Last updated: 2026-11-06
Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG) as amended on 22 October 2026, checked on 6 November 2026. All templates are version 1.1 of 6 November 2026. Their content comes from the topic pages of this website, and each file names its source. The templates are general working aids. They are not legal advice, not an official form and not proof that a duty has been met. Whether and how a duty applies to your company is a question for a lawyer admitted in Germany. We have prepared the templates with care, but we give no warranty as to their completeness or suitability in an individual case. Adapt the template to your company and, before using it, check whether a newer version is available on this page. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.
You may use and adapt the templates within your own company. Publication or resale is not permitted.
Why are the templates in German?
The files are available only in German because their field names follow the wording of the German statutes. We therefore do not offer English versions of the files. This page describes the sheets and fields in English and gives the German labels in brackets, so that you can find your way around the files. The links below lead to the same files as the German page.
Which templates are available?
Four, each for a duty that small and medium-sized telecom providers often start with:
| Template | Format | Purpose | Instructions |
|---|---|---|---|
| Checklist of protective measures under Section 165 TKG | Excel, German | Duties under Section 165 subsection by subsection, evidence, mapping to the catalogue of security requirements | protective measures under Section 165 TKG |
| Appointment of the security officer and EU contact person | Word, German | Designation and appointment under Section 166(1) nos. 1 and 2 TKG | security officer under Section 166 TKG |
| Internal reporting procedure under Sections 168 and 169 TKG | Excel, German | Roles, deadlines, reporting route, deadline calculator, log and exercise script | incident reporting under Section 168 TKG and data breach notification under Section 169 TKG |
| Role check | Excel, German | Clarify whether and in which role you are a telecom provider, with reasons | Am I a telecom provider? |
Checklist of protective measures under Section 165 TKG
The checklist puts each duty from Section 165 TKG in a row of its own, with the group of obliged parties under the Act, suitable evidence and the mapping to the catalogue of security requirements version 2.0 of 29 April 2020, which is in force. It names the draft version 2025-10 only for information, as it has not been adopted. You enter whether the row applies to you, how you implement it and where the evidence is kept.
Download the Section 165 TKG checklist (Excel, German, version 1.1, as of 6 November 2026)
- Notes (Hinweise): version, legal status, catalogue status, instructions in five steps, how to read the columns, a note that Section 228 TKG does not list Section 165.
- Section 165 (§ 165): 29 rows from subsection 1 to subsection 9, the ten minimum measures under subsection 2a individually, no. 10 in three rows.
- Catalogue 2.0 chapter 3 (Katalog 2.0 Kapitel 3): for each section 3.1.1 to 3.9 the main requirements in short form, plus annex 1 for providers with their own IP infrastructure.
- Example (Beispiel): evidence table of a fictitious fibre ISP with 12 employees.
Preview of the columns in the “§ 165” sheet:
| Column | Content | Type |
|---|---|---|
| ID, reference (ID, Fundstelle) | Serial number (165-01 to 165-29), subsection, sentence, number | preset |
| Statutory duty (Gesetzliche Pflicht) | Short wording, for example “concepts for risk analysis and information system security” | preset |
| Who is obliged (Verpflichtet ist) | Group of obliged parties under the Act, for example “only with increased threat potential, today only 5G network operators” | preset |
| Applies to us (Gilt für uns) | Selection: yes, no, check | input |
| Professional recommendation: suitable evidence (Fachliche Empfehlung: geeignete Nachweise) | Common documents, neither complete nor mandatory | preset |
| Catalogue 2.0 section, draft catalogue 2025-10 section (Katalog 2.0 Abschnitt, Katalogentwurf 2025-10 Abschnitt) | Our mapping; the draft for information only | preset |
| Implementation, evidence, responsible (Umsetzung, Nachweis, Verantwortlich) | Free text | input |
| Status | Selection: implemented, partly, open, not applicable | input |
| Next review, remarks (Nächste Überprüfung, Bemerkung) | Date, free text | input |
Instructions and explanation of the minimum measures: protective measures under Section 165 TKG.
Appointment of the security officer and EU contact person
The Word template records whom management designates as security officer and whom it appoints as contact person established in the EU, with tasks, powers and signatures. You replace the completion notes in grey with your own details, and page 2 shows a completed example.
Download the appointment under Section 166 TKG (Word, German, version 1.1, as of 6 November 2026)
Preview of the fields:
| Field | Completion note |
|---|---|
| Company (Unternehmen) | Company name, address, role as network operator and/or service provider |
| Legal basis (Rechtsgrundlage) | Designation under Section 166(1) no. 1 TKG, appointment under Section 166(1) no. 2 TKG (preset) |
| Security officer, deputy (Sicherheitsbeauftragte(r), Stellvertretung) | Name, function, telephone and e-mail of the function |
| Tasks, powers (Aufgaben, Befugnisse) | With a suggestion, for example maintaining the security concept, coordination during security incidents, right to report to management |
| Time budget and training, reporting line (Zeitbudget und Fortbildung, Berichtsweg) | Hours per week, training cycle, reporting to management |
| EU contact person (EU-Ansprechpartner) | Name, function, address in the European Union |
| Valid from, signatures (Gültig ab, Unterschriften) | Date, review of the appointment, signatures of management and the security officer |
Instructions, requirements for the person and the question of internal or external: security officer under Section 166 TKG.
