Germany Country Report - Enisa - Europa

Germany Country Report
Country-specific activities for identifying and promoting economically efficient
approaches to information security
On its web site, BMI indicates its focus on assessing the impact of regulation as a crucial action for
better legislation. BMI acknowledges that an informative assessment of the impact of regulation is
increasingly important and that is key for specialists and stakeholders to be involved from an early
stage in examining alternatives and their consequences in a process of consultation.
The aim is to improve the quality and reduce the quantity of government regulation by using a
process of consultation in which specialists and stakeholders examine regulatory alternatives. This
process both increases the democratic participation of citizens and gives lawmakers a firmer
foundation for their decisions. For this, BMI also published or helped produce the following tools:
� Guidelines for Regulatory Impact Assessment;
� Manual of Regulatory Impact Assessment, Baden-Baden: Böhret/Konzendorf
(commissioned by the Federal Ministry of the Interior and the Interior Ministry of the state
of Baden-Württemberg)
� Regulatory Impact Assessment: Testing in Practice
� Regulatory Impact Assessment: Help for Practitioners
Since December 2008, the Federal Academy of Public Administration (BAköV) has also offered a
seminar on regulatory impact assessment. The aim is to establish regulatory impact assessment
as an integral part of the legislative process and to continually improve its quality. However, no
specific impact assessment results are available on the web site of BMI with respect to NIS-related
initiatives.
Interdependencies, Interconnection and Improving Critical Information
Infrastructure Protection
Critical infrastructure protection in Germany
In Germany, within the area of critical infrastructure protection 50 , BSI focuses particularly on IT
threats, that is on Critical Information Infrastructure Protection (CIIP). The BSI applies the term
"information infrastructure" both to the ICT sector per se (the large IT and telecommunications
networks including their components and operators) and to the ICT-based infrastructures of other
sectors.
With the National Plan for Information Infrastructure Protection – Nationaler Plan zum Schutz der
Informationsinfrastrukturen (NPSI), the Federal Cabinet adopted, in 2005, the German umbrella
strategy for the protection of information infrastructures. Three strategic objectives are set out in
the NPSI:
� Prevention: Protecting information infrastructures adequately.
� Preparedness: Responding effectively to IT security incidents.
� Sustainability: Enhancing German competence in IT security – setting international
standards.
In order to further substantiate the umbrella strategy, implementation plans have been drawn up
and adopted thereafter.
50 Source BSI: https://www.bsi.bund.de/EN/Topics/Criticalinfrastructures/criticalinfrastructures_node.html
25