Verification obligations for operators of critical facilities

(1) Operators of critical facilities must demonstrate to the BSI, through security audits, examinations or certifications, the implementation of the measures relating to critical facilities under section 30(1), first sentence in conjunction with section 31(1) and (2), first sentence, at a time determined by the BSI in consultation with the Federal Office of Civil Protection and Disaster Assistance, at the earliest three years after they first, or at the latest three years after they again, qualify as an operator of a critical facility, and thereafter every three years. The operators transmit to the BSI the results of the audits, examinations or certifications carried out, including particulars of the security defects thereby uncovered. The BSI may require submission of the documentation on which the review was based. In the case of security defects it may, in agreement with the competent federal supervisory authority or in consultation with the otherwise competent supervisory authority, require the submission of a suitable defect-remediation plan and the remediation of the security defects. The BSI may require submission of suitable evidence that the defects have been remedied.
(2) The BSI may determine the following requirements for arranging the procedure for examinations and the provision of evidence under subsection (1): 1. requirements as to the manner of conduct, 2. requirements as to the suitability of the evidence to be provided, and 3. after hearing the operators and entities concerned and the trade associations concerned, professional and organisational requirements for the examining bodies, in agreement with the Federal Office of Civil Protection and Disaster Assistance. The determination under the first sentence is made by public notice on the BSI's website.
(3) By way of derogation from subsection (1), first sentence, the BSI determines, for operators of critical facilities that, until this Act entered into force, were operators of Critical Infrastructures under section 2(10) of the BSI Act of 14 August 2009 (Federal Law Gazette I, p. 2821), as last amended by Article 12 of the Act of 23 June 2021 (Federal Law Gazette I, p. 1982), the time for providing evidence at the earliest three years after the last evidence was provided under section 8a(3) of the BSI Act of 14 August 2009 (Federal Law Gazette I, p. 2821), as last amended by Article 12 of the Act of 23 June 2021 (Federal Law Gazette I, p. 1982). Operators of critical facilities that, until this Act entered into force, were operators of Critical Infrastructures, and whose evidence period under section 8a(3) of the BSI Act of 14 August 2009 (Federal Law Gazette I, p. 2821), as last amended by Article 12 of the Act of 23 June 2021 (Federal Law Gazette I, p. 1982), would have expired within twelve months of this Act entering into force, may, within that period, provide evidence in accordance with the previously applicable requirements.
(4) The obligation under subsection (1), first sentence does not apply to operators of critical facilities that were designated as such on the basis of section 5(7) of the Critical Infrastructure Umbrella Act.