ISO 27001 ISMS and security concept under Section 166 TKG: what fits, what is missing

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026. Catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force, the draft version 2025-10 has not been adopted. Standards: ISO/IEC 27001:2022, ISO/IEC 27011:2024. Checked on 6 November 2026. This is general information, not legal advice. Whether your concept meets the requirements in a specific case is a question for a lawyer admitted in Germany.

This page is for telecom providers in Germany, including international groups with a German network or service, that already run an information security management system under ISO/IEC 27001 or are building one and want to base their security concept under Section 166 TKG on it. How the concept as a whole is structured, explained and submitted is covered on security concept under Section 166 TKG, and what the catalogue requires chapter by chapter on catalogue of security requirements under Section 167 TKG.

Does an ISO 27001 certificate replace the security concept?

No. Neither catalogue 2.0 nor draft 2025-10 provides that a certificate under ISO/IEC 27001 replaces the security concept, the implementation declaration or the review by the Bundesnetzagentur (BNetzA), the German Federal Network Agency. We searched both documents in full for “Zertifikat” (certificate), “27001”, “ISMS” and “anerkannt” (recognised) and found no such rule. In our reading, three duties therefore remain in their own right:

• the concept under Section 166(1) no. 3 TKG covering network and services, threats and protective measures, as one coherent document,
• submission to the Bundesnetzagentur: for network operators without undue delay once network operation starts, for service providers on request (Section 166(2)), and again when circumstances change (Section 166(4) sentence 2),
• the declaration that the measures have been implemented or will be implemented without undue delay (Section 166(3)), in writing under the catalogue.

In the energy sector the standard is more closely tied in: there, ISO/IEC 27001, 27002 and 27019 form the basis of the IT security catalogues. Neither Section 5c of the Energy Industry Act (EnWG) nor Sections 165 to 167 TKG provide for one regime to count towards the other. What this means for a municipal utility with a telecoms business is covered on municipal utilities with a telecoms business.

What does the catalogue say about standards such as ISO 27001?

Catalogue 2.0 expressly allows standards as a basis for the measures. Chapter 5.1.6 states that a company is in principle not obliged to define its protective measures on the basis of its own analysis. They can also be defined on the basis of suitable standards, and the chapter names standards of the Federal Office for Information Security (BSI), the IT-Grundschutz methodology and DIN ISO/IEC standards. The bibliography lists ISO/IEC 27001 and 27002, each in the German edition of 2017.

Draft 2025-10 goes further: its security objectives and measures are said to be derived from existing standards that can be used for implementation. The overview names ISO 27001/27002 and ISO 22301, among others. At the same time, the IT-Grundschutz of the BSI is to form the basis there and be taken into account for all security objectives. The draft has not been adopted.

In our reading, chapter 5.1.6 allows the selection of measures to be based on a standard. The other contents of the concept remain: the description of network and services, the threats and the explanation of how the measures meet the duties under Section 165 TKG as specified in the catalogue. Where the catalogue only sets a security objective, Section 166(1) no. 3(c) requires an explanation that the measures achieve the objective in full.

What can be reused from the ISMS?

In our assessment, these building blocks of an established ISMS can mainly be reused, provided its scope includes the network and services:

• Risk method and risk register (ISO/IEC 27001 clauses 6.1.2, 6.1.3, 8.2, 8.3) as the basis of the specific threat analysis under catalogue 2.0 chapter 5.1.4.
• Inventory of assets (Annex A 5.9) as the starting point for the network structure plan under chapter 5.1.1 and asset management under chapter 3.4.3.
• Statement of applicability (clause 6.1.3 d) as the list of measures with implementation status, which the concept then maps to the chapters of the catalogue.
• Policies and evidence on access, changes, suppliers, personnel, logging and backup.
• Incident and emergency processes (Annex A 5.24 to 5.30) as the basis for chapters 3.5 and 3.6 of the catalogue.
• Internal audits and management review (clauses 9.2, 9.3) for the regular assessment of measures under chapter 3.8 and the review of the concept under chapter 5.1.10.

What is the ISMS missing for the concept?

