Qeveria gjermane dëshiron siguri më të madhe digjitale

2024-07-27 22:45:00, Kosova & Bota CNA

The German government has approved a draft law on digital security, which will be debated by the Bundestag. It is envisaged that companies will better train their employees in this area and ensure greater protection of access to digital systems through a multi-factor security option that provides for at least two steps of verification before they can be entered into computer systems. The new rules will apply to at least 30,000 German companies.

Economic damage due to cyber attacks

Germany is obliged to adopt this law, because the European Union requires it with the NIS2 directive. The Social Democratic Minister of Internal Affairs, Nancy Faeser, in the Ministry's media statement said that the law is being adopted to strengthen the resistance of the German economy to cyber attacks.

An important component of the future law is the provision that the company's management must take over the guarantee in case the appropriate digital protection measures are not taken. Management must enable the development of a concept of defense against cyber attacks and data protection. This is called "backup-management" in the profession.

Dennis-Kenji Kipker from the University of Bremen says that the management of the company must have knowledge and that those who do not get this knowledge risk losing the right to be in charge of the company. Kipker adds: "Digital security is completely uncharted territory in many areas of German industry."

Qeveria gjermane dëshiron siguri më të madhe digjitale

The Federal Institute for Security in Information Technology (BSI) will have expanded powers. Companies must register with that institution and send extensive reports in the event of a cyber incident. If someone breaks the security rules, this state institution has the right to intervene and sanction more quickly.

The government has provided for large fines in the draft law. In the case of large and important companies, the fine can be up to two percent of the annual turnover. We are talking about amounts that can be several million euros each.

Criticism of the bill

Bremen law professor Denis-Kenji Kipker criticizes the non-transparency of the law-making process. He says the current draft is the best possible compromise. Although the Federal Institute for Security in Information Technology took on more tasks and responsibilities, it did not become politically independent. Kipker says that instead this institution has remained integrated into the structure of the Ministry of the Interior.

Also, it is noted that the draft law is inaccurate in crucial segments, which unnecessarily complicates the work of law enforcement for companies. Karsten Bartel, a lawyer from the IT Security Association (TeleTrustT), says that it is not clear, for example, what additional measures should be taken by critical infrastructure companies in the areas of water supply or energy supply.

The draft envisages that such companies take on the obligation to put in place stricter security measures compared to companies that are less threatened. But it is not clear what exactly it means. "Companies need concrete regulation. If the draft as it is becomes law, it will immediately create the need for improvement", says Bartel.

A challenge for small businesses

Qeveria gjermane dëshiron siguri më të madhe digjitale

Entrepreneurs' associations are also included. They welcome the improvement of digital security in a wide range of industries and the legal obligation to improve security. Paul Ruland from the Federal Association of Medium Enterprises (BVMW) says that in difficult economic times this will not always be easy to achieve. The German Association of Medium-sized Entrepreneurs (DMB) believes that German small and medium-sized enterprises must make up a lot of lost ground in this area. However, the alliance criticizes "a politically too ambitious plan that can hardly be implemented in reality".

In a first step, the Federal Institute for Security in Information Technology published a catalog of questions on its website. Based on them, companies can check whether the new rules also apply to them. However, there are no detailed instructions on what they should do about digital security and how to implement the new rules./ DW