Germany · EU member state
Germany: NIS2, the CRA, the GDPR and ISO 27001, from the registers
Every register row StandardOS holds for Germany, each with the day it was read, and the two scope tools with the state filled in. Nothing on this page is typed; it is the registers, joined by state.
- NIS2 measures on the Commission's register
- 20
- CRA authorities registered
- 2/2
- ISO 27001 certification bodies on the register, read 10 October 2026
- 35
- Public tenders mentioning ISO 27001
- 1,539
Reporting clocks, and who they run to
- 24hNIS2: early warning of a significant incidentThe national CSIRT: CERT-Bund
- 24hCRA: early warning of an actively exploited vulnerabilityThe CSIRT designated as coordinator: CERT-Bund
- 72hGDPR: notification of a personal data breachSupervisory authority (Article 51): Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)The Board notes that competence is split among several authorities in this state. the list of authorities
Receives the Article 23 notifications, unless the state's act routes them to its competent authority, and the CRA's Article 14 notifications where it is also the coordinator.
NIS2
The NIS2 law, as communicated to the Commission
Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung
- Gesetz
- dated 5 December 2025
- in force 6 December 2025
all 20 measures on the register · read on 23 October 2026
Registration
Bundesamt für Sicherheit in der Informationstechnik (BSI)
You need ELSTER-Organisationszertifikat (Mein Unternehmenskonto) before a registration will be accepted.
The registration deadline has already passed. If you are in scope and have not registered, you are late.
read on 28 September 2026
The national CSIRT
CERT-Bund · CERT-Bund at the BSI · www.bsi.bund.de/EN
The Cyber Resilience Act
The CSIRT designated as coordinator
CERT-Bund
CERT-Bund at the BSI · www.bsi.bund.de/CERT-Bund
From ENISA's list of coordinators, dated 10 September 2026. A manufacturer with its main establishment in the state files its Article 14 notifications here, on ENISA's single reporting platform.
The authorities registered for the CRA
- Market surveillance authority
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Notifying authority
- Bundesamt für Sicherheit in der Informationstechnik - Referat S 14 – Befugniserteilung und Aufsicht über Konformitätsbewertungsstellen
As registered in the Commission's Single Market Compliance Space on 13 October 2026. Designations are expected to fill in before full application on 11 December 2027.
GDPR
Supervisory authority (Article 51)
Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
The Board notes that competence is split among several authorities in this state. the list of authorities
The authority of a company's main establishment leads for its cross-border processing (Article 56(1)) and receives its Article 33 breach notification. As the European Data Protection Board lists its members, read on 12 September 2026.
Which authority is yours: the main establishment and the lead authority of Article 56ISO 27001
The national accreditation body
DAkkS
Deutsche Akkreditierungsstelle
The one body under Regulation (EC) 765/2008 whose register says which certifiers are accredited for ISO 27001 here. Checked 11 August 2026.
Certification bodies for ISO 27001
35
DAkkS's register lists 35 bodies accredited for ISO 27001, read 10 October 2026.
See all 35, each with its own sitePublic tenders mentioning ISO 27001
Of 165,757 notices the state's buyers published on TED in 365 days, 0.93 % mention ISO 27001, 4,897 mention ISO 9001 and 92 mention NIS2. Observed 12 September 2026; mentions, not requirements.
How to check a certifier on the registerISO 27001 in EU public tenders, by countryISO 9001 in EU public tenders, by country
One workspace for what the state asks and what the buyer asks
StandardOS keeps the ISO 27001 records that answer most of NIS2's Article 21 measures, the incident record the Article 23 and Article 14 clocks run from, and the evidence a supervisor, a coordinator or an auditor asks for, in six languages.
Every row on this page is a register's, read on the day shown; the registers change and the read dates say how old each answer is. This is not legal advice.