CERT-DE

CERT-DE
Name	CERT-DE
Formation	2003
Headquarters	Bonn, Germany
Parent organization	Federal Office for Information Security (BSI)
Jurisdiction	Federal Republic of Germany

CERT-DE CERT-DE is the national computer emergency response team operated by the Federal Office for Information Security in the Federal Republic of Germany. It provides incident handling, vulnerability coordination, and situational awareness for critical information infrastructure and public sector networks in Germany. CERT-DE liaises with national and international partners including ENISA, European Union Agency for Cybersecurity, and the NATO Communications and Information Agency to support cross-border incident response and resilience.

History

CERT-DE was established in 2003 under the auspices of the Federal Office for Information Security following several high-profile cyber incidents affecting public administration and the Bundestag. Early years saw cooperation with the Bundesamt für Sicherheit in der Informationstechnik and outreach to operators of critical infrastructure in sectors such as energy and telecommunications. Over time CERT-DE expanded liaison roles with entities including the German Federal Police, the Bundeskriminalamt, and the European Union institutions to address transnational incidents. Major milestones included integration with national alerting mechanisms and formalized exchange channels with organizations like FIRST and the Computer Emergency Response Team Coordination Center (CERT/CC). CERT-DE's evolution paralleled legislative developments such as the IT Security Act 2.0 and amendments to NetzDG that shaped national cyber incident reporting obligations.

Responsibilities and Operations

CERT-DE coordinates incident response for cyber events impacting public administration and critical infrastructure operators designated under the IT Security Act 2.0. Core activities include vulnerability handling, malware analysis, threat intelligence sharing, and issuing advisories to entities such as the Federal Ministry of the Interior and Community and municipal administrations. It operates technical capabilities for traffic analysis, digital forensics, and CERT-to-CERT communications with partners like CERT-EU and national teams in the European Union and NATO. CERT-DE also supports incident preparedness through exercises with stakeholders including the German Aerospace Center and the German Association for Information Technology, Telecommunications and New Media (Bitkom). Operational outputs comprise situation reports, technical indicators, and mitigation guidance aimed at reducing impact for organizations such as state ministries and public broadcasters like Deutschlandradio.

Organizational Structure and Governance

CERT-DE is embedded in the Federal Office for Information Security, reporting to its executive leadership and aligning with oversight from the Federal Ministry of the Interior and Community. The team includes units for incident handling, vulnerability analysis, legal liaison, and public relations; specialists often hold prior experience at institutions like the Bundeswehr and academic centers such as the Fraunhofer Society. Governance structures provide interfaces with the Bundesnetzagentur and sectoral regulators for energy, finance, and transport. Internal policies reflect compliance obligations under statutes including the Telekommunikationsgesetz and coordination mechanisms with law enforcement agencies like the Bundeskriminalamt.

Major Incidents and Responses

CERT-DE has been involved in coordinating responses to incidents affecting public-sector IT and critical services, working with affected organizations and international partners such as US-CERT and CERT-UK. Notable response efforts addressed vulnerabilities exploited by state-linked campaigns attributed in public discourse to entities reported by think tanks and research groups; CERT-DE issued advisories and coordinated patching with vendors such as major enterprise software providers and infrastructure operators. It has participated in remediation after distributed denial-of-service events targeting media outlets and service providers, collaborating with transit operators represented by associations like the German Association of Public Transport (VDV). CERT-DE also contributes to aftermath analyses published by academic institutions including Technische Universität Berlin and policy centers in the European Union.

Collaboration and Partnerships

CERT-DE maintains formal and informal partnerships with national CERTs and international organizations such as ENISA, CERT-EU, FIRST, and the NATO Communications and Information Agency. It engages with industry stakeholders including Deutsche Telekom, cloud providers, and the German Association for Information Technology, Telecommunications and New Media (Bitkom) to share indicators of compromise and mitigation strategies. Academic collaboration includes joint research with universities like RWTH Aachen University and Karlsruhe Institute of Technology. CERT-DE participates in multinational exercises alongside partners from the European Union and NATO and exchanges best practices with sector regulators including the Bundesnetzagentur.

Legal Framework and Policy Influence

CERT-DE operates under statutory frameworks including the IT Security Act 2.0 and interfaces with regulations stemming from the Network and Information Security Directive (NIS Directive) as implemented in German law. Its advisory outputs inform policymaking at the Federal Ministry of the Interior and Community and contribute to consultations involving the Bundesrat and Bundestag committees concerned with digital security. CERT-DE's role in incident reporting and information sharing has influenced implementation guidance for operators of critical infrastructure in sectors overseen by ministries such as the Federal Ministry for Economic Affairs and Climate Action. Through cooperation with agencies like ENISA and engagement in EU-level working groups, CERT-DE shapes cross-border standards and incident response frameworks.

Category:Computer emergency response teams Category:Government agencies of Germany