Germany Country Report - Enisa - Europa

Germany Country Report
NIS national strategy, regulatory framework and key
policy measures
Overview of the NIS national strategy
The German National Strategy for Critical Infrastructure Protection (CIP Strategy) of Germany was
published already in June 2009 1 by the Federal Ministry of the Interior - Bundesministerium des
Innern (BMI) and summarizes the objectives as well as the political-strategic approach as it is
already common practice and pursued e.g. by the National Plan for Infrastructure Protection
(NPSI) for the area of ICT.
For the implementation of the National Critical Infrastructure Protection Strategy, an extensive set
of instruments is available in the form of:
� Programmes and plans (e.g. the National Plan for Information Infrastructure Protection
(NPSI) and the related implementation plans as a strategic concept for IT infrastructure
protection);
� Specific recommendations for action, like for instance:
o the national Baseline Protection Concept as a basic guidance to physical critical
infrastructure protection;
o the Risk and Crisis Management Guide for Critical Infrastructure Operators, or
o the national special protection concepts as detailed recommendations for action for
the protection of individual CI sectors and sub-sectors);
� Standards, norms and regulations (e.g. the BSI Information Security Standards as a basic
recommendation for action addressed to critical infrastructure operators.
In Germany, critical infrastructure protection is a task to be performed jointly by the government,
companies and/or operators and also by civil society. The guiding principles regarding critical
infrastructure protection are, in particular:
� Trusting co-operation between the state and business and industry at all levels; and
� The requirement for, and suitability and proportionality of, the measures taken and the
use of resources made for increasing the level of protection.
As stated in the CIP Strategy, Germany acknowledges that for joint action to be successful,
strategic guidelines are required which describe the basic philosophy, action and practices in all
essential security-policy matters regarding critical infrastructure protection with reference to all
relevant risks.
Early 2011, Germany published its new Federal Cyber Security Strategy for Germany 2 . With the
new German Cyber Security Strategy, the German Federal Government adapts measures to the
current threats on the basis of the structures established by the CIP implementation plan and the
implementation plan for the federal administration. The Federal Government will specifically focus
on ten strategic areas:
1. Protection of critical information infrastructures: main priority of cyber-security, extends
the cooperation established by the CIP implementation plan;
1 http://www.bmi.bund.de/cae/servlet/contentblob/598732/publicationFile/34423/kritis_englisch.pdf
2 http://www.cio.bund.de/SharedDocs/Publikationen/DE/IT-
Sicherheit/css_engl_download.pdf?__blob=publicationFile
5