Information security officers of federal administration entities

(1) The management of each federal administration entity appoints an information security officer for its entity and designates at least one person authorised to act as deputy.
(2) Targeted training of the information security officers of federal administration entities is necessary for performing their tasks. The information security officers of the entities and their deputies must acquire the expertise necessary to perform their tasks. They and their deputies are subject to the technical oversight of the information security officer of the respective competent department.
(3) The information security officers of federal administration entities are responsible for establishing and maintaining their entity's information security process. They draw up an information security concept that satisfies at least the BSI's requirements under section 44(1). They work towards the operational implementation of the information security concept and monitor its implementation within the entity. The information security officers advise the management of the federal administration entity on all questions of information security, and inform the management of the federal administration entity, and the respective competent information security officer of the department, regularly and as occasion requires, of their activity, of the state of information security within the entity, of resource and staffing levels, and of security incidents. They perform their reporting and advisory tasks independently and free of instructions.
(4) The information security officers of the entities must be involved in all measures affecting the entity's information security. They have a right of direct access to their entity's respective management and to the information security officer of the respective competent department. They may not be removed from office or disadvantaged by their respective entity on account of performing their tasks.