The BSI has sent a draft of the IT security self-declaration form for UBI 1 companies to the potentially affected organisations known to the BSI for comment. Following the comment round, the revised form will be published on the BSI websites.

UBI 2 must submit the self-declaration on IT security at the earliest 2 years after the entry into force of the statutory order (UBI-VO) (cf. § 8f (1) and (4) sentence 2 BSIG). The UBI-VO is issued by the Federal Ministry of the Interior and Home Affairs pursuant to §10 (5) BSIG. The BSI will prepare and publish more detailed information on the self-declaration once the UBI-VO is available. A schedule for the UBI-VO is currently not yet available.

Certifications are not a formal requirement for submitting the self-declaration. However, appropriate implementation of IT security measures can often be proven by means of relevant certifications. Irrespective of legal obligations, the BSI recommends appropriate implementation of IT security measures.

All certifications that represent an attestation of implemented information/cyber security measures are to be provided.