Telecom security under the German Telecommunications Act
Telecom security under the German Telecommunications Act, without a major project
We help small and mid-sized network operators and service providers bring their security concept, security officer and NIS2 duties under the German Telecommunications Act (TKG) up to the law in force, at fixed fees and in English. The entry point is a status review that shows what is missing.
What the German Telecommunications Act requires
Anyone who operates a public telecommunications network or provides publicly available telecommunications services in Germany must, under Section 166(1) of the German Telecommunications Act (TKG), designate a security officer, designate a contact person established in the EU and draw up a security concept. There is no size threshold. Network operators submit the concept to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, without delay once the network goes into operation; service providers without their own network do so when the regulator asks for it. The Bundesnetzagentur reviews implementation regularly, as a rule at least every two years.
Since 6 December 2025 the NIS2 obligations for telecom providers have been part of the TKG. Public network operators and providers of publicly available telecom services are at least important entities under Section 28 of the German BSI Act (BSIG), with no lower size threshold, and essential entities from 50 employees or with annual turnover and balance sheet total of more than EUR 10 million each. Section 165(2a) TKG sets ten minimum measures for them, from risk analysis through supply chain and backup to multi-factor authentication. Management must implement and oversee these measures and take part in training regularly. Significant security incidents are reported to both the Bundesnetzagentur and the Federal Office for Information Security (BSI), the first report no later than 24 hours after becoming aware (Section 168 TKG).
The security concept has to describe the measures taken to meet Section 165(1) to (7) TKG, so a concept written before December 2025 will usually not yet cover the new minimum measures. The yardstick is the catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force, the draft version 2025-10 has not been adopted. Which obligations apply to your company depends on your role and needs to be assessed case by case.
Our telecom security services
You book what you are missing. The security concept and the NIS2 obligations for telecom providers each have their own page with details.
Where do we stand?
Status review (stage 1)
Classification of your company under German rules, gap check of your security concept against the law in force, a reporting template with a German cover text for the authorities, a prioritised list of measures and support with BSI registration. Fixed fee, credited once in full against a revision of the security concept ordered within 60 days of handover of the results.
Status review (stage 1)Concept out of date?
Security concept under Section 166 TKG
We revise your concept to the law in force, prepare the implementation declaration and the submission with a German text for the authority, and answer one round of questions from the Bundesnetzagentur.
Security concept under Section 166 TKGRole not filled?
Security officer under Section 166 TKG
Tasks of the mandatory role and how it differs from an information security officer. We take on the role of external telecom security officer on request.
Security officer under Section 166 TKGWhat applies since NIS2?
NIS2 obligations under the TKG
Your role as network operator or service provider, classification under Section 28 BSIG, BSI registration and management duties.
NIS2 for telecom providersBased outside Germany?
Telecom providers based abroad
Notification to the Bundesnetzagentur, EU contact person, security concept and the open questions on BSI registration, with a checklist for providers serving customers in Germany.
Telecom providers based abroad
Status review (stage 1) in brief
The status review "NIS2 obligations status (telecom)" is a limited professional review for one legal entity, delivered in English: classification, gap check of your security concept against the law in force, a prioritised list of measures, a template for the incident reporting procedure under Section 168 TKG with a German cover text for the authorities, and support with BSI registration where it applies, based on your documents and one interview. It costs from EUR 4,900 net. The fee is credited once in full against a revision of the security concept if you order it within 60 days of handover of the results (fixed fees below). Procedure, a sample result and the limits of the review are on the page "Status review (stage 1)".
Offer and fixed fees
The status review is the entry point. If you already know that your concept needs revising, you can order the revision without it. Fees for work in English, all net of VAT:
| Service | up to 49 employees | 50 to 249 employees |
|---|---|---|
| Status review (stage 1) "NIS2 obligations status (telecom)" (fee for 50 or more employees, no upper limit) | EUR 4,900 | EUR 5,900 |
| Revision of the security concept under Section 166 TKG to the law in force | EUR 9,900 | EUR 15,900 |
| NIS2 implementation package added to a revision (incident reporting procedure, evidence for management, support with BSI registration) | + EUR 4,900 | + EUR 5,900 |
| NIS2 implementation package on its own, for a concept that reflects the law in force | EUR 5,900 | EUR 6,900 |
| External telecom security officer | on request | on request |
All fees net, plus VAT where applicable, per legal entity, remote. Procedure and a sample result of the status review are on the page "Status review (stage 1)". The fee depends on the headcount of the contracting legal entity on the day of the order. If you order a revision of your security concept within 60 days of receiving the results of the status review, we credit the fee for the status review once in full against it. It is not credited against the implementation package on its own. What the revision and the implementation package include is described on the page on the security concept. New concepts, and revisions for 250 or more employees or for 5G networks, on request. Offered to businesses only.
