Technical and organisational safeguards under Section 165 TKG

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), each as amended on 22 October 2026, checked on 6 November 2026. This page covers what Section 165 TKG and the catalogue under Section 167 require. How to describe the measures in your security concept and submit it to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, is explained on the page security concept under Section 166 TKG. This is general information, not legal advice. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany.

Who has to meet which subsection of Section 165?

Section 165 addresses different groups in different subsections, from anyone who contributes to a telecommunications service up to 5G network operators. The table summarises the statutory text in short form.

Subsections 2a to 2d depend on the classification under Section 28 BSIG. Under Section 28(1) and (2) BSIG, operators of public telecommunications networks and providers of publicly available telecommunications services are at least important entities, with no lower size threshold. In our reading, the ten minimum measures therefore apply to practically everyone addressed by subsection 2. Classification and the duties of management under subsections 2b to 2d are covered on NIS2 for telecom providers in Germany.

What do subsections 1 and 2 require?

Subsection 1 requires appropriate precautions to protect the secrecy of telecommunications and to prevent breaches of personal data protection, taking the state of the art into account. It also covers companies that only contribute to providing a service, in our reading for example contractors in network operations.

Subsection 2 is the core rule for network operators and service providers. They must protect their telecommunications and data processing systems against disruptions that lead to significant impairments, including attacks from outside and disasters, and they must manage the risks to the security of networks and services. In particular, systems must be secured against unauthorised access, and the impact of security breaches must be kept as small as possible, where appropriate through encryption.

The yardstick is a level of security appropriate to the existing risk. The statute lists the state of the art, relevant European and international standards, the cost of implementation, risk exposure, the size of the provider and the likelihood, severity and impact of incidents. Subsection 6 adds that measures are appropriate if the effort is not out of proportion to the importance of the networks or services. A fibre provider with a few thousand lines therefore does not have to do what a nationwide mobile network operator does. It does have to be able to explain why its measures match its risk.

The ten minimum measures under Section 165(2a)

Subsection 2a requires the measures under subsection 2 to follow an all-hazards approach that protects network and information systems and their physical environment against incidents, and to include at least the ten points below. It has applied since 6 December 2025 without a transition period.

The table separates three things. The second column summarises the statutory duty. The third column is our professional recommendation: the statute names no type of evidence, so the documents listed are common examples, neither complete nor mandatory. The fourth column maps each measure to sections of the catalogue of security requirements in force. That mapping is ours as well, because catalogue 2.0 predates subsection 2a. For point 10 in particular, version 2.0 contains no general requirement for multi-factor authentication. It only recommends stronger authentication for end customers in annex 1, so the duty comes from the statute. A worked example follows further down.

The measures belong in the security concept: Section 166(1) no. 3 TKG requires the concept to set out the measures taken to meet Section 165(1) to (7), which in our reading has included subsection 2a since 6 December 2025.

What do the other subsections cover?

Attack detection (subsection 3): network operators and service providers may use attack detection systems as defined in Section 2 no. 41 BSIG. They are mandatory only with increased threat potential, and must then detect threats through continuous, automatic recording and analysis.

Critical components (subsection 4): network operators with increased threat potential may only use critical components that a recognised certification body has tested and certified before first use. The basis is the BSI technical guideline TR-03163, the deadline for each component falls on 1 January 2026 at the earliest, and components already in use do not have to be recertified. The list of critical functions, the deadlines and Section 41 BSIG are explained on the page critical components in telecommunications.

Shared sites (subsection 7): where sites or technical facilities are shared, every party has the duties under subsections 1 to 5 unless they can be assigned to one party. For cooperations, open access models and colocation it pays to allocate responsibilities in writing.

Orders and audits (subsections 8 to 11): after an incident or in case of significant danger, the BNetzA can order measures and set deadlines. It can require any network operator or service provider to undergo an audit by a qualified independent body or a competent national authority. Network operators with increased threat potential must undergo this audit every two years at their own cost. The BNetzA assesses deficiencies in the security concept in agreement with the BSI.

Increased threat potential currently applies, under the BNetzA's general ruling in force, only to operators of public 5G mobile networks with a frequency assignment. Subsection 3 sentence 2, subsection 4 and subsection 9 sentence 2 do not currently apply to a fibre provider, the telecoms arm of a municipal utility or a VoIP provider.

The catalogue under Section 167 in brief

The BNetzA sets the details of the measures under Section 165(1) to (7) in the catalogue of security requirements under Section 167 TKG, in agreement with the BSI and the Federal Commissioner for Data Protection and Freedom of Information (BfDI). Version 2.0 of 29 April 2020 is in force, and draft version 2025-10 has not been adopted (as of 6 November 2026). Structure, requirements per chapter and the comparison with the draft are on the page catalogue of security requirements under Section 167 TKG.

The draft TKG Amendment Act 2026

The federal government's draft amendment act (Bundestag printed paper 21/8277) would change Section 165 in four places, among them tying the attack detection duty to essential entities and certification of critical components in the core network to network operators that are essential entities, and limiting the mandatory audit under subsection 9 to 5G network operators, every three years, by the BSI or a body it designates. First reading was on 9 October 2026, the committee hearing on 4 November 2026, and the act has not been adopted (as of 6 November 2026). This page describes the law in force. The state of the procedure and a comparison of the law in force with the draft are on the page TKG Amendment Act 2026.

Example: evidence table for a fibre provider

Example, not a client. A regional fibre provider with 12 employees and annual turnover below EUR 10 million runs an FTTH network in several municipalities and offers internet access and telephony. Night-time on-call duty for the network is outsourced to a contractor, and the data centre for the core network and customer systems is rented. The provider is an important entity under Section 28(2) BSIG, so subsection 2a applies. It does not have increased threat potential.

Its evidence table could look like this, one line per measure, all details invented:

The table shows at a glance where evidence is missing and is the basis for the measures part of the security concept under Section 166 TKG.

A blank version with all subsections of Section 165 and the sections of catalogue 2.0 is available as an Excel checklist (in German) on the page templates for telecom providers.

Three common gaps

If you want to know where your company stands on the protective measures, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.