Information Security Officer (ISB / CISO)

An external CISO Germany, also called Informationssicherheitsbeauftragter or ISB, is the designated person responsible for steering information security risk, controls and incident response. The role has shifted from a recommended best practice to a legal duty for a large segment of the German economy since the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz, NIS-2-UmsuCG, entered into force on 06 December 2025. The transposed law amends the BSI-Gesetz: § 30 BSIG defines the cybersecurity risk management measures, § 32 BSIG sets the reporting duties with the 24-hour early warning, the 72-hour incident notification and the one-month final report, and § 38 BSIG requires governance involvement of the management. Two new categories apply: essential entities and important entities, with thresholds typically at 250 employees and 50 million euros turnover for essential, and 50 employees and 10 million euros turnover for important. For financial institutions, the EU Digital Operational Resilience Act, DORA, has applied since 17 January 2025 under Regulation 2022/2554, adding ICT risk management, incident reporting and third-party oversight under Art. 28. The accepted control catalogue is ISO/IEC 27001:2022 with 93 controls in Annex A; the transition deadline from ISO 27001:2013 ended on 31 October 2025 so any active certificate must now reflect the 2022 version. Fines under § 60 BSIG reach up to 10 million euros or 2 percent of global annual turnover for essential entities, and the management can be personally liable for breach of the supervisory duty.

The duty to appoint an information security officer follows from the NIS-2-UmsuCG in force since 06 December 2025 and from sector-specific regulation. § 38 BSIG obliges the management of essential and important entities to ensure that cybersecurity risk management measures are implemented and supervised, which in practice requires a named information security officer. Essential entities cover sectors such as energy, transport, banking, healthcare, drinking water, wastewater and digital infrastructure with thresholds at 250 employees and 50 million euros turnover or 43 million euros balance sheet. Important entities cover postal services, waste management, chemicals, food, manufacturing of medical devices, electronics and machinery and digital providers at thresholds of 50 employees and 10 million euros turnover. For banks and insurers, MaRisk AT 7.2 and BAIT or VAIT have required an information security officer since 2017 and 2018. DORA Art. 5 to Art. 16 since 17 January 2025 requires financial entities to assign clear ICT risk responsibilities. Public sector and critical infrastructure operators already had duties under § 8a BSIG. Mid-sized companies frequently engage an external CISO as a service to obtain BSI- and BaFin-grade competence without a full-time hire.