Last updated: 2026-11-06
Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, checked on 6 November 2026. Catalogue of security requirements: version 2.0 of 29 April 2020 is in force, draft version 2025-10 has not been adopted. The protective measures the statute itself requires are on the page protective measures under Section 165 TKG, and how they go into the concept on security concept under Section 166 TKG. This is general information, not legal advice. Which requirements apply to your company is a question for a lawyer admitted in Germany. Quotations from the catalogue of security requirements and other German sources on this page are our own unofficial translations. Only the German text is legally binding.
What does the catalogue under Section 167 TKG do?
The catalogue turns the general duties of Section 165(1) to (7) TKG into concrete requirements. Under Section 167(1), the Bundesnetzagentur (BNetzA), the German Federal Network Agency, sets it by general ruling in agreement with the Federal Office for Information Security (BSI) and the Federal Commissioner for Data Protection and Freedom of Information (BfDI). It covers the details of the measures, graded by the threat potential of networks and services, which functions are critical and who has increased threat potential.
Manufacturers and the associations of network operators and service providers are consulted before it is adopted. Section 167 itself refers in two places to BSI Act provisions that no longer exist in that form (subsection 1 no. 2 and subsection 2). The draft TKG Amendment Act 2026 would correct only the reference in subsection 2.
Which catalogue applies today?
- In force: catalogue version 2.0 of 29 April 2020. The BNetzA lists it and its general ruling as "currently still valid". It was adopted by general ruling no. 63/2021 of 25 August 2021, last amended by general ruling no. 57/2022 of 29 June 2022.
- Alongside it: the list of critical functions of 18 August 2021 and the general ruling on implementation deadlines for critical components.
- Draft: version 2025-10, published in Official Gazette 22/2025 on 19 November 2025, comments until 16 January 2026 (extended deadline). It has not been adopted, and the BNetzA gives no date (as of 6 November 2026).
Why version 2.0 still cites the old act
Version 2.0 was written under Section 109 of the TKG as it stood before 1 December 2021. It cites that provision throughout and uses terms of the TKG 2004. The duties now follow from Sections 165 to 169 TKG, and the data protection rules for telecommunications from the Telecommunications Digital Services Data Protection Act (TDDDG). This mapping helps when reading (our assignment by content):
| Cited in catalogue 2.0 | Content at the time | Today in the TKG |
|---|---|---|
| Section 109(1) old version | Secrecy of telecommunications and personal data | Section 165(1) |
| Section 109(2) old version | Protecting infrastructure against disruption, availability of services | Section 165(2) |
| Section 109(4) old version | Security concept | Section 166 |
| Section 109(5) old version | Reporting security breaches | Section 168 |
| Section 109(6) old version | Catalogue of security requirements | Section 167 |
| Section 109(7) old version | Audit by a qualified independent body | Section 165(9) |
| Section 109a old version | Data and information security, personal data breaches | Section 169 |
How is version 2.0 structured?
The catalogue has seven chapters and two annexes. Chapter 3 is mandatory for every network operator and service provider, the annexes apply only to certain providers:
| Part | Content | Applies to |
|---|---|---|
| Ch. 1 | System and proportionality: only suitable, necessary and appropriate measures are required | everyone |
| Ch. 2 | Function of the catalogue, which can also serve as the basis for an audit by an independent body | everyone |
| Ch. 3 | Security requirements in nine sections (3.1 to 3.9) | everyone, mandatory |
| Ch. 4 | Legal requirements on secrecy of telecommunications, data protection and infrastructure under the TKG 2004 | everyone, to be read against the law in force today |
| Ch. 5 | Implementation: guidance on drafting the security concept, classification of criticality | everyone who prepares a concept |
| Ch. 6 | Entry into force on publication in the Official Gazette, implementation within one year | everyone |
| Ch. 7 | Definitions (based on the TKG 2004) | everyone |
| Annex 1 | Requirements for providers with IP infrastructure | additionally, providers with their own IP infrastructure |
| Annex 2 | Additional requirements with increased threat potential | additionally, today only 5G network operators |
What does chapter 3 require?
