CLAIM-2026-09-13-06

§ 30 BSIG requires risk-management measures including incident handling and business continuity, and § 38 BSIG requires the management body to approve those measures, arrange and oversee their implementation, and attend regular training, with liability to the entity under the applicable corporate-law rules on breach.

Why it matters

It puts a named human on the hook for whether the control exists, which is what turns a stopwatch log from documentation into evidence.

Sources

• althammerki2026nis
• bundesamtfu2026schulung