Federal Office for Information Security

Federal Office for Information Security
Name	Federal Office for Information Security
Native name	Bundesamt für Sicherheit in der Informationstechnik
Formed	1991
Headquarters	Bonn, Germany
Chief1 name	Claudia Plattner
Chief1 position	President
Parent department	Federal Ministry of the Interior (Germany)
Website	www.bsi.bund.de

Federal Office for Information Security. The Bundesamt für Sicherheit in der Informationstechnik, known as the BSI, is the national cybersecurity authority of the Federal Republic of Germany. Operating under the auspices of the Federal Ministry of the Interior (Germany), it is tasked with securing information technology across federal administration, critical infrastructure, and for citizens and businesses. With its headquarters in Bonn, the agency plays a central role in defending against threats from cybercrime, state-sponsored hacking, and espionage, while also promoting secure digital products and standards.

History

The agency was established in 1991, evolving from cryptographic and security units within the Bundesnachrichtendienst and the Federal Office for the Protection of the Constitution. Its creation was driven by the growing importance of information technology following the end of the Cold War and the rise of the public internet. A pivotal moment in its development was the passage of the Information and Communication Services Act in 1997, which formally enshrined its modern mandate. Over the decades, its role expanded significantly in response to major incidents like the Stuxnet computer worm and increasing threats to national infrastructure, leading to legislative enhancements through laws like the IT Security Act.

Organization and structure

The BSI is organized into several directorates focusing on areas such as cyber security, critical infrastructure protection, and digital sovereignty. It is led by a President, currently Claudia Plattner, who succeeded Arne Schönbohm. The agency maintains its primary offices in Bonn and has a significant presence in Berlin, collaborating closely with other federal bodies like the Federal Criminal Police Office (Germany) and the Federal Office for the Protection of the Constitution. Its structure includes specialized units for incident response, cryptography, IT baseline protection, and the operation of the Computer Emergency Response Team for federal government networks.

Responsibilities and tasks

Core responsibilities include advising the German federal government on all matters of IT security, developing mandatory security standards for federal authorities, and certifying secure hardware and software products. The agency operates the National Cyber Defence Centre in cooperation with partners like the Bundeswehr and the Federal Office for the Protection of the Constitution to coordinate national responses to major cyber attacks. It is also responsible for protecting critical infrastructure sectors such as energy, finance, and healthcare under the German IT Security Act, and provides public awareness services through platforms like BSI für Bürger.

Legal basis and authority

The primary legal foundation is the BSI Act, supplemented by key legislation including the IT Security Act and the Critical Infrastructures Ordinance. These laws grant the authority to issue binding technical directives for federal bodies, investigate security incidents, and impose security requirements on operators of essential services. Its mandate is further defined within the broader framework of the European Union's Network and Information Security Directive, which has been transposed into German law. The agency's actions are subject to oversight by the German Bundestag and judicial review by administrative courts.

Notable activities and incidents

The BSI gained public prominence for its analysis of sophisticated cyber attacks, including the disclosure of the Bundestag hack allegedly linked to APT28, and its warnings about vulnerabilities in widely used software like Microsoft Exchange Server. It played a critical role during the COVID-19 pandemic by securing the Corona-Warn-App and investigating attacks on research institutions like the Robert Koch Institute. The agency has also been involved in controversies, such as the scrutiny over its former president's contacts with the Cyber Security Council of Germany, leading to his dismissal.

International cooperation

As Germany's central authority for cybersecurity, it maintains extensive bilateral and multilateral partnerships. It works closely with the European Union Agency for Cybersecurity in Athens and is an active member of the NATO Cooperative Cyber Defence Centre of Excellence in Tallinn. The agency collaborates with counterparts like the National Cyber Security Centre in the United Kingdom and the Cybersecurity and Infrastructure Security Agency in the United States. It also represents German interests in international forums such as the United Nations and the International Organization for Standardization to shape global norms and standards for information security.

Category:Computer security organizations Category:Federal agencies of Germany Category:Organizations based in Bonn