Security concept under Section 166 of the German Telecommunications Act (TKG)

This page is about the document itself: what a security concept under Section 166 of the German Telecommunications Act (Telekommunikationsgesetz, TKG) has to contain, how to structure it, how it is submitted and how to keep it current. Which obligations apply to your company overall, including the NIS2 rules transposed into the TKG, is explained on NIS2 for telecom providers in Germany.

Legal status: TKG as amended on 22 October 2026. Catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force, the draft version 2025-10 has not been adopted. Checked on 6 November 2026. This is general information, not legal advice. Whether and how an obligation applies to your company is a question for a lawyer admitted in Germany.

Who has to prepare and submit a security concept?

Anyone who operates a public telecommunications network or provides publicly available telecommunications services must prepare a security concept (Section 166(1) TKG). There is no size threshold, and the obligation does not depend on the classification under the German BSI Act. Only the submission differs:

The same section also requires a security officer and a contact person established in the European Union (Section 166(1) nos. 1 and 2 TKG), both explained on security officer under Section 166 TKG. The EU contact person applies to every provider, which matters most for companies based outside the EU that serve customers in Germany (see telecom providers based abroad).

What must the concept contain?

The statute sets three elements (Section 166(1) no. 3 TKG). The concept must show

1. which public telecommunications network is operated and which publicly available telecommunications services are provided,
2. which threats are to be expected, and
3. which technical and other protective measures have been taken or are planned to meet the obligations under Section 165(1) to (7) TKG as specified by the catalogue of security requirements.

Where the catalogue only sets a security objective, the concept must show that the measures achieve that objective in full. Catalogue 2.0 also requires one coherent document; oral statements or statements by telephone do not suffice.

Because the third element refers to Section 165(1) to (7), the concept has also had to cover the ten minimum measures of Section 165(2a) TKG since 6 December 2025 (our reading of the cross-reference). They apply to telecom providers that are important or essential entities under Section 28 of the BSI Act, which public network operators and providers of publicly available services are, with no lower size threshold. They range from risk analysis and incident handling to access control and multi-factor authentication, see protective measures under Section 165 TKG. The statute grants no transition period.

Which catalogue is the concept written against?

The benchmark is the catalogue of security requirements under Section 167 TKG, version 2.0 of 29 April 2020, which is still in force. It was set by the Bundesnetzagentur in agreement with the Federal Office for Information Security (BSI) and still cites the former Section 109 TKG. Its chapter 5 contains the authority's guidance on drafting the concept, and the outline below builds on it. Draft version 2025-10 has not been adopted (as of 6 November 2026). Once a new catalogue enters into force, it must be met within one year under Section 167(3) TKG unless it sets a different period. Structure and chapters of both versions are compared on catalogue of security requirements under Section 167 TKG.

Sample outline with an example chapter

Example, not a client: A fibre provider with 12 employees runs an FTTH network in three municipalities with two points of presence (PoP) and offers internet access and VoIP telephony. A contractor operates the voice platform, the customer portal runs in a data centre in Germany. Its concept dates from 2019 and still follows the former Section 109 TKG. The revised outline:

Example chapters 4.3 and 5 (extract): Looking at the overall system, both PoPs use the same upstream provider and the emergency power supply covers only one PoP. The measures part therefore includes these lines:

Outline and example are our own work based on chapter 5 of catalogue 2.0.

The implementation declaration

The concept must be accompanied by a declaration that the measures it sets out have been implemented or will be implemented without undue delay (Section 166(3) TKG). Catalogue 2.0 requires written form. The declaration turns the concept into a binding statement about the actual situation. A practical approach: mark every line of the measures part as implemented or planned with a date, so the declaration refers to a list that can be checked. We recommend that management signs it after the security officer has confirmed the status.

When must the concept be updated?

