber hygiene procedures and training,
- policies and procedures for cryptography and encryption,
- security concepts for personnel, access control and asset management,
- multi-factor or continuous authentication and secure communication systems.
§ 30 para. 1 sentence 2 BSIG contains a proportionality requirement. In the assessment, particular account must be taken of risk exposure, the size of the entity, implementation costs, the likelihood and severity of security incidents, as well as societal and economic impacts. These criteria limit the scope of the requirements without removing the statutory minimum character of the measures specified for covered entities.
Reporting obligations under § 32 BSIG
§ 32 BSIG provides for a graduated reporting procedure for significant security incidents. The early initial notification must be submitted within 24 hours, the follow-up notification with assessment within 72 hours and the final report no later than after one month. In the case of ongoing incidents, a progress report must be submitted.
The 24-hour period is linked to knowledge of the significant security incident. It does not depend on whether the entity has already completed its registration. A separate online reporting channel at the BSI is available for entities that are not registered.
Duties of management under § 38 BSIG
§ 38 BSIG regulates the duty of management to implement risk management measures and to monitor their implementation. The provision also contains statements on liability of governing bodies and training obligations. A waiver of liability of management for duties under § 38 BSIG by articles of association or partnership agreement is excluded by law.
Liability under § 38 BSIG exists vis-à-vis the entity itself. It does not establish liability directly towards external third parties. As regards the specific liability consequence, the BSIG generally refers to the company law rules applicable according to the respective legal form.
Special statutory requirements outside the BSIG
DORA for financial undertakings
Chapter II of DORA contains detailed requirements for ICT risk management by financial undertakings. Art. 5 DORA is addressed directly to management bodies and is more specific in this respect than § 38 para. 1 BSIG. The management body defines, approves, oversees and is responsible for the implementation of all arrangements related to the ICT risk management framework.
Art. 5 para. 2 DORA identifies individual areas of responsibility. These include, among others, policies to maintain the availability, authenticity, integrity and confidentiality of data, clear responsibilities for ICT-related functions, appropriate governance arrangements, the digital operational resilience strategy and the determination of an appropriate tolerance level for ICT risks.
The responsibility of the management body also includes approving, overseeing and reviewing ICT business continuity policies, response and recovery plans and internal ICT audit plans. Budget issues, policies on the use of ICT services and reporting channels at company level are also expressly addressed.
These tasks cannot be delegated in the sense that responsibility could be transferred to subordinate units. Support services by employees remain possible. The obligation to undergo training on ICT risks pursuant to Art. 5 para. 4 DORA must be fulfilled personally by members of the management bodies.
Departmental responsibility under DORA
Art. 5 para. 3 DORA permits the designation of a member of senior management who is responsible for monitoring the risk exposure associated with ICT third-party service providers and the relevant documentation. A special intra-organ responsibility for other aspects of cybersecurity is not expressly regulated in Art. 5 DORA, but it is not excluded either.
An allocation of responsibilities within the management board may therefore generally be considered. However, the overall responsibility of the management body remains in place for the tasks specified in Art. 5 para. 2 DORA. The special responsibility of an individual member does not remove this overall responsibility.
NIS-2 Implementing Regulation
The NIS-2 Implementing Regulation specifies technical and methodological requirements for certain digital services with a cross-border character. The services covered include, among others, DNS service providers, TLD name registries, cloud computing services, data centre services, content delivery network operators, managed service providers, online marketplaces, online search engines, social networking platforms and trust service providers.
The Regulation is also of interest beyond its direct scope of application because it contains detailed statements on the organization of network and information security. The security concept must be reviewed and updated at least annually and in the event of significant security incidents or material changes. Responsibilities, powers of instruction and reporting lines to management bodies are expressly regulated.
It is striking that the duties of management bodies in the NIS-2 Implementing Regulation do not fully correspond to the requirements under DORA. It follows that the respective regulatory frameworks must be considered according to their specific scope of application and regulatory purpose.
