Received a BSI request: what the BSI may ask for and how to reply
A BSI request names its legal basis, what the BSI wants to know and a deadline. The BSI can ask for information and documents, for example about registration (§ 33(4) BSIG), from essential entities for an inspection (§ 61 BSIG) and from important entities when facts point to a breach (§ 62 BSIG). Read the request carefully, decide who replies, and reply in writing within the deadline.
What a request can be based on
The legal basis is stated in the letter. It determines what the BSI may ask for.
Registration
If facts suggest that your company has not registered, you present documents and provide information on request. The BSI can also carry out the registration itself.
§ 33(3) and (4) BSIG
Inspection of an essential entity
The BSI can check whether the law is being complied with, including with the help of third parties. You grant access during normal business hours, present documents, provide information and give support.
§ 61(5) BSIG
Evidence from an essential entity
The BSI can order evidence from 6 December 2028 at the earliest, from approved hospitals from 6 December 2030 at the earliest.
§ 61(3) BSIG
Inspection of an important entity
Only if facts suggest that your company is not implementing § 30, § 32 or § 38(3) BSIG, or not properly.
§ 62 BSIG
After a report
If you have reported an incident, the BSI can ask for an intermediate report on the status.
§ 32(1) no. 3 BSIG
How to proceed
Read the letter carefully: which provision does it name, what exactly does the BSI want to know, and by when?
Decide who replies. Management should know about the request.
Put together what is asked for. Usually it already exists: your documents, lists and records, which you keep anyway under § 30(1), third sentence, BSIG.
If the deadline is not enough, ask early and in writing for more time and say why.
Reply in writing, with a list of enclosures and the date. Put in writing what was discussed on the phone.
If the scope or legal basis is unclear, or the letter concerns fine proceedings, get legal advice.
How far the duty goes
The duty goes as far as what the BSI asks for and the named provision supports. You do not have to send documents nobody asked for.
Before the BSI issues an administrative act that interferes with your rights, such as an order, it usually gives you the opportunity to comment.
Refusing access, documents or information during an inspection of an essential entity is an administrative offence. The upper limit is EUR 100,000.
§ 28 VwVfG · § 65(2) no. 17 and (5) BSIG
What this means for a company with 50 to 150 employees
As an important entity, your company is only inspected when there are indications of a breach. The BSI can still ask about registration or after a report.
Replying is easier when the records already exist: which measures you took, who approved them, how you report incidents, when management was trained.
An example
A made-up company: a food manufacturer with 85 employees. In September a letter from the BSI arrives with a three week deadline.
The letter names § 33(4) BSIG. The BSI asks why the company is not registered.
The managing director reads it the same day and asks the IT manager to prepare the reply.
The company checks: food production is listed in Annex 2, and with 85 employees it is an important entity. The registration was missing because the activation letter from ELSTER had not arrived yet.
The letter arrives in the second week. The company registers and replies in writing with the date of registration, within the deadline.
How the walkthrough does this
The walkthrough at nisd2.eu does not write your reply to the BSI. It records what the reply rests on.
The export puts the whole walkthrough in one document: status, open items, documents, risk matrix, all registers and details. You save it as a PDF in the browser.
Every approved document shows the name and date of management's approval.
The activity log shows who changed what and when, including every approval.
Admins, auditors and your company's management can export.
Common questions
Do I have to reply to a BSI request?
Yes, as far as the named provision obliges you to, for example § 33(4) or § 61(5) BSIG. You do not have to provide anything beyond that.
How long do I have?
The deadline is in the letter. The law sets no fixed deadline for such requests.
Can I ask for more time?
Yes. Ask early and in writing and say why the deadline is not enough. The BSI decides whether to agree.
Do I need a lawyer?
Not for every request. If it is unclear what the BSI may ask for, or the letter concerns fine proceedings, legal advice makes sense.
Sources
- BSI Act (BSIG) §§ 30, 32, 33, 61, 62, 65, gesetze-im-internet.de/bsig_2025
- Administrative Procedure Act (VwVfG) § 28, gesetze-im-internet.de
- Directive (EU) 2022/2555 (NIS 2), Art. 32 and 33, EUR-Lex
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
