Depending on the case in question, the scope and application of the right to information is based on the appraisal of the BSI. Upon request, operators must provide the BSI with all records, written documents and other documents deemed necessary for the assessment by the BSI in a suitable manner unless there are overriding aspects of confidentiality or security. In particular, this also includes that is needed to assign asset categories or determine the supply value of systems.

In accordance with Section 8b(3)(2) of the BSI Act, the BSI is able to register any operator of relevant systems that fails to fulfil its registration duties itself. The BSI must examine in advance whether the circumstances are grounds for a duty to register. While is does not have a comprehensive duty to conduct such examinations, the BSI is required to give the operator a chance to respond if it has yet to issue a statement on the reasons why it has not registered. If registration is performed by the BSI instead, this can also lead to a fine in accordance with Section 14(2)(5) of the BSI Act; in this case, registration is classed as having been performed by the BSI.

For operators of critical infrastructures who are registered by the BSI, the same rights and duties apply as for operators that register themselves. This relates in particular to the implementation of appropriate safeguards, the provision of corresponding evidence, the reporting of IT disruptions, and the availability of the point of contact defined by the BSI. As such, upon being informed that they have been registered by the BSI, operators are requested by the BSI to check the data used by the BSI for this purpose, and where applicable, inform the BSI of any corrections.