Radiating effect of special statutory duties
No analogous application to all companies
A central question is whether special statutory cybersecurity requirements may also apply to companies that do not fall within the respective scope of application. An analogous application of the requirements under the BSIG or DORA to all corporations must be rejected. As a rule, there is no unintended regulatory gap.
The legislature deliberately and in detail defined the scopes of application of the relevant regulatory frameworks. Where certain obligations are imposed only on certain sectors, entities or size classes, this generally argues against extending the same obligations to other companies by analogy. This applies in particular to sector-specific regulatory frameworks such as DORA, the EnWG and the TKG.
Model function of § 30 BSIG
Irrespective of any analogy, § 30 BSIG may have a model function for general organizational duties under company law. The starting points are § 93 para. 1 sentence 1 AktG (Aktiengesetz, German Stock Corporation Act), § 43 GmbHG (GmbH-Gesetz, German Limited Liability Companies Act) and, for stock corporations, § 91 para. 2 AktG and, for listed companies, § 91 para. 3 AktG. Cyber risks may have to be included in this framework if they are significant for the company or potentially threaten its existence.
In the case of stock corporations, organizational cybersecurity precautions under § 91 para. 2 AktG may be required if cyber risks can trigger developments threatening the company’s continued existence. In listed companies, cyber risks are among the risks that must be identified, assessed and managed in the internal control and risk management system. General duties of care may also require management measures depending on the significance of the risks.
However, the model function does not mean that the BSIG minimum requirements are directly and unrestrictedly binding outside their scope of application. What is decisive is the proximity of the respective company to a BSIG application category. The closer the sector, size and risk profile are to those of a particularly important or important entity, the more readily the measures referred to in § 30 para. 2 BSIG may be included as guidance in the overall assessment.
Organization of cybersecurity within the company
Responsibility within the corporate organization
For the management board, the initial question is which organizational unit is to be assigned responsibility for cybersecurity measures. The IT department, risk management, the compliance function, the legal department or a dedicated cybersecurity unit may be considered in particular. The choice depends on the company’s structure, size, risk profile and available resources.
Many cybersecurity measures are connected to risk management. At the same time, cyberattacks can raise significant legal issues, for example in dealing with ransom demands, protecting trade secrets or complying with capital markets disclosure obligations of listed companies. Breaches of obligations under the BSIG that are subject to fines also have a compliance dimension.
In principle, the management board must be granted broad business discretion in the organizational allocation of responsibilities. In practice, clear delineations of responsibilities and functioning interfaces between the areas involved are important. This applies both to preventive structures and to the response to a specific security incident.
The “whether” and “how” of implementation under § 30 BSIG
For companies that are directly subject to the BSIG, there is no business discretion as to the “whether” of implementing the measures specified in § 30 para. 2 BSIG. In this respect, the provision constitutes a statutory minimum standard. The management board therefore cannot replace individual measures with other measures that, in its view, are more suitable or more economical if this causes legally prescribed components to be omitted.
The question of the “how” of implementation must be assessed differently. The specific design of the measures requires knowledge of the structures, processes, systems and risks of the respective company. In this respect, there is much to suggest that the management board has organizational discretion that is subject to only limited judicial review.
The Business Judgement Rule under § 93 para. 1 sentence 2 AktG may apply to this design. For example, the law requires that policies and procedures for cryptography and encryption must exist; which specific procedures and concepts are chosen remains a business decision within the statutory limits. The scope for structuring ends where mandatory statutory requirements are not met.
Overall responsibility and delegation
Horizontal delegation within the management board
The organization of cybersecurity regularly requires technical and organizational expertise. A departmental responsibility for cybersecurity may therefore be provided within the management board or management. Such horizontal delegation corresponds to the general principles of permissible division of labour within the management body.
However, there is not automatically an obligation to allocate such a department. Whether and to what extent such an allocation is made is generally within the organizational discretion of the management board or, where competent, the supervisory board. In particular, allocation to a department close to IT may be appropriate.
