Designate contact point for notifications as operator of energy supply networks

If you operate an energy supply network, you must report IT faults to the Federal Office for Information Security (BSI) immediately. In order to submit a report, you must name a contact point to the BSI in advance.

Critical infrastructures are organizations and facilities that are of great importance to the functioning of the community and whose failure or impairment would result in significant supply bottlenecks or threats to public safety.

As the operator of an energy supply network, you must immediately report IT disruptions to the Federal Office for Information Security (BSI). This applies regardless of whether your energy supply network is part of the critical infrastructure.

To enable you to report faults, you must designate a contact point where you can be reached at any time. BSI will send you various information to this address, for example IT security warnings and situation information.

Once you have registered a contact point with the BSI, you will receive comprehensive information to help you protect your critical infrastructures. In the event of a reportable incident, established and trustworthy reporting channels are available to you.

Among other things, you will receive

• Information on the reporting obligation,
• a reporting form,
• instructions on how to make a report.

This enables the BSI to ensure that

• incoming reports actually originate from operators of energy supply networks,
• operators are included in the group of recipients of BSI situation and warning information,
  • This means, among other things, that operators can be contacted at any time and are able to receive cyber security warnings or situation information.
    • to receive them,
    • immediately view
    • and evaluate it.

As a rule, the BSI sends out information during normal business hours. In exceptional cases, urgent warnings can also be sent outside normal business hours, i.e. on public holidays, weekends or at night.

• completed and signed registration form
  • with details of the organization
  • if applicable, with details of the critical infrastructures operated
  • with details of the contact person and contact points
• In the registration form, the data protection declaration and the final declaration are requested by means of a signature.

• Forms available: Yes
• Written form required: Yes
• Informal application possible: No
• Personal appearance necessary: No
• Online service available: Yes

• You are the operator of an energy supply grid,
  • regardless of whether your energy supply network is part of the critical infrastructure.
• You as the operator of the energy supply network must designate the contact point at the BSI.

• Contradiction
  • As a rule, you can lodge an objection with the Federal Office against an administrative act of the Federal Office with which you do not agree.
  • In the objection procedure, the Federal Office will review the decision it has made, taking into account the arguments you have put forward to remedy the situation before going to court.
• Legal action before the administrative court: In principle, you can only take legal action before the court once you have received a notice of objection in response to your objection.

You must name the contact point via the Reporting and Information Portal (MIP) of the Federal Office for Information Security (BSI).

• Call up the MIP of the BSI.
  • If your organization is already registered, you can log in via "Login".
  • Otherwise, you can start the registration process by clicking on "Register". You will then receive the access data by post.
• Complete the form for naming a contact point in full.
• Then complete an "Annex 2" for each of your infrastructures.
• You can then check your data again and send it off.
• After submitting, you can save your form as a PDF file. Print out the form, sign it and send it to the BSI's KRITIS office.
  • You can send the documents to the BSI by post, fax or e-mail. You will find information on this in the form for naming the contact point.
• The BSI will check your registration.
• You will receive confirmation of your registration by e-mail and access data by post. Further documents will be available in the download area of the registration portal once you have completed the registration process. If you have any questions about the registration process, you can contact the BSI's KRITIS office. If you have technical questions about the reporting portal, please contact the reporting office at the National IT Situation Center.

Note: If you do not name a contact point, the BSI can carry out the registration itself and inform the responsible federal supervisory authority.

As soon as you operate an energy supply network for the first time or again, you must designate a contact point by the next working day at the latest.

It usually takes 1 to 2 weeks to process your registration.

The BSI does not charge any costs for registering the contact point.

• IT security and situation information, which also includes non-public and confidential information, is compiled from the BSI's continuous collection of information.
• If you are a notifiable operator of an energy supply grid and have transferred operation to an upstream grid operator,
  • you can designate a contact point at the upstream grid operator in consultation with the upstream grid operator,
  • but the responsibility with regard to the legal obligations remains with you as the grid operator.