How we work with you
From the first call to submission to the Bundesnetzagentur.
1
Initial call
Role, network, services and the state of your concept. No obligation, by video call or phone.
2
Status review, if needed
If it is unclear how far your concept is from the law in force, the status review (stage 1) clarifies this at a fixed fee.
3
Revision
We bring your concept up to the law in force and prepare the implementation declaration and the submission with a German text for the authority.
4
Submission and questions
You submit the concept to the Bundesnetzagentur. We help answer one round of questions from the authority.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Providers based outside Germany
In our reading, the TKG applies according to where the activity takes place: if you operate networks or provide telecom services in Germany, its security rules apply to you even if your company is based abroad. What this means for notification, the EU contact person, the security concept and the BSI is set out, with a checklist, on the page linked below.
We work with you in English and prepare the German text you submit to the Bundesnetzagentur. The fees shown above are for work in English. The compact revision for small networks is available in German only.
Our experience with telecom security
We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.
That is why we write concepts the way the catalogue of security requirements structures them: with measures assigned to a part of the network or a service, and with an implementation status your management can stand behind in the implementation declaration. We do not name clients.
Legal status of this page
German Telecommunications Act as amended on 22 October 2026 and BSI Act as amended on 22 October 2026, both checked on 6 November 2026. Catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force; the draft version 2025-10 has not been adopted (as of 6 November 2026).
The draft TKG Amendment Act 2026 (Bundestag printed paper 21/8277) would also change security provisions in Sections 165 and 168 TKG. It is a draft: first reading on 9 October 2026, hearing on 4 November 2026, not adopted. This page describes the law in force.
What is not included
Our fixed fees apply per legal entity and to remote work by video call. Not included:
- multiple legal entities or separate concepts per network
- on-site meetings, technical audits or scans
- technical implementation of the measures in your network and drafting a new concept (on request)
- ongoing correspondence with the Bundesnetzagentur or the BSI beyond the round of questions included in the revision
- legal advice and certified translations
- a step-by-step guide to registration in the BSI portal; this is on https://nis2-readiness.de (in German), as is NIS2 outside telecommunications
- appointing an external information security officer; this service is described on https://blackfort-tec.de/consulting-pages/externer-informationssicherheitsbeauftragter (in German)
Our classification is a professional, not a legal one. Whether an obligation applies in your case as a matter of law is a question for a lawyer admitted in Germany.
Frequently asked questions
Who is this for?+
Small and medium-sized operators of public telecom networks and providers of publicly available telecom services, including companies based outside Germany that are active in the German market. The fixed fees for a revision apply up to 249 employees. For larger companies and 5G networks we prepare an offer after reviewing your documents. The status review has a fixed fee at any size.
Do we have to start with the status review?+
No. If you know your concept needs revising, order the revision directly. The status review is useful when it is unclear which obligations apply. If you order a revision within 60 days of receiving the results, we credit its fee once in full.
Why are the fees for work in English higher?+
Because the work involves more: coordination in English and, for the revision of the concept, a German text for the Bundesnetzagentur. The scope of the service is otherwise the same.
Read more
- TKG Status Review: Stage 1 Check for Telecom Providers
- Section 166 TKG Security Concept: German Telecommunications Act
- Security Officer under Section 166 TKG: Tasks and Appointment
- Section 165 TKG: Protective Measures, Ten Minimum Measures
- NIS2 for Telecom Providers in Germany: TKG Duties, Registration
- Section 168 TKG: Reporting Security Incidents to BNetzA and BSI
- Customer Data, Sections 172-174 TKG (German Telecommunications Act)
- TKG Templates: Section 165 Checklist, Appointment, Reporting
- TKG Germany: Checklist for Foreign Telecom Providers
- About Us: TKG-Readiness by Blackfort Technology, Bonn
Sources
- German Telecommunications Act (TKG), Sections 165 to 168 (German) (retrieved 2026-11-06)
- German BSI Act (BSIG), Sections 28, 33 (German) (retrieved 2026-11-06)
- Bundesnetzagentur: catalogue of security requirements (German) (retrieved 2026-11-06)
- Bundesnetzagentur: consultation on the revised catalogue (German) (retrieved 2026-11-06)
- Bundestag printed paper 21/8277: draft TKG Amendment Act 2026 (German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Where does your security concept stand?
In an initial call we clarify your role, the state of your concept and whether a status review or a revision is the right step.