Access control and MFA for network elements under Section 165(2a) nos. 9 and 10 TKG

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, catalogue of security requirements of the Bundesnetzagentur (BNetzA), the German Federal Network Agency, version 2.0 of 29 April 2020, checked on 6 November 2026. This page goes into two of the ten minimum measures in more depth. The overview of all ten is on the page protective measures under Section 165 TKG. This is general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany. Quotations from German statutes and from the catalogue of security requirements on this page are our own unofficial translations. Only the German text is legally binding.

What do Section 165(2a) nos. 9 and 10 TKG require?

No. 9 requires “human resources security, access control policies and asset management” (our translation). No. 10 requires the “use of multi-factor authentication or continuous authentication solutions”, together with secured voice, video and text communications and, where appropriate, secured emergency communication systems within the entity. Both apply to operators of public telecommunications networks and providers of publicly available telecommunications services that are essential or important entities under Section 28 of the BSI Act (BSIG). In our reading, that means practically every telecom provider (classification on the page NIS2 for telecom providers in Germany).

This page deals with access to network elements: routers, switches, OLTs, broadband gateways, session border controllers and the systems used to manage them. The secured communications under no. 10 are covered in the overview on the page protective measures under Section 165 TKG.

Where does the MFA duty come from if the catalogue does not name it for administrative access?

From the Act. Catalogue 2.0, which is in force, dates from 2020. The ten minimum measures only entered the TKG with the NIS2 implementation on 6 December 2025. Catalogue 2.0 does not name multi-factor authentication for access to network elements or for remote maintenance. It mentions two-factor methods only in annex 1 (section 3.1): providers with IP infrastructure “should, where technically possible” offer their customers stronger authentication methods. Remote maintenance appears only as a “possible protective measure”. The catalogue gives concrete form to the Act, but it cannot remove a duty the Act sets. In our reading, a provider that follows catalogue 2.0 alone therefore does not meet no. 10.

The Act does not say for which kinds of access multi-factor authentication has to be used. The yardstick remains Section 165(2): a level of security appropriate to the risk and, under subsection 6, effort that is not out of proportion. In our reading, the first in line are every administrative access to network elements and management systems, every remote access from outside, including by service providers and manufacturers, and access to customer data. How far the duty reaches in a given case is a balancing exercise that you should justify in the security concept.

What does catalogue 2.0 in force require on access control?

Chapter 3 of catalogue 2.0 is mandatory for all obliged companies. Section 3.3.4 “Access control to network and information systems” introduces its list with “Possible protective measures are”. The list contains:

• unique user IDs and authentication before users access services or systems,
• storing passwords only in encrypted form,
• defining roles, rights, responsibilities and procedures for granting and revoking access rights,
• logging access to network and information systems and recording deviations,
• adequately securing remote maintenance access (“dedicated VPN access”),
• allowing outside persons, for example during maintenance or conversion work, into secured areas only when accompanied or after a security check and briefing,
• reviewing and adjusting access control mechanisms regularly.

Four further sections are relevant to no. 9. Under 3.2.1, a security check may be appropriate for persons with security-relevant tasks, and the catalogue names system administrators. Under 3.2.3, access rights must be adjusted or blocked without delay when staff or contractors change. Section 3.4.3 requires an inventory of the essential assets including configuration control, and 3.7.1 requires logging of administrative activities.

What would draft 2025-10 change?

The draft of the new catalogue (version 2025-10) has not been adopted (as of 6 November 2026), and catalogue 2.0 continues to apply. The draft would regulate access control in section 4.4.3 in three categories. Their assignment by a new threat potential does not apply today (details on the page catalogue of security requirements under Section 167 TKG):

The draft would thus catch up with what Section 165(2a) no. 10 has required since December 2025. Commission Implementing Regulation (EU) 2024/2690, which sets technical requirements for other NIS2 sectors, does not apply to telecom providers. It lists its addressees exhaustively, and network operators and providers of electronic communications services are not among them.

Remote maintenance by service providers and manufacturers

Remote maintenance is the kind of access where access control and the supply chain meet. The service provider needs administrative rights on your network elements but sits outside your company. In our reading, the Act leads to three requirements: the access is part of your access control policy (no. 9), it is secured with multi-factor authentication (no. 10), and the service provider is bound by contract and assessed (no. 4, see supply chain in the telecom network). From category b) on, the draft would expressly require that remote access by third parties is granted only for a limited time and without permanent credentials. How remote maintenance can be secured technically in this way, with approval per session, multi-factor authentication and recording, is described in our service secure remote maintenance on www.blackfort-tec.de (in German).

Example: access rights review for network elements

Fictitious example, not a client. A regional carrier with 25 employees operates a fibre and microwave network and leases lines to business customers. It manages its routers and OLTs through a central network management system with central sign-on, and an IT service company maintains the routers by remote access. Every six months the head of network operations reviews all access. The record can look like this, all details invented:

The record is the evidence that roles and rights are reviewed regularly. With date and signature, it belongs in the measures part of the security concept under Section 166 TKG. The MFA column shows at a glance where no. 10 is still open.

Three typical gaps

If you want to know where your company stands on the ten minimum measures as a whole, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.