Logo Bayernportal
Home > Procedures

Designate contact point for notifications as operator of energy supply networks

If you operate an energy supply network, you must report IT faults to the Federal Office for Information Security (BSI) immediately. In order to submit a report, you must name a contact point to the BSI in advance.

Online services & Forms

Online services

  • Melde- und Informationsportal des Bundesamts für Sicherheit in der Informationstechnik (BSI)
    The reporting and information portal of the German Federal Office for Information Security (BSI) offers you the possibility to designate a contact point online for submitting reports as well as for sending information to the BSI. In order to submit a report, a contact point must first be registered with the BSI. After successful registration, extensive information is available in the download area, including a sample notification form and instructions on how to submit a notification, so that established and trusted notification channels are available to you in the event of a reportable incident. A hardware token sent by the BSI is used as the means of authentication in the reporting and information portal.

Responsible for you

Bundesamt für Sicherheit in der Informationstechnik - KRITIS-Büro

Street address

Godesberger Allee 87
53175 Bonn

Postal address

Postfach 200363

53133 Bonn

Mehr zur Behörde

Procedure details

Critical infrastructures are organizations and facilities that are of great importance to the functioning of the community and whose failure or impairment would result in significant supply bottlenecks or threats to public safety.

As the operator of an energy supply network, you must immediately report IT disruptions to the Federal Office for Information Security (BSI). This applies regardless of whether your energy supply network is part of the critical infrastructure.

To enable you to report faults, you must designate a contact point where you can be reached at any time. BSI will send you various information to this address, for example IT security warnings and situation information.

Once you have registered a contact point with the BSI, you will receive comprehensive information to help you protect your critical infrastructures. In the event of a reportable incident, established and trustworthy reporting channels are available to you.

Among other things, you will receive

  • Information on the reporting obligation,
  • a reporting form,
  • instructions on how to make a report.

This enables the BSI to ensure that

  • incoming reports actually originate from operators of energy supply networks,
  • operators are included in the group of recipients of BSI situation and warning information,
    • This means, among other things, that operators can be contacted at any time and are able to receive cyber security warnings or situation information.
      • to receive them,
      • immediately view
      • and evaluate it.

As a rule, the BSI sends out information during normal business hours. In exceptional cases, urgent warnings can also be sent outside normal business hours, i.e. on public holidays, weekends or at night.

  • You are the operator of an energy supply grid,
    • regardless of whether your energy supply network is part of the critical infrastructure.
  • You as the operator of the energy supply network must designate the contact point at the BSI.

  • Required Documents
    • completed and signed registration form
      • with details of the organization
      • if applicable, with details of the critical infrastructures operated
      • with details of the contact person and contact points
    • In the registration form, the data protection declaration and the final declaration are requested by means of a signature.

You must name the contact point via the Reporting and Information Portal (MIP) of the Federal Office for Information Security (BSI).

  • Call up the MIP of the BSI.
    • If your organization is already registered, you can log in via "Login".
    • Otherwise, you can start the registration process by clicking on "Register". You will then receive the access data by post.
  • Complete the form for naming a contact point in full.
  • Then complete an "Annex 2" for each of your infrastructures.
  • You can then check your data again and send it off.
  • After submitting, you can save your form as a PDF file. Print out the form, sign it and send it to the BSI's KRITIS office.
    • You can send the documents to the BSI by post, fax or e-mail. You will find information on this in the form for naming the contact point.
  • The BSI will check your registration.
  • You will receive confirmation of your registration by e-mail and access data by post. Further documents will be available in the download area of the registration portal once you have completed the registration process. If you have any questions about the registration process, you can contact the BSI's KRITIS office. If you have technical questions about the reporting portal, please contact the reporting office at the National IT Situation Center.

Note: If you do not name a contact point, the BSI can carry out the registration itself and inform the responsible federal supervisory authority.

The BSI does not charge any costs for registering the contact point.

As soon as you operate an energy supply network for the first time or again, you must designate a contact point by the next working day at the latest.

It usually takes 1 to 2 weeks to process your registration.

  • IT security and situation information, which also includes non-public and confidential information, is compiled from the BSI's continuous collection of information.
  • If you are a notifiable operator of an energy supply grid and have transferred operation to an upstream grid operator,
    • you can designate a contact point at the upstream grid operator in consultation with the upstream grid operator,
    • but the responsibility with regard to the legal obligations remains with you as the grid operator.

  • Contradiction
    • As a rule, you can lodge an objection with the Federal Office against an administrative act of the Federal Office with which you do not agree.
    • In the objection procedure, the Federal Office will review the decision it has made, taking into account the arguments you have put forward to remedy the situation before going to court.
  • Legal action before the administrative court: In principle, you can only take legal action before the court once you have received a notice of objection in response to your objection.

Status: 09.03.2025
Editorially responsible for prodecure description: Bundesministerium des Innern
Source: Federal Portal