Fixed-fee entry point
Status review (stage 1): where your company stands on telecom security in Germany
The status review shows, within a limited scope, how far your security concept and your measures are from the German Telecommunications Act (TKG) as it stands today, and what to tackle first. It is based on your documents and one interview, and we carry it out in English. If you order a revision of your security concept within 60 days of handover of the results, we credit the fixed fee once in full against it.
What the status review is for
Since 6 December 2025 the NIS2 obligations for telecom providers have been part of the TKG: ten minimum measures under Section 165(2a), duties of the management body, new reporting stages under Section 168 and registration with the Federal Office for Information Security (BSI) under Section 33 of the BSI Act (BSIG). The security concept under Section 166 TKG has to describe the measures for Section 165(1) to (7). A concept dated before December 2025 only covers the obligations in force since then if it has been updated.
Many small and mid-sized providers therefore do not know exactly how far their concept is from the law in force, and whether a revision or only the NIS2 implementation package is the right next step. The status review answers exactly this question before you commit to larger pieces of work.
If you already know that your concept needs revising, you do not need the status review. In that case, order the revision directly.
What you receive
You receive the results in writing and discuss them with us. The credit period starts on handover.
01
Classification
Your classification against the statutory criteria, with the areas of obligations your concept and measures should reflect, and open borderline cases clearly marked.
02
Gap table
For each check item, what your concept says and our assessment: covered, partly covered, missing or out of date.
03
List of measures
The open items with a priority and the right next step, whether in the concept, in a process or with management.
04
Reporting procedure template
Roles, reporting stages under Section 168 TKG and recipients as a template for you to adapt, with a German cover text for the authorities.
05
Recommended next step
Whether a revision, the NIS2 implementation package or no further service fits your situation.
06
Results meeting
We go through the results with you by video call and answer your questions.
Sample result: gap table of a fibre ISP
This is an extract from a gap table. The example is invented and does not relate to any client: a regional fibre ISP with 12 employees and annual turnover below EUR 10 million, an FTTH network in three municipalities, internet access and telephony. The security concept dates from 2019 and still follows Section 109 of the former TKG.
| Check item | Finding at the sample ISP | Assessment | Priority | Next step |
|---|---|---|---|---|
| Role | Operates its own FTTH network and provides publicly available services. Also Wi-Fi in two apartment buildings owned by a landlord. | Network operator; Wi-Fi in the apartment buildings open as a borderline case | medium | Have the Wi-Fi borderline case clarified by a lawyer |
| Classification under Section 28 BSIG and registration under Section 33 BSIG | fewer than 50 employees, turnover below EUR 10 million; not registered with the BSI | important entity on the criteria; registration missing | high | Register through the company account, with our support |
| Security officer and EU contact person | Security officer appointed, left in 2025; no EU contact person designated | missing | high | Fill the role again, designate the contact person |
| Security concept: description of network and services | second rollout area and telephony missing | out of date | high | Add to the concept, submission under Section 166(4) sentence 2 |
| Minimum measures, Section 165(2a) nos. 1 to 10 | Backup and access control described; supply chain, effectiveness assessment and MFA not | partly covered | high | Add missing measures to the concept, MFA for remote access first |
| Management body under Section 165(2b) to (2d) | no documented oversight, no training | missing | medium | Define the reporting line, plan training |
| Reporting route under Section 168 TKG | Reporting plan refers to the former reporting duty, BSI not mentioned | out of date | high | Reporting procedure to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, and the BSI with a 24-hour early warning, starting from the template |
| Implementation declaration | last declaration from 2019 | out of date | medium | Submit a new one with the revised concept |
Invented, shortened example with no link to any client. Assessments and priorities are illustrative and professional, not a legal assessment. The real gap table covers every check item that applies to your classification.
What we do in the status review
Five building blocks for one legal entity, based on your documents and one interview.
Which areas of obligations?
Classification
We classify your company against the statutory criteria (network or service, headcount, turnover and balance sheet total) and show which areas of obligations under the TKG and BSIG your security concept and list of measures need to reflect for this classification. Borderline cases, such as whether a service is publicly available, are flagged as open, with a recommendation to have them clarified by a lawyer.
NIS2 obligations for telecom providersWhat is missing from the concept?
Gap check of your security concept
Your existing concept checked against Section 166(1) TKG and the minimum measures in Section 165(2a) TKG: what is covered, what is missing and what is out of date.
Security concept under Section 166 TKGWhere to start?
Prioritised list of measures
The open items in an order you can work through, with a note on which of them belong in the security concept.
Protective measures under Section 165 TKGWho reports what, and by when?
Template for the reporting procedure
A template for your internal procedure for reporting under Section 168 TKG, with the reporting stages to the Bundesnetzagentur and the BSI, for you to adapt to your company, and a German cover text for the authorities.
Reporting security incidents under Section 168 TKGRegistered with the BSI?
Support with BSI registration
Where registration applies, support on the substance of registration under Section 33 BSIG. You register through your own company account.
