Security Officer under Section 166 TKG: Tasks and Appointment

Last updated: 2026-11-06

This page covers the two mandatory roles in Section 166 of the German Telecommunications Act (Telekommunikationsgesetz, TKG). The document the security officer looks after is explained on the page security concept under Section 166 TKG.

Legal status: TKG as amended on 22 October 2026. Catalogue of security requirements under Section 167 TKG: version 2.0 of 29 April 2020 is in force, the draft version 2025-10 has not been adopted. Checked on 6 November 2026. This is general information, not legal advice. How the roles are to be filled in your company is, where in doubt, a question for a lawyer admitted in Germany.

Who has to appoint a security officer?

Anyone who operates a public telecommunications network or provides publicly available telecommunications services must appoint a security officer (Section 166(1) no. 1 TKG). There is no size threshold, and the duty applies to network operators and to service providers without their own network alike. According to the catalogue of security requirements, version 2.0 (chapter 5.1.8), the appointment is not part of the security concept itself, but like the concept it has to be in place when operation of the network or the service starts.

The same provision requires a contact person established in the European Union (Section 166(1) no. 2 TKG). This duty, too, applies to every obligated provider, not only to companies based abroad. The German wording distinguishes the two acts: the security officer is "bestimmt" (appointed internally), the contact person is "benannt" (named).

What does the security officer do?

The TKG does not describe any tasks. Catalogue 2.0 states that the security officer should have coordination, control and specialist tasks, among others, and that the security officer or a named deputy should also be the contact for the Bundesnetzagentur. In our assessment, the following tasks follow from this in practice:

Task	In practice	Basis
Maintain the security concept	Check changes to network, services and contractors, update the concept and prepare resubmission	Section 166(4) sentence 2 TKG
Prepare the implementation declaration	Confirm the status of each measure before management signs	Section 166(3) TKG
Contact for the Bundesnetzagentur	Answer questions on the submission, accompany the review of implementation	Section 166(5) TKG, catalogue 2020 ch. 5.1.8
Coordinate security incidents	Assess incidents and trigger the report to the Bundesnetzagentur and the Federal Office for Information Security (BSI), see incident reporting under Section 168 TKG	Section 168 TKG
Check the measures	Test effectiveness, collect evidence, report deviations to management	catalogue 2020 ch. 5.1.8 and 5.1.10
Keep management informed	Regular report so that management can meet its duty to implement and oversee the measures	Section 165(2b) TKG, see NIS2 for telecom providers in Germany

Responsibility for the protective measures stays with the company. Under Section 165(2b) TKG, management has to implement the measures and oversee their implementation. The security officer supports management in this and does not take the duty over.

Three roles compared. Security officer: basis Section 166(1) no. 1 TKG, duty for every telecom provider, tasks according to the catalogue: coordination, control, contact for the Bundesnetzagentur. EU contact person: basis Section 166(1) no. 2 TKG, duty for every telecom provider, established in the European Union. Information security officer: no role under the TKG, runs the ISMS of the whole company. — Tap the graphic to open it at full size.Security officer, EU contact person and information security officer compared. Sources: Section 166(1) TKG; catalogue of security requirements version 2.0 (29 April 2020), chapter 5.1.8; information security officer as our own classification. Own illustration.

What does the person need to bring?

Catalogue 2.0 describes requirements for the role, not a qualification. The person should have the necessary expertise and understand how the company works. Their knowledge of developments in IT security, of internal processes and of the legal framework must be kept up to date, and the conditions for direct contact with company management must be in place. Chapter 5.1.8 names no specific training or certification.

In our assessment, this means for the choice of person:

They know the network and services well enough to judge the security impact of a change.
They have time for the role, with a fixed budget, and a deputy, so the Bundesnetzagentur has a contact during holidays as well.
They can report to management at any time and have access to network documentation, contracts and change planning.
They keep up to date, for example on changes to the TKG and to the catalogue of security requirements.

Internal or external?

Neither Section 166 TKG nor catalogue 2.0 says expressly whether the security officer has to be an employee. An external appointment is therefore not ruled out, though it is not expressly permitted either. In both cases the catalogue's description applies: knowledge of the company's processes and direct contact with management. The comparison below is our own assessment:

	Internal	External
Knowledge of network and processes	there from day-to-day work	has to be built through fixed meetings, access to documentation and an internal contact
Expertise on the TKG, the catalogue and the Bundesnetzagentur	has to be built and kept current	should come with the service provider
Independence in control tasks	difficult if the person also runs network operations	more likely, as long as the provider has no operational tasks
Availability and deputy	small teams often have only one person	can be agreed by contract
Effort	working time and training of an own employee	fee for a fixed volume of hours

A mixed model is often worth considering: an internal deputy from network operations who knows the daily routine, and an external security officer who looks after the concept, contact with the authority and the control tasks.

Security officer under the TKG and information security officer

The security officer under Section 166 TKG is a statutory role for the security of telecommunications networks and services, with the Bundesnetzagentur as counterpart. An information security officer (ISO) runs the information security management system of the whole company and has no place in the TKG. One person can hold both roles. The role of an information security officer is described on the page external information security officer on www.blackfort-tec.de.

The EU contact person

Section 166(1) no. 2 TKG requires a contact person established in the European Union. The statute says nothing more, not even whether the security officer may also be the contact person. For a company based in Germany, the duty is usually met by a person from its own staff who is listed with contact details in the concept. Providers based outside the EU need a person or office within the EU; what else applies to them is set out on the page for telecom providers based abroad.

