Reporting obligations of the BSI

(1) The BSI informs the Federal Ministry of the Interior of its activity.
(2) The information under subsection (1) also serves to inform the public, through the Federal Ministry of the Interior, of dangers to IT security, taking place at least once a year in a summary report. Section 13(2) applies accordingly.
(3) The Federal Ministry of the Interior informs the Interior Committee of the German Bundestag, each calendar year by 30 June of the year following the reporting year, of the application of this Act. It also addresses the further development of the relevant Union law in doing so.
(4) The BSI submits to the European Union Agency for Cybersecurity, each year by 18 January, 18 April, 18 July and 18 October, a summary report containing anonymised and aggregated data on significant security incidents, significant cyber threats and near misses reported under section 32 and section 5(2).
(5) The BSI transmits, on 17 April 2027 and thereafter every two years, 1. to the European Commission and the Cooperation Group under Article 14 of the NIS 2 Directive, for each sector and subsector under Annex I or II of the NIS 2 Directive, the number of essential entities and important entities registered under section 33(1), and 2. to the European Commission, relevant information on the number of critical facilities, on the sector and subsector under Annex I or II of the NIS 2 Directive to which they belong, on the type of services they provide, and on the provisions on the basis of which they were identified.