Maintaining operations under Section 165(2a) no. 3 TKG: recovery and backup power

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, catalogue of security requirements version 2.0 of 29 April 2020, checked on 6 November 2026. This page looks in depth at one of the ten minimum measures. The overview of all of them is on the page protective measures under Section 165 TKG. This is general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany. Quotations from German statutes and from the catalogue of security requirements on this page are our own unofficial translations. Only the German text is legally binding.

What does Section 165(2a) no. 3 TKG require?

The provision names three elements: “maintaining operations, such as backup management and recovery after an emergency, and crisis management”. It applies to operators of public telecommunications networks and providers of publicly available telecommunications services that are essential or important entities under Section 28 of the BSI Act (BSIG), which in our reading means practically every telecom provider (classification on the page NIS2 for telecom providers). Subsection 2a also requires an all-hazards approach that protects the physical environment of the systems as well. Power failure, fire, flooding and cable damage are therefore covered just as much as a cyber attack.

Two other subsections of Section 165 have supported this for some time. Under subsection 2, network operators and service providers must protect their systems against disruptions that lead to considerable impairment, including disruptions caused by attacks and disasters. Under subsection 5, every network operator must ensure the proper operation of its network and so the continuous availability of the services. Separately, Sections 184 to 190 TKG govern emergency preparedness in telecommunications for large-scale emergencies. Its duty to ensure services under Section 185(1) applies to service providers with more than 100,000 contracting parties and to the network operators whose network is needed for these services.

What does catalogue 2.0 in force require?

Chapter 3 of catalogue 2.0 is mandatory for all obliged companies. Four sections are relevant to maintaining operations:

Catalogue 2.0 also grades networks and services by criticality. Above 100,000 subscribers it presumes elevated criticality. Measures against considerable disruption from natural disasters, serious accidents, sabotage and terrorist attacks are then added, expressly including emergency preparedness measures. Most regional providers are below this level.

What would draft version 2025-10 change?

The draft of the new catalogue (version 2025-10) has not been adopted (as of 6 November 2026), and catalogue 2.0 continues to apply. The draft would grade the requirements by a new threat potential in three levels, with measures in categories a), b) and c). This classification does not apply today (details on the page catalogue of security requirements under Section 167 TKG). For maintaining operations, these points would be new above all:

The Bundesnetzagentur (BNetzA), the German Federal Network Agency, itself states in the explanatory notes that for companies with normal threat potential the draft still stays below the 3-2-1 rule for backups (three copies, two storage media, one copy off site). For setting up emergency management, the draft refers to BSI Standard 100-4 of the Federal Office for Information Security (BSI).

Backup power and network outages: what matters in a telecom network

Catalogue 2.0 requires protection against power failure, but no particular technology and no minimum runtime. How long a network node has to run without mains power is something you set from your risk analysis. From category b), the draft would expressly require this extent to be defined. In our professional view, planning should cover:

• Runtimes per site: How long do batteries bridge network nodes, distribution points and the core network? Is there a generator or a connection point for a mobile backup power unit?
• External dependencies: Customers' terminal equipment runs on household power. In a wide-area power cut, the customer side is disconnected even if the network node keeps running. This belongs in communication with customers and authorities.
• Cooling: If the equipment runs on backup power but the air conditioning does not, temperature limits the runtime.
• Fuel and access: Who refuels a generator after how long, and who can get into the site during a power cut if the locking system is electric?
• Testing under load: Catalogue 2.0 requires backup power systems to be checked regularly and tested where possible. A test without load says little about the actual runtime.

In a telecom network, backup is about more than servers. Configurations of routers, OLTs and session border controllers, the provisioning of customer lines and the customer database all have to be restorable after an outage or an attack. Whether an outage has to be reported as a significant security incident is explained on the page incident reporting under Section 168 TKG. If remote maintenance is the only way to reach the network elements in an emergency, it belongs in the plan too, see access to network elements.

Example: recovery plan for the telecoms arm of a municipal utility

Fictitious example, not a client. Alongside electricity and water, a municipal utility (Stadtwerk) runs a fibre network with around 6,000 connections. The equipment sits in two network nodes, the core network and the customer systems in the utility's data centre. The telecoms arm offers internet access and telephony itself. Scenario: power cut in the supply area, network node 1 is running on battery. The recovery plan could look like this, all figures invented:

The plan also sets out the emergency officer and their deputy, the crisis management team with contact details, a printed copy of the emergency manual in both network nodes, and communication with customers and the Bundesnetzagentur. Rows 2 and 5 show the open points, and the next exercise should start there. The other divisions follow their own rules: the power grid falls under Section 5c of the Energy Industry Act (EnWG) with the IT security catalogue, the drinking water supply in our reading under the BSI Act, see municipal utilities with a telecoms arm.

Three typical gaps

If you want to know where your company stands on the ten minimum measures as a whole, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.