The German government has approved the draft Law to improve security for Information Technology Systems, also called the IT Security Law 2.0. Proposed by the Interior Ministry, the law regulates the protection of the federal administration, critical infrastructure such as telecom networks, companies with a special public interest and related consumer protections. It notably outlines new criteria for the security of telecom networks, introducing a certification regime for critical elements.
The draft law was approved at the same time as a reform of the Telecoms Act, and together the two pieces of legislation, if approved by parliament, are expected to form a new legal framework for enhancing network security. Under the law, a committee composed of representatives from the chancellery and the interior, economy and foreign ministries would be able to declare a supplier untrustworthy if it makes false declarations, does not support security audits or fails to report or patch vulnerabilities promptly, Reuters reports. Suppliers would be required to provide detailed technical information so the authorities can assess and monitor whether their equipment meets the required level of security.
The German government stopped short of banning any suppliers immediately, despite pressure from the American government to target Chinese companies. Huawei welcomed the German law, saying it would mean "higher and equal security standards for all suppliers" of 5G networks, a spokesman said.
The security law requires all operators of critical infrastructure in Germany to take measures to deter cyber-attacks, including new obligations for energy providers. Existing security obligations would also be extended to companies that are of particular public interest, such as those in the defense and IT industries, and companies that are particularly important for economic activities.
Other provisions of the law include enhanced powers for the state cybersecurity agency BSI to protect the federal administration's technology infrastructure, including coordinating with telecom and IT companies in the event of attacks. The BSI also gets responsibility for consumer protection and is tasked with developing a new IT security label system to help consumers understand potential risks. Device makers and telecom service providers also would face new requirements to supply the BSI with necessary security information, if the law is approved by parliament.
