BSI (Germany)

BSI (Germany)
Agency name	Federal Office for Information Security
Native name	Bundesamt für Sicherheit in der Informationstechnik
Formed	1991
Preceding1	Zentralstelle für Sicherheit in der Informationstechnik
Jurisdiction	Federal Republic of Germany
Headquarters	Bonn, Germany
Employees	700–1,200 (varies)
Minister	Federal Ministry of the Interior and Community
Chief1 name	President (office)
Website	(official)

BSI (Germany) is the Federal Office for Information Security in the Federal Republic of Germany, responsible for information and communications technology security, cryptography policy, and protecting critical infrastructure. It serves as a technical authority and certification body tied to national institutions and European frameworks while interacting with international organizations and industry stakeholders.

History

The agency traces roots to post-Cold War reforms linking to institutions such as Bundesministerium des Innern, Federal Intelligence Service (BND), Bundeswehr technical units, and earlier offices created during reunification. Throughout the 1990s it interfaced with entities like Bundesdatenschutzgesetz discussions, Europol precursors, and standards bodies including Deutsches Institut für Normung, International Organization for Standardization, and European Telecommunications Standards Institute. In the 2000s its remit expanded amid events involving Stuxnet, WannaCry, and debates around Schengen Agreement information systems, prompting links to Bundesamt für Verfassungsschutz and legislative acts such as the IT Security Act 2015 and Network Enforcement Act. Recent years saw cooperation with European Union Agency for Cybersecurity, NATO Cooperative Cyber Defence Centre of Excellence, and interactions with technology companies including SAP, Siemens, Deutsche Telekom, Microsoft, and Google.

Legal status and organisation

Legally established under federal statute, the office reports to the Federal Ministry of the Interior and Community and interacts with parliamentary bodies including the Bundestag and committees addressing digital affairs. Its organisation mirrors federal agencies like Federal Statistical Office (Destatis), Federal Office for Migration and Refugees, and Federal Criminal Police Office (BKA), with departments covering cryptography, certification, incident response, and research. Governance involves standards set alongside European Commission directives, coordination with Bundesländer authorities, and compliance with instruments such as the General Data Protection Regulation and national statutes including the Telekommunikationsgesetz and Strafgesetzbuch provisions for cybercrime. Executive leadership liaises with advisory boards comprising representatives from Bundeswehr University Munich, Fraunhofer Society, Max Planck Society, and industry consortia like Bitkom.

Responsibilities and functions

Mandates include protecting federal IT, advising ministries such as Federal Ministry of Finance and Federal Foreign Office, and supporting agencies like Federal Office for Migration and Refugees and Federal Employment Agency on technical security. It issues guidance used by corporations such as Deutsche Bahn, Bundesagentur für Arbeit, KfW, Commerzbank, and infrastructure operators in energy, transport, and healthcare including RWE, Deutsche Telekom, Charité, and Siemens Healthineers. The office operates Computer Emergency Response Teams akin to CERT-EU and coordinates with law-enforcement partners including the Bundeskriminalamt and judicial organs at the Federal Constitutional Court of Germany for legal aspects. It maintains crypto recommendations influencing projects with European Central Bank, Deutsche Bundesbank, and standards impacting Visa and Mastercard payment systems.

Cybersecurity and IT standards

The agency develops technical guidelines aligning with ISO/IEC 27001, Common Criteria, and European schemes such as EU Cybersecurity Act. It publishes baselines and catalogs referenced by vendors like Cisco Systems, IBM, Oracle Corporation, and open-source communities associated with Linux Foundation, Apache Software Foundation, and OpenSSL. Standards work engages research partners including Technical University of Munich, Karlsruhe Institute of Technology, RWTH Aachen University, and labs within Fraunhofer Institutes. Certification schemes affect products from manufacturers such as Siemens, Bosch, Infineon Technologies, and influence procurement by entities like Deutsche Bahn and Bundeswehr.

Research, certification and services

The office runs laboratories and test centers in collaboration with institutions like Bundeswehr University Munich, Helmholtz Association, and commercial test houses. It issues IT security certificates under programs comparable to Common Criteria Recognition Arrangement and works with accreditation bodies such as Deutsche Akkreditierungsstelle. Services include vulnerability analyses, cryptographic assessments, and training programs for professionals from Bundesnachrichtendienst partners, private firms such as SAP and Vodafone, and municipal IT teams. It contributes to academic literature alongside publishers and conferences like Usenix, Black Hat, RSA Conference, and European events including Infosecurity Europe.

International cooperation and incidents

The agency cooperates with NATO, European Union Agency for Cybersecurity, Council of Europe, Interpol, and bilateral partners like United States Department of Homeland Security, National Cyber Security Centre (UK), Agence nationale de la sécurité des systèmes d'information, and CERT-Polska. It has been involved in response efforts for incidents related to families of malware such as NotPetya, Emotet, and SolarWinds, coordinating with vendors including FireEye (Mandiant), Microsoft, CrowdStrike, and infrastructure providers like Amazon Web Services and Google Cloud Platform. High-profile advisories have referenced vulnerabilities in products from Cisco Systems, Siemens, Kaspersky Lab, and Huawei Technologies. The office participates in exercises with NATO Cooperative Cyber Defence Centre of Excellence and crisis simulations involving agencies such as Bundesamt für Bevölkerungsschutz und Katastrophenhilfe and Bundesamt für Verfassungsschutz.

Category:Bundesbehörden