Fixed fee and credit
The status review has a fixed fee per legal entity, for work in English. All amounts net of VAT:
| Service | up to 49 employees | 50 or more employees |
|---|---|---|
| Status review (stage 1) "NIS2 obligations status (telecom)" | EUR 4,900 | EUR 5,900 |
| for comparison: revision of the security concept under Section 166 TKG | EUR 9,900 | EUR 15,900 (50 to 249 employees) |
Credited once in full against a revision of the security concept if you order it within 60 days of handover of the results. It is not credited against the NIS2 implementation package ordered on its own. The fee level depends on the headcount of the contracting legal entity on the day of the order. Work by video call. The fixed fee for the status review applies from 50 employees with no upper limit, including for 5G networks. For a revision with 250 or more employees, for 5G networks and for several legal entities, we prepare an offer after reviewing your documents. Offered to businesses only.
How the status review works
Five steps from the first call to the handover of results.
1
Initial call
Network, services, headcount and existing documents. No obligation, by video call or phone.
2
Documents
You send us your security concept, the last implementation declaration and any letters from the Bundesnetzagentur.
3
Interview
One session with technical staff and management on network, services, suppliers and organisation.
4
Analysis
We classify your company, check the concept against the law in force, prioritise the open items and provide the template for the reporting procedure.
5
Handover
You receive the results in writing and discuss them with us. The credit period starts on handover.
The status review does not update your concept. It shows whether a revision or the implementation package is the right next step.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Professional assessment, not legal advice
The status review is a professional review of IT and telecom security. We classify your company against the statutory criteria and check your concept against the Act and the catalogue of security requirements. A binding legal assessment of your individual case is a matter for a lawyer admitted in Germany.
Where the classification depends on a legal question, such as whether Wi-Fi in an apartment building is a publicly available service, we record it as an open item in the results and recommend having it clarified by a lawyer.
What comes after the status review
If the status review shows that your concept needs revising, we bring it up to the law in force, prepare the implementation declaration and the submission, and answer one round of questions from the Bundesnetzagentur. If the concept already reflects the law in force but a worked-out reporting procedure, evidence for management or BSI registration is missing, the NIS2 implementation package fits. It works out the reporting procedure for your company, and the status review provides the template for it. Scope and fixed fees are on the page on the security concept under Section 166 TKG.
You are under no obligation to order a follow-up service from us. The results are written so that your team or another provider can continue working with them.
Our experience with telecom security
We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. We do not name clients.
What we need from you
Documents
The current security concept, the last implementation declaration and any letters from the Bundesnetzagentur.
Contacts
One person from engineering or operations and the management for the interview.
Key figures
Headcount of the legal entity, networks operated and services offered.
What is not included
The scope of the status review is limited so that the fixed fee applies. Not included:
- multiple legal entities or separate concepts per network
- on-site meetings, technical audits or scans
- revising the security concept or drafting a new one (on request)
- ongoing correspondence with the Bundesnetzagentur or the BSI
- legal advice and certified translations
- step-by-step instructions for registering in the BSI portal; these are available in German on https://nis2-readiness.de
Our classification is a professional, not a legal one. Whether an obligation applies in your case as a matter of law is a question for a lawyer admitted in Germany.
Frequently asked questions
Who is the status review for?+
For operators of public telecom networks and providers of publicly available telecom services in Germany who are not sure how far their security concept is from the law in force: fibre ISPs, municipal utilities with a telecoms arm, cable and Wi-Fi networks, regional carriers, VoIP and cloud telephony providers, including companies based outside Germany.
What if we do not have a security concept yet?+
Then there is nothing to check against, and the status review is usually not the right entry point. For a new concept we prepare an offer after an initial call.
How does the credit work?+
If you order a revision of your security concept within 60 days of handover of the results, we credit the fee for the status review once in full against it. It is not credited against the NIS2 implementation package ordered on its own.
What determines the fee level?+
The headcount of the legal entity placing the order, counted per person on the day of the order. Turnover, balance sheet total and the EU definition of small enterprises play no role in the fee.
Is the status review legal advice?+
No, it is a professional assessment. The distinction is explained above in the section "Professional assessment, not legal advice".
Why is the service called "NIS2 obligations status (telecom)"?+
That is its name in our letters to telecom providers. It refers to where your concept and your measures stand against the security obligations that have been in the TKG since December 2025. It is not a legal determination of your obligations.
Read more
- German Telecommunications Act (TKG): Telecom Security Services
- Section 166 TKG Security Concept: German Telecommunications Act
- NIS2 for Telecom Providers in Germany: TKG Duties, Registration
- Section 165 TKG: Protective Measures, Ten Minimum Measures
- Section 168 TKG: Reporting Security Incidents to BNetzA and BSI
- BNetzA Review of the Security Concept: Process, Evidence File
Sources
- Section 165 TKG: technical and organisational safeguards (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 166 TKG: security officer and security concept (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 168 TKG: reporting security incidents (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 28 BSI Act: essential and important entities (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 33 BSI Act: registration duty (gesetze-im-internet.de, German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Where does your security concept stand?
In an initial call we clarify whether the status review fits your situation or whether you are better off ordering a revision directly.