ISO/IEC 27001 knows neither the TKG nor the Bundesnetzagentur. The concept therefore needs these additions:

1. Network and service description under Section 166(1) no. 3(a). Catalogue 2.0 normally expects a network structure plan with five structural elements: systems, connections between them, external connections, size and type of the network, geographical extent. In addition, every publicly available service with its group of subscribers.
2. Criticality classification under chapter 5.1.3: standard, elevated (indicator: more than 100,000 subscribers) or increased (currently only 5G).
3. Telecom-specific requirements for which Annex A has no control of its own. One is the protection of the secrecy of telecommunications and of traffic data (chapter 4 of the catalogue). It is still worded along the sections of the TKG 2004, today mainly Section 3 of the Telecommunications Digital Services Data Protection Act (TDDDG) and Sections 165 to 169 TKG. The other, for providers with their own IP infrastructure, is annex 1 with protection against DoS and DDoS attacks, inter-domain routing, DNSSEC and reachability of emergency numbers over VoIP.
4. Mapping to the catalogue: every measure with a reference to the chapter of the catalogue, not only to its number in Annex A.
5. Reporting channels: significant security incidents under Section 168 TKG to the Bundesnetzagentur and the BSI, personal data breaches under Section 169 TKG. An ISO incident process does not cover these recipients and deadlines by itself. Details are on incident reporting under Section 168 TKG.
6. Roles under Section 166(1): security officer and EU contact person. In our reading, an information security officer can take on the role if appointed to it. The distinction is explained on security officer under Section 166 TKG.
7. Implementation declaration and submission: in writing, signed, submitted to the Bundesnetzagentur with the concept.

Mapping: catalogue 2.0 and ISO/IEC 27001:2022 Annex A

As far as our research shows, the Bundesnetzagentur has not published a mapping between the catalogue of security requirements and ISO/IEC 27001 (as of 6 November 2026). The table below is our own mapping, meant as a working aid. It follows chapter 3 of catalogue 2.0, which applies to everyone with obligations, and lists the clauses and controls of ISO/IEC 27001:2022 by number (Annex A has 93 controls in four themes; names paraphrased here, catalogue chapter titles shortened). Matching numbers do not mean the content is identical. Check the catalogue text for what it requires in detail.

Fictitious example, not a client. A municipal utility runs an FTTH network with two network nodes alongside its electricity grid and offers internet access and telephony. Its ISO/IEC 27001 ISMS is certified for the electricity grid, and the fibre network is outside the scope. The last column shows what the utility can reuse for the concept of its telecoms business and what is missing. All details are invented:

In the example, the utility can largely reuse its method, processes and policies. It has to write new material for the network and service description, the threat analysis and measures for the fibre network, the telecom reporting channels, the appointment of the security officer and the implementation declaration. In our assessment it makes sense to extend the scope of the ISMS to the fibre network at the next revision, so the utility keeps risks and evidence in one place.

What about ISO/IEC 27011?

ISO/IEC 27011 is a guideline for implementing information security controls in telecommunications organisations based on ISO/IEC 27002. The edition in force is edition 3 of March 2024 (ISO/IEC 27011:2024). The 2016 edition has been withdrawn and should no longer be cited as the current standard. According to the abstract, the aim is for telecommunications organisations to meet baseline requirements for confidentiality, integrity and availability. The abstract says nothing about recognition by authorities. Neither the TKG nor catalogue 2.0 or draft 2025-10 mentions ISO/IEC 27011. In our reading it can help with telecom-specific implementation, but it is not required.

Three typical gaps

Four steps

1. Compare the ISMS scope with the network and services covered by the TKG.
2. Using the table above, record for each chapter of the catalogue what comes from the ISMS and what is missing.
3. Close the gaps: network and service description, telecom threats, measures, reporting channels, roles under Section 166(1).
4. Draw up the concept as one coherent document, sign the implementation declaration, submit. From then on, review the concept in the ISMS cycle of audit and management review and adapt it when things change.

If you want to introduce an ISMS first, see ISO 27001 consulting on www.blackfort-tec.de. How ISO 27001 relates to the NIS2 duties under the BSI Act is covered by our sister site nis2-readiness.de (in German).

We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. Revising a concept for a fixed fee is described on security concept under Section 166 TKG.