Chapter 3 is the core. Each company first judges the appropriateness of a measure itself, and the requirements are expressly neither complete nor fixed. The table lists the main points per section. The exact wording is in the BNetzA's PDF (German only):
| Section | Main requirements |
|---|---|
| 3.1 Organisation | Procedure to identify risks, documented threats (3.1.1); security roles with deputies (3.1.2); assessing suppliers, binding them by contract, data processing agreements under Article 28 GDPR (3.1.3) |
| 3.2 Personnel | Security screening depending on the role (3.2.1); documented training (3.2.2); adjusting rights at once on a change of role or departure (3.2.3); handling violations (3.2.4) |
| 3.3 Data, systems, facilities | Sensitive data locked away, mobile devices encrypted (3.3.1); redundant lines kept separate, fire protection (3.3.2); power, air conditioning, testing emergency power (3.3.3); unique identifiers and access logs, with secure remote maintenance listed as a possible protective measure (3.3.4); updates and malware protection (3.3.5); encryption, detection of anomalies (3.3.6) |
| 3.4 Operations | Documented operating procedures (3.4.1); planned and logged changes (3.4.2); inventory and configuration control (3.4.3) |
| 3.5 Disruptions and security incidents | Detection procedures (3.5.1); handling with a reporting chain and named staff (3.5.2); reporting channels to authorities, informing customers quickly about attacks on passwords (3.5.3) |
| 3.6 Emergency and outage management | Emergency manual, redundancy tests, data backup, emergency officer (3.6.1); recovery with priorities (3.6.2) |
| 3.7 Monitoring and testing | Logging security-relevant events (3.7.1); emergency exercises (3.7.2); test environment and security tests (3.7.3) |
| 3.8 Assessment | Reassessing measures regularly, for example through risk analyses and metrics such as outage times |
| 3.9 Compliance with legal requirements | Building compliance monitoring into operations, naming a responsible unit |
Version 2.0 contains no general requirement for multi-factor authentication. Annex 1 only recommends stronger authentication for end customers where technically possible. Where Section 165(2a) TKG now requires MFA, that duty comes from the statute (see protective measures under Section 165 TKG).
Chapter 5 grades the principles for measures by criticality. Version 2.0 has three levels: standard for all public networks and services, elevated where a service matters more to the public (indicator: more than 100,000 subscribers), and increased, currently only 5G. At the elevated level, measures against natural disasters, serious accidents, sabotage and terrorist attacks are added. The decisive factor remains the company's own threat analysis. How this looks in practice is shown on the security concept page, and how to arrange evidence by the sections of the catalogue for a review on the page review by the Bundesnetzagentur.
What is in annex 1 and annex 2?
Annex 1 applies in addition to providers with their own IP infrastructure, in our assessment most fibre, cable and wireless network operators that offer internet access over their own IP network. It covers infrastructure (DDoS protection, inter-domain routing), monitoring and end-user services: internet access, VoIP with reachable emergency numbers and protection against TDoS, DNS with DNSSEC. Passwords must be stored at least hashed and salted.
Annex 2 applies only with increased threat potential, which under the general ruling in force only operators of public 5G mobile networks have. It requires, among other things, certified critical components, trustworthy manufacturers and suppliers, product integrity, security monitoring and diversity. The list of critical functions of 18 August 2021 also applies only with increased threat potential, and it determines which components must be certified before first use under Section 165(4) TKG.
What would draft 2025-10 change?
Everything in this section is a draft and not the law in force. The BNetzA names as the main changes the grading of measures by three levels of threat potential, new measures for 5G with a new list of critical functions, and a proportionality check when the catalogue is adopted as an administrative act. The draft has three parts: part A is the general ruling with its reasoning, part B the catalogue with chapters 1 to 6, part C a technical specification for packet-switched networks (including DDoS, inter-domain routing, DNS and e-mail security).