The essential elements of the cybersecurity architecture nevertheless remain within the overall responsibility of the management board. This applies in particular to decisions that concern the core area of management responsibility. DORA and the NIS-2 Implementing Regulation may provide guidance here, without their requirements being transferable one-to-one to companies that are not covered.
Monitoring duties of management board members without specific responsibility
Management board members without special responsibility for cybersecurity also retain control and monitoring duties. Their own duty to perform tasks is transformed in this respect into a duty to monitor the responsible management board member. The other members may generally rely on proper information as long as there are no indications to the contrary.
Where difficulties are apparent, security gaps recur or deficiencies are obvious, this reliance may be limited. In that case, management board members who are not primarily responsible must also work towards remedial action. If initiatives remain unsuccessful, referral to the full management board and, where appropriate, the supervisory board may become necessary.
Vertical delegation to subordinate units
Vertical delegation, i.e. the transfer of tasks to employees, officers or specialized units below management level, is of particular significance. The wording of § 38 para. 1 BSIG speaks of “implementing”, whereas Art. 20 para. 1 of the NIS-2 Directive refers to approval and oversight of the measures by management bodies. This divergence has led to discussions.
However, the wording of § 38 para. 1 BSIG does not imply a bar on delegation. A prohibition on commissioning subordinate units would hardly be appropriate in practice and would contradict recognized principles of proper corporate organization. The explanatory memorandum to the Act also assumes ultimate responsibility when auxiliary persons are involved.
In the case of vertical delegation, management’s duty shifts to duties of care in delegation. These include selection, instruction, clarification of responsibilities and monitoring of the persons or units commissioned. This does not eliminate the overall responsibility of management.
Involvement of IT, risk management and compliance
Coordination of several functions
Cybersecurity regularly affects several corporate functions. The IT department typically has an overview of hardware, software, networks and other infrastructure. Risk management is important for the identification, assessment and management of significant risks.
Compliance and legal functions may be relevant in particular in the case of statutory reporting obligations, fine risks, capital markets law issues or dealing with unlawful attacks. If several departments are involved, communication channels and decision-making structures must be sufficiently clear. Uncertainties as to who informs whom and who below the management board is responsible for specific measures may give rise to organizational risks.
Cybersecurity governance, emergency organization and attack simulation
In larger companies or companies with particular cyber exposure, a differentiated organization may be appropriate. A distinction can be made in particular between long-term risk prevention and an emergency organization for rapid response to attacks. Risk prevention serves to establish and maintain protection systems.
A response or emergency organization has the task of repelling attacks, preventing access and returning impaired systems to proper operation as quickly as possible. Attack simulations may be considered as a further function in order to identify vulnerabilities at an early stage. Organizational separation may be necessary for this so that tests can be carried out realistically.
§ 30 para. 2 no. 6 BSIG addresses policies and procedures for evaluating the effectiveness of risk management measures in this respect. For financial undertakings, DORA contains even clearer statements on the regular testing of ICT systems and employees with ICT-related responsibilities. The objective is to identify and eliminate potential vulnerabilities.
Liability of management in relation to cyber risks
Internal liability towards the company
If the management board or management breaches organizational duties to protect the company against cyberattacks, internal liability may arise. § 38 para. 2 BSIG refers to the company law liability rules applicable according to the legal form. For stock corporations, § 93 para. 2 sentence 1 AktG is particularly relevant; for GmbHs, § 43 GmbHG is decisive.
When assessing liability, the distinction between the “whether” and the “how” is central. If an entity directly covered by the BSIG does not meet the minimum requirements of § 30 para. 2 BSIG, this may constitute a breach of the duty of legality. By contrast, there is much to suggest business discretion in the specific design of properly provided measures.