Internal reporting procedure under Sections 168 and 169 TKG
The Excel template brings together what must be at hand in an emergency: who assesses, who approves and who reports, which report is due by when, and which reporting route applies if personal data are also affected. The deadline calculator works out the latest dates from the time of becoming aware.
Preview of the sheets:
| Sheet | Content |
|---|---|
| Roles (Rollen) | Network operations on call, security officer, management, data protection officer, customer service, each with task and deputy; you enter name and contact details |
| Deadlines (Fristen) | Up to five reports under Section 168 to the Bundesnetzagentur (BNetzA), the German Federal Network Agency, and the Federal Office for Information Security (BSI), initial report, second report, notification and register under Section 169 |
| Reporting route (Meldeweg) | Decision tree in six questions on Section 169, Article 33 GDPR and Section 168, with a column for the answer in the case at hand |
| Deadline calculator (Fristenrechner) | Enter the time of becoming aware; the latest dates for 24 hours, 72 hours and one month are calculated |
| Log (Protokoll) | Date and time, event, role, decision or result, initials |
| Exercise script (Übungsdrehbuch) | Tabletop exercise for a fictitious VoIP provider with times and questions for the exercise |
Instructions: incident reporting under Section 168 TKG for security incidents and data breach notification under Section 169 TKG for the reporting route where personal data are involved.
Role check: am I a telecom provider?
The role check takes you through the definitions in Section 3 TKG and records, for the network and each product, which role you have and why. The “reasons” column (Begründung) matters most: if you are asked, it shows how you reached your decision.
Download the role check (Excel, German, version 1.1, as of 6 November 2026)
Preview of the columns in the “Rollenprüfung” sheet:
| Column | Content |
|---|---|
| Step (Prüfschritt) | Network, whether the network is public, one row per product, borderline cases, whether the notification under Section 5 is up to date, consequences of the role, approval |
| Guidance (Hinweis zur Prüfung) | Questions to ask, for example “Do we provide the service ourselves or only contribute to it?” |
| Answer, reasons (Antwort, Begründung) | Your details with the reference in the TKG |
| Internal evidence (Beleg im Haus) | Network plan, customer contract, wholesale contract |
| Result (Ergebnis) | Network operator, service provider, subject to notification, open |
There is also a sheet with the definitions in Section 3 TKG and questions to ask, and a sheet with the completed example of a fibre ISP. Instructions and borderline cases: Am I a telecom provider?.
In which order should you use the templates?
Our recommendation is the role first, then the people, then the measures and the emergency:
- Role check: it shows which duties apply at all.
- Appointment: the security officer maintains the other templates.
- Section 165 checklist: it shows which measures are implemented and backed by evidence.
- Reporting procedure: it is filled in with names and rehearsed once a year.
If you would rather start with an outside assessment of where your company stands, the status review (stage 1) is the starting point.
Three typical gaps when using templates
| Gap | Cause | Effect | Remedy |
|---|---|---|---|
| Template completed, never approved | The file stays with the person who filled it in, management does not know it | Roles and decisions are not binding, and in an emergency nobody knows about them | Approval with date and signature, filed in the evidence folder for the security concept |
| Legal status not updated | An older version of the template is kept in use | Deadlines or duties no longer match the law in force | Check version and date in the file, adopt the new version when the topic page changes |
| Evidence column empty | The template is used as a questionnaire, not as a list of evidence | During an audit, implementation cannot be proven | Enter one document per row with title, date and storage location |
How we help
The templates are enough to get started. If you want support with the checklist, the appointment, the security concept or rehearsing the reporting procedure, get in touch. Borderline cases in the role check are a matter for your legal adviser, and we prepare the technical details for this. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.
Frequently asked questions
Do I have to sign up to download?+
Is there also a template for the security concept?+
Are the templates official forms?+
How up to date are the templates?+
Read more
- Section 165 TKG: Protective Measures, Ten Minimum Measures
- Security Officer under Section 166 TKG: Tasks and Appointment
- Section 168 TKG: Reporting Security Incidents to BNetzA and BSI
- Section 5 TKG: Am I a Telecom Provider? Roles, Notification
- Section 169 TKG: Notifying Data Breaches to BNetzA and BfDI
- TKG Status Review: Stage 1 Check for Telecom Providers
Sources
- Section 3 TKG: definitions (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 5 TKG: duty to notify (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 165 TKG: technical and organisational safeguards (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 166 TKG: security officer and security concept (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 168 TKG: reporting a security incident (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Section 169 TKG: data and information security (gesetze-im-internet.de, German) (retrieved 2026-11-06)
- Bundesnetzagentur: catalogue of security requirements (catalogue 2.0 and draft 2025-10, German) (retrieved 2026-11-06)
- Bundesnetzagentur: reporting a security incident under Section 168 TKG (German) (retrieved 2026-11-06)
- BfDI: the procedure under Section 169 TKG (German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).