Threat potential and categories of measures in the draft
| Threat potential (draft) | Criteria in the operative part of the draft | Mandatory measures in chapter 4 |
|---|---|---|
| normal | fewer than 10 employees and annual turnover or balance sheet total of at most EUR 2 million | at least category a) (basic) |
| elevated | where relevant to the public, in any case fewer than 50 employees and annual turnover or balance sheet total of at most EUR 10 million | categories a) and b) (extended) |
| increased | in any case 5G network operators, network operators or service providers with 50 or more employees or with annual turnover and balance sheet total each above EUR 10 million, operators of critical entities under the CER Directive | categories a), b) and c) (full); 5G also chapter 5 |
The levels in the draft overlap: by its wording, the elevated group includes the normal group, and the list for increased threat potential ends with an open "or". The draft speaks partly of "persons" and partly of "employees". The criteria will only be reliable in the adopted version. Chapter 4 of the draft groups the measures into ten areas, 4.1 to 4.10, each with security objectives and measures in categories a), b) and c). Chapter 5 applies only to 5G and covers critical components, certification and diversity, among other things.
Comparison table: catalogue 2.0 and draft 2025-10
This table is our own work product, based on the two PDF versions published by the BNetzA. The first part compares the structure, the second maps each section of chapter 3 of version 2.0 to the area of the draft where the same topic would sit. The mapping follows the headings, not a comparison of every single measure.
| Topic | Catalogue 2.0 (in force) | Draft 2025-10 (not adopted) |
|---|---|---|
| Legal basis cited | Section 109 TKG old version | Section 167 TKG |
| Grading | criticality standard, elevated (indicator 100,000 subscribers), increased (5G) | threat potential normal, elevated, increased by headcount and turnover |
| Form of measures | requirements per section 3.1 to 3.9, the same for everyone | security objectives with measures a), b), c) per area 4.1 to 4.10 |
| IP networks | annex 1 | part C, measures per category a), b), c) |
| 5G | annex 2, list of critical functions 2021 | chapter 5 with a new way of determining critical components |
| Data protection and secrecy of telecommunications | chapter 4 under the TKG 2004 | area 4.1 |
| Implementation deadline | one year after entry into force (on publication) | one year after notification, version 2.0 continues to apply until then |
| Catalogue 2.0, chapter 3 | Draft 2025-10, chapter 4 (our mapping) | What would be new |
|---|---|---|
| 3.1.1 Organisational and risk management | 4.2.1 Information security policy, 4.2.2 Risk management | information security policy as a separate point |
| 3.1.2 Security roles | 4.2.3 Security roles and responsibilities | - |
| 3.1.3 Supplier management | 4.2.4 Security of third-party dependencies | focus on dependencies, beyond suppliers |
| 3.2 Personnel | 4.3 Security in personnel management | heading 4.3.2 adds security education and testing |
| 3.3 Data, systems, facilities | 4.4 Security of data, systems and facilities | protection of security-relevant data (4.4.6) |
| 3.4 Operations | 4.5 Operations | - |
| - | 4.6 Lifecycle management for hardware and software | new area |
| 3.5 Disruptions and security incidents | 4.7 Incident management | cooperation on cross-provider disruptions (4.7.4) |
| 3.6 Emergency and outage management | 4.8 Emergency and outage management | backup strategy (4.8.3) |
| 3.7.1 to 3.7.3 Monitoring and testing | 4.9.1 to 4.9.3 | attack detection named explicitly in 4.9.1 |
| 3.8 Assessment | 4.9.4 Assessment of protective measures | - |
| 3.9 Compliance | 4.9.5 Monitoring compliance | - |
| Chapter 4 (secrecy of telecommunications, data protection) | 4.1 Protection of the secrecy of telecommunications and personal data | based on the law in force |
| - | 4.10 Threat awareness | new area, including informing users about threats |
Which individual measures will sit in categories a), b) and c) remains open until the catalogue is adopted.
Which deadlines apply?
Under Section 167(3) TKG, obliged companies must meet the requirements of a catalogue no later than one year after it enters into force, unless the catalogue sets a different period. For version 2.0 that period has long expired. Draft 2025-10 is to enter into force on notification. During the following year, version 2.0 continues to apply as far as the new requirements are not yet met, and is then revoked.