Example: appointment template for a fibre provider

Example, not a client, all names invented: Example Fibre GmbH has 12 employees and runs an FTTH network with internet access and VoIP. The head of network operations takes the role, a network technician is her deputy. The template is a working aid, not an official form. Employment law questions, such as the job description or works council participation, have to be clarified case by case.

Field	Entry
Company	Example Fibre GmbH, Musterstraße 1, 12345 Beispielstadt; operator of a public telecommunications network and provider of publicly available telecommunications services
Legal basis	Appointment under Section 166(1) no. 1 TKG, naming under Section 166(1) no. 2 TKG
Security officer	Anna Beispiel, head of network operations, phone and e-mail of the function (security@…), not a personal address
Deputy	Jonas Muster, network technician
Tasks	Maintaining the security concept and preparing resubmission, preparing the implementation declaration, contact for the Bundesnetzagentur, coordinating security incidents including reports under Section 168 TKG, checking the measures, reporting to management
Powers	Right to report to management at any time, access to network documentation, contracts and change planning, involvement in every security-relevant change to network, services and contractors
Time and training	4 hours per week; training on the TKG and the catalogue at least once a year
Reporting line	Quarterly report to management, immediately in case of a security incident
EU contact person	Max Beispiel, managing director, address as above
Valid from	1 December 2026; staffing reviewed every year and whenever a person leaves
Signatures	Management (appointment), security officer (acknowledgement and acceptance)

Section 166 TKG does not require the appointment to be notified separately to the Bundesnetzagentur. We recommend listing the security officer, the deputy and the EU contact person in chapter 1 of the security concept and updating the entries with every change.

The appointment template with this example is available as a Word file (in German) on the page templates for telecom providers.

Three common gaps

Gap	Cause	Effect	Remedy
Role on paper only	Appointment without time budget or powers	Concept and evidence go out of date, questions from the Bundesnetzagentur stay unanswered	Set time budget, right to report and reporting line in writing
No deputy	Small team, the role depends on one person	No contact during holidays, illness or after a resignation, not even for a reportable incident	Appoint a deputy, document the handover, use contact details of the function instead of personal addresses
Change of person not reflected	Staff change without updating the concept and contact details	The concept names someone who has left the company	Staffing as a check item in the annual review of the concept and in the leaver process

Is there a fine if no security officer is appointed?

Section 228 TKG contains no separate offence for a missing security officer or a missing EU contact person. The duty under Section 166(1) TKG applies all the same. Without the role, nobody is responsible for the security concept, its updates and the contact with the Bundesnetzagentur. The offences relating to submission of the concept are explained on the page security concept under Section 166 TKG.

External telecom security officer: our service on request

For network operators and service providers that do not want to fill the role internally, we take it on as external telecom security officer. The mandate covers:

the mandatory role under Section 166(1) no. 1 TKG, named as contact for the Bundesnetzagentur,
updating the security concept after changes and preparing resubmission,
preparing and accompanying the review by the Bundesnetzagentur under Section 166(5) TKG,
readiness to report security incidents under Section 168 TKG together with your operations team,
organising the regular training of management under Section 165(2d) TKG,
adapting the concept to the new catalogue of security requirements once it has been adopted.

Responsibility for implementing the protective measures stays with the company and its management. We agree scope and term according to size and network, and we quote on request. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.

If the concept has to be revised first, see the page security concept under Section 166 TKG. An overview of our services is on the home page, and the entry point is the status review (stage 1).

Frequently asked questions

Does the duty also apply to very small providers?+

Yes. Section 166(1) TKG has no size threshold. Every operator of a public telecommunications network and every provider of publicly available telecommunications services must appoint a security officer and name an EU contact person.

May the managing director be the security officer?+

The statute does not rule it out. Catalogue 2.0, however, gives the security officer control tasks and direct contact with company management. If management holds the role itself, that check is missing. In our assessment, this is acceptable in very small companies if a deputy is appointed and the measures are reviewed from outside at regular intervals.

Does the security officer have to be notified to the Bundesnetzagentur?+

Section 166 TKG does not require a separate notification. Under catalogue 2.0, however, the security officer or the deputy should be the contact for the Bundesnetzagentur. We recommend naming both with contact details in the security concept, which network operators submit anyway.

Does a provider based outside the EU need an EU contact person?+

Yes. Section 166(1) no. 2 TKG requires every obligated provider to designate a contact person established in the European Union. For a provider outside the EU, this means naming a person or office within the EU. Further duties of providers based abroad are covered on the page for telecom providers based abroad.

Is the security officer under the TKG the same as an information security officer?+

No. The security officer under Section 166 TKG is a statutory role for the security of telecommunications networks and services, with the Bundesnetzagentur as counterpart. An information security officer runs the ISMS of the whole company. One person can hold both roles.

Sources

Section 166 TKG: security officer and security concept (gesetze-im-internet.de, German) (retrieved 2026-11-06)
Section 165 TKG: technical and organisational safeguards, subsections 2b and 2d on management (gesetze-im-internet.de, German) (retrieved 2026-11-06)
Section 228 TKG: fines (gesetze-im-internet.de, German) (retrieved 2026-11-06)
Bundesnetzagentur: catalogue of security requirements version 2.0, 29 April 2020, ch. 5.1.8 (PDF, German) (retrieved 2026-11-06)
Bundesnetzagentur: catalogue of security requirements, overview page (German) (retrieved 2026-11-06)

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).

Appointing a security officer under the German Telecommunications Act (TKG)