The Business Judgement Rule may exclude liability if the decision was made on the basis of appropriate information, free from special interests and in the company’s best interests. However, this does not concern the decision not to implement mandatory statutory minimum requirements at all. At that point, the scope for entrepreneurial discretion ends.
No tortious external liability under § 823 para. 2 BGB in conjunction with § 30 BSIG
It must also be examined whether § 30 BSIG constitutes a protective statute within the meaning of § 823 para. 2 BGB (Bürgerliches Gesetzbuch, German Civil Code). This could be supported by the fact that § 30 BSIG also takes into account societal and economic impacts of security incidents and that fine provisions exist. In the final analysis, however, personal external liability of the management board towards third parties due to defective implementation of the BSIG requirements must be rejected.
§ 30 BSIG is not to be classified as a third-party-protective provision within the meaning of tort law. The provision primarily serves regulatory and security-related steering of the affected entities. The statutory liability regime indicates responsibility of management towards its own entity, not a pass-through of liability for the benefit of external third parties.
This classification also corresponds to the assessment of other supervisory-law organizational duties, such as § 25a KWG (Kreditwesengesetz, German Banking Act). Such provisions regularly fulfil a regulatory policy function; an individual damages claim by third parties does not readily arise from them. The case law on § 130 OWiG (Ordnungswidrigkeitengesetz, German Administrative Offences Act) also supports a cautious recognition as a protective statute.
Key findings for management boards and managing directors
Cybercrime has become a significant risk for companies of different sizes and sectors. The statutory cybersecurity requirements have been significantly consolidated by the NIS-2 implementation, the revised BSIG, DORA, the NIS-2 Implementing Regulation and further special regulations. For management bodies, the organization of appropriate cyber risk management is central.
§ 30 BSIG contains mandatory minimum requirements for particularly important and important entities. These range from risk analysis and security concepts to emergency management, business continuity, supply chain security, cryptography, access control and multi-factor authentication, through to evaluating effectiveness. DORA formulates even more detailed requirements for financial undertakings, particularly with regard to management bodies.
An analogous application of these special duties to companies that are not covered must be rejected. Nevertheless, § 30 BSIG may have a model function for general organizational and duty-of-care obligations. The decisive factors remain the proximity of the respective company to a BSIG application category and the specific risk profile.
In the organizational positioning of cybersecurity, the management board generally has broad organizational discretion. With regard to the “whether” of legally prescribed measures, this discretion does not exist for covered entities. By contrast, the “how” of specific implementation generally remains a business decision.
Horizontal and vertical delegation are possible, but they do not release management from overall responsibility, monitoring and duties of care in delegation. Internally, liability may exist under company law rules. By contrast, tortious external liability towards third parties under § 823 para. 2 BGB in conjunction with § 30 BSIG must be rejected.
Frequently asked questions
§ 30 BSIG management board cyber risks: What duties apply to management?
For covered entities, § 30 BSIG requires technical and organizational risk management measures, the implementation and monitoring of which fall within management’s responsibility under § 38 BSIG. The “whether” of the statutory minimum measures is not discretionary, while the “how” of their design generally remains shaped by entrepreneurial judgment.
NIS-2 Implementation Act practical consequences for companies: What changed as of 6 December 2025?
Upon entry into force of the NIS-2 Implementation Act, the new obligations applied without a transitional period. Affected entities had to register, comply with risk management measures and report significant security incidents within the deadlines set out in § 32 BSIG.
DORA management body ICT risk: Can the management board delegate its responsibility?
DORA permits support by subordinate units, but leaves ultimate responsibility for ICT risk management with the management body. Individual responsibilities may be allocated internally without eliminating overall responsibility.
Company law classification of cyber risks
Cyber risks directly affect the management and organization of companies. Distinguishing between mandatory statutory duties, business discretion, departmental responsibility, delegation and liability requires a careful company law assessment of the specific company and its risk profile. MTR Legal Rechtsanwälte supports companies, investors and high-net-worth private individuals in such matters; further information can be found under legal advice in company law.