Discrepancy in the draft: in two places, the notes and point 2 of the operative part, the draft cites "Section 167(2) TKG" as the basis for the one-year period. In the statute, the period is in subsection 3, while subsection 2 concerns the power to define critical functions. The statutory text prevails. Because the BNetzA gives no date for adoption, no end date can be named today.
Example: what the comparison means for a cable network operator
Example, not a client. A regional cable network operator with 35 employees and EUR 7 million annual turnover serves around 18,000 lines with internet access and telephony. It runs its own IP core network with BGP connections to two upstream providers, its own DNS resolvers and e-mail mailboxes for its customers. The classification follows the wording of the documents and is our reading:
| Question | Today (catalogue 2.0) | If the draft is adopted as it stands |
|---|---|---|
| Classification | criticality standard: no 5G, indicator for elevated (more than 100,000 subscribers) not reached | not "normal" (10 or more employees), by the operative part in any case "elevated" (under 50 employees, turnover at most EUR 10 million) |
| What applies | chapter 3 in full, annex 1 because of its own IP infrastructure | chapter 4, categories a) and b) in all ten areas; part C for DDoS, routing, DNS and e-mail |
| Increased threat potential | no | no, as long as it stays below 50 employees and turnover or balance sheet total is at most EUR 10 million |
| What it can do now | document measures per section 3.1 to 3.9 and annex 1 with evidence | prepare the same documentation with the mapping table above, start early on lifecycle management and backup strategy |
| When | since entry into force, the one-year period has expired | no later than one year after notification of the new catalogue |
If the operator grows to 50 employees, it would have increased threat potential under the draft, with the consequences under Section 165 described on protective measures under Section 165 TKG.
Three common gaps
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| Annex 1 not addressed | Own IP infrastructure not recognised as the trigger | DDoS protection, routing security, DNSSEC and password storage are missing from the concept, although the general ruling requires them | Clarify whether you run your own IP infrastructure, then work through annex 1 point by point with measure and evidence |
| Old section numbers carried over | References in the concept come from catalogue 2.0 and cite Section 109 old version | Newer duties, such as the ten minimum measures under Section 165(2a), are missing from the mapping | Update references with the mapping table above and add the new duties |
| Waiting for the new catalogue | The levels of the draft are seen as uncertain | Once it is adopted, one year remains for all new areas at once | Document against catalogue 2.0 now and prepare with the mapping table |
If you want to know where your company stands against the catalogue, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.
Frequently asked questions
Does the catalogue also apply to service providers without their own network?+
Do we have to meet annex 1 if we only offer telephony?+
Which level of threat potential would a small fibre provider have under the draft?+
Should we structure our concept along the draft now?+
Read more
- Section 165 TKG: Protective Measures, Ten Minimum Measures
- Section 166 TKG Security Concept: German Telecommunications Act
- NIS2 for Telecom Providers in Germany: TKG Duties, Registration
- Security Officer under Section 166 TKG: Tasks and Appointment
- German Telecommunications Act (TKG): Telecom Security Services
Sources
- Section 167 TKG: catalogue of security requirements (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 165 TKG: technical and organisational safeguards (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Bundesnetzagentur: catalogue of security requirements (version 2.0, general ruling, list of critical functions) (German) (retrieved 2026-11-06)
- Bundesnetzagentur: catalogue of security requirements version 2.0 of 29 April 2020 (PDF, German) (retrieved 2026-11-06)
- Bundesnetzagentur: general ruling setting the catalogue of security requirements (PDF, German) (retrieved 2026-11-06)
- Bundesnetzagentur: general ruling on implementation deadlines for critical components (PDF, German) (retrieved 2026-11-06)
- Bundesnetzagentur: consultation on the revised catalogue of security requirements (German) (retrieved 2026-11-06)
- Bundesnetzagentur: draft catalogue of security requirements, version 2025-10 (PDF, German) (retrieved 2026-11-06)
- BfDI: the procedure under Section 169 TKG, which replaced Section 109a of the former TKG (German) (retrieved 2026-11-06)
- Bundestag printed paper 21/8277: draft TKG Amendment Act 2026 (PDF, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).