If the circumstances on which the concept is based change, the party obliged under subsection 2 must update it without undue delay and resubmit it to the Bundesnetzagentur, pointing out the changes (Section 166(4) sentence 2 TKG). This covers network operators and service providers that have been required to submit. In our assessment, typical triggers include a new PoP or coverage area, a new service, a change of data centre or of a contractor with network access, and a change in the law, most recently the NIS2 transposition on 6 December 2025.

How does the Bundesnetzagentur review the concept?

The Bundesnetzagentur regularly reviews the implementation of the concept, as a rule at least every two years (Section 166(5) TKG), and can require security deficiencies to be remedied without undue delay (Section 166(4) sentence 1 TKG). Failing to submit the concept, or submitting it incorrectly, incompletely or late, is an administrative offence with a fine of up to EUR 300,000 (Section 228(2) no. 38 TKG); there is no separate offence for preparing the concept or for the protective measures under Section 165 TKG. A mandatory audit by an independent body without an order currently applies only to 5G network operators (Section 165(9) TKG). How a review works, what applies to deficiencies and how to prepare evidence in a file is explained on the page review by the Bundesnetzagentur.

Reusing an ISO 27001 management system

Catalogue 2.0 allows measures to be defined on the basis of suitable standards, including DIN ISO/IEC standards, so much of an ISO/IEC 27001 management system can be reused. The catalogue does not provide for a certificate to replace the concept or the implementation declaration, and the network and service description, the mapping to the catalogue and reporting under Section 168 TKG have to be added. What can be reused and how the chapters of the catalogue map to Annex A of ISO/IEC 27001:2022 is shown on the page security concept under Section 166 TKG and ISO 27001.

"Section 109 TKG": the former provision

Until 30 November 2021, the security obligations of telecom companies were in Section 109 of the former TKG. The TKG 2021 entered into force on 1 December 2021 and split them across Section 165 (protective measures), Section 166 (security officer and security concept), Section 167 (catalogue of security requirements) and Section 168 (incident reporting). A concept still structured along the old Section 109 does not have to be rewritten, but it should be checked against what has been added since, above all Section 165(2a) to (2d) and Section 168 since December 2025.

Three common gaps

How we work

1. Review: existing concept, network plans and contracts, two interviews (up to 2 hours each) with management and engineering.
2. Network and services: network structure plan and service description following chapter 5 of the catalogue.
3. Threats and measures: threats per component and for the overall system, each measure mapped to the catalogue and Section 165(2a) TKG with status and evidence.
4. Declaration and submission: the finished concept with a German text for the authority and a prepared implementation declaration for your signature. You submit it to the Bundesnetzagentur.
5. Questions: we answer one round of questions from the Bundesnetzagentur on this version.

Fixed fees for revising your concept in English

Fees for work in English, per legal entity and concept, remote, net of VAT where due; EU businesses: reverse charge as a rule.

New concepts, companies with 250 or more employees and 5G networks on request. The fee depends on the headcount of the contracting legal entity on the day of the order. Before you place an order, we check free of charge whether your existing concept can be revised. Offered to businesses only.

The revision always reflects the law in force, because the concept has to describe the measures taken to meet Section 165(1) to (7) TKG (Section 166(1) no. 3 TKG). The NIS2 implementation package works out the procedures for this if you do not have them yet. The basis is the statute and the catalogue of security requirements on an agreed reference date; adapting the concept to a catalogue adopted later is a separate order. Work is done in English, with a German text for submission to the Bundesnetzagentur; support with BSI registration only where you have an establishment in Germany.

The round of questions covers our answer to one set of questions from the Bundesnetzagentur on this version, received within six months of delivery. Not included: on-site visits, technical audits, implementing the measures, further correspondence with authorities, the role of security officer, legal advice, certified translations. If you want to know where you stand first, start with the status review (stage 1). Its fee is credited once in full against a revision if you order it within 60 days of receiving the results. It is not credited against the NIS2 implementation package on its own.

Our experience

We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. Who is behind TKG-Readiness is explained on about us.