New additional testing requirements according to the IT Security Act 2.0 for all operators of energy supply networks and energy plants - without consideration of threshold values.

Operators of Critical Infrastructures are obligated to implement appropriate organizational and technical measures to prevent disruptions to the availability, integrity, authenticity, and confidentiality of their information technology systems, components, or processes. Following the implementation of the 2nd IT Security Act, the BSIG (Federal Office for Information Security Act) in the new § 8a paragraph 1a explicitly refers to the use of Attack Detection Systems.

Such systems provide an effective method for (early) detection of cyber-attacks and are particularly helpful in reducing and preventing damage.

Operators of energy supply networks and energy facilities are already required to implement an IT security catalog published by the Federal Network Agency. With an amendment in the Energy Industry Act (EnWG), they are now additionally obliged to use attack detection systems and to provide corresponding proof to the Federal Office for Information Security (BSI). According to § 11 paragraph 1f of the EnWG, they must demonstrate compliance with the requirements of § 11 paragraph 1e EnWG to the BSI for the first time on May 1, 2023, and then every two years thereafter.