The second act on increasing the security of IT systems (German IT Security Act 2.0) has given rise to new regulations for companies in the special public interest (UBI). The specific obligations for UBI are outlined in Section 8f of the BSI Act (BSIG).

The types of companies that are considered UBI are defined in Section 2 (14) of the BSIG. There are three UBI categories:

• UBI 1 (AWV UBI) includes manufacturers/developers as defined in Section 60 of the Foreign Trade and Payments Ordinance (AWV); that is, companies that operate in the area of weapons, munitions and military goods or in the area of products with an IT security function that are used for processing classified state information or components of such products that are vital to the IT security function.
• UBI 2 (value creation UBI) covers the companies in Germany that are the largest in terms of their domestic value creation, and the key suppliers to these companies.
• UBI 3 (hazardous incident UBI) covers operators “of an upper-tier establishment as defined in the applicable version of the Hazardous Incident Ordinance” or operators that “are equivalent to operators of this kind in accordance with Section 1 (2) of the Hazardous Incident Ordinance”.

For answers to frequently asked questions about UBI, see our FAQ.

UBI 3 (hazardous incident UBI) has been subject to a reporting obligation since 1 November 2021. For answers to frequently asked questions about this, see our FAQ. You can find details of the reporting process and the reporting form in “Reporting UBI security incidents”.

If you have any questions that are not covered by the FAQ, please feel free to send an e-mail to the UBI Office at ubi-buero@bsi.bund.de.