Catalogue of security requirements

(1) The Federal Network Agency, in agreement with the Federal Office for Information Security and the Federal Commissioner for Data Protection and Freedom of Information, determines, by general order, in a catalogue of security requirements for operating telecommunications and data-processing systems and for processing personal data: 1. details of the technical precautions and other measures to be taken under section 165(1) to (7), having regard to the various threat potentials of public telecommunications networks and publicly available telecommunications services, 2. which functions are critical functions within the meaning of section 2, point 23(c)(bb), of the BSI Act that are realised by critical components within the meaning of section 2, point 23, of the BSI Act, and 3. who is to be classified as an operator of public telecommunications networks and as a provider of publicly available telecommunications services with increased threat potential. The catalogue of security requirements under the first sentence may also contain requirements on the disclosure and interoperability of interfaces of network components, including technical standards to be observed. The Federal Network Agency gives manufacturers, the associations of operators of public telecommunications networks, and the associations of providers of publicly available telecommunications services the opportunity to comment.
(2) The power of the Federal Network Agency under subsection (1), point 2, continues to exist until a statutory instrument is issued under section 56(7) of the BSI Act for the information technology and telecommunications sector within the meaning of section 2, point 24. A general order issued by the Federal Network Agency on the basis of subsection (1), first sentence, point 2, is to be revoked upon the entry into force of a statutory instrument under section 56(7) of the BSI Act for the information technology and telecommunications sector.
(3) The obligated parties must satisfy the requirements of the catalogue no later than one year after its entry into force, unless a different implementation period has been set in the catalogue.