Security officer and security concept

(1) A person operating a public telecommunications network or providing publicly available telecommunications services must
1. designate a security officer,
2. name a contact person established within the European Union, and
3. draw up a security concept showing
a) which public telecommunications network is operated and which publicly available telecommunications services are provided,
b) which hazards are to be assumed, and
c) which technical precautions or other protective measures have been taken or are planned to fulfil the obligations under section 165(1) to (7), as specified by the requirements of the catalogue of security requirements under section 167; insofar as the catalogue merely sets security objectives, it must be shown that the measures taken fully achieve the respective security objective.
(2) A person operating a public telecommunications network must submit the security concept to the Federal Network Agency without delay after commencing network operation. A person providing publicly available telecommunications services may be required by the Federal Network Agency to submit the security concept.
(3) A declaration that the technical precautions and other protective measures set out in the security concept have been implemented, or will be implemented without delay, is to be submitted together with the security concept.
(4) Where the Federal Network Agency finds security deficiencies in the security concept or in its implementation, it may require these deficiencies to be remedied without delay. Where the circumstances underlying the security concept change, the party obligated under subsection (2) must adapt the security concept without delay after the change and resubmit it to the Federal Network Agency without delay after the adaptation has been made, indicating the changes.
(5) The Federal Network Agency regularly reviews implementation of the security concept. The review should take place at least every two years.