Navigation and service

• What are the functions of the BSI?

  The scope of the BSI is defined by the Act on the Federal Office for Information Security (BSI Act -- BSIG). The BSI's objective is to preventively promote information and cyber security to enable and advance the secure use of information and communication technology in society. The BSI provides support to ensure the issue of IT security is treated seriously in government, business and society and implemented independently.

  For example, the BSI develops practice-oriented minimum standards and target group-oriented recommendations for action on IT and Internet security to support users in avoiding risks.

  The BSI is also responsible for the protection of Federal IT systems. This concerns the defence against viruses, trojan attacks and other technical threats against federal computers and networks. The BSI reports on this to the Committee on Internal Affairs of the German Bundestag once a year.

  The BSI's functions also include:

  • Protecting the federal government's networks, including detection and defence against attacks on government networks
  • Testing, certification and accreditation of IT products and services
  • Warning about malware or security vulnerabilities in IT products and services
  • IT security consulting for the federal administration and other target groups
  • Providing information and raising citizen awareness on the topic of IT and Internet security
  • Developing uniform and binding IT security standards
  • Developing cryptographic systems for federal IT
• What is a BSI 'warning'?

  According to Section 7 of the Federal Office for Information Security Act (BSI-Gesetz), the BSI has the authority to issue warnings concerning vulnerabilities in information technology products and services as well as malware. These warnings can be directed to the affected parties or issued publicly (via the media, for example). A warning of this type may also state that the BSI advises against using certain products and solutions until the vulnerability in question has been resolved. In all cases, the manufacturers of the products and services concerned are always notified before the warning is published.

  A public warning is only issued if there are sufficient indications that threats to IT security are originating from the product concerned. The BSI treats this authority with the utmost respect, because a public warning from the BSI about a specific product may have serious financial consequences for the affected company.

The BSI