Digital laws of the federal states

Efficient implementation of the e-government and information security laws of the German federal states with Versio.io

In a nutshell Request demo Start free trial

What are the digital laws of the federal states?

In Germany, each of the 16 federal states regulates the digitalisation of its own administration. The legal basis is formed by the e-government and digital laws of the federal states – from the E-Government Act of Baden-Württemberg and the Bavarian Digital Act (BayDiG) to the Thuringian E-Government Act. They govern electronic access to the administration, electronic files, IT organisation and binding IT standards – and, increasingly, information security as well.

In addition, more and more federal states are adopting their own information security laws. The latest examples are the Information Security Act of North Rhine-Westphalia (InfoSiG NRW), in force since January 2026, and the Information Security Act of Mecklenburg-Western Pomerania (ISichG M-V) of May 2026. Whatever the law is called, the operational requirements are similar: an information security management system, a complete overview of all IT systems, risk and vulnerability management and reporting obligations for security incidents.

Why do the federal states need their own laws?

The federal NIS2 Implementation Act has been in force since 6 December 2025 and amends the BSI Act (BSIG). It applies to companies – including municipal enterprises that exceed the thresholds – and to the federal administration, but not to the core administrations of the federal states and municipalities: the legislative competence for their cybersecurity lies with the federal states themselves (Article 70(1) and Article 28(2) of the Basic Law).

The NIS2 Directive nevertheless requires the federal states to protect the critical parts of their administrations, i.e. public administration entities at regional level whose disruption could have a significant impact on critical societal or economic activities (Article 2(2)(f)(ii) NIS2). The federal states implement this in very different ways: with information security laws, with amendments to their e-government and digital laws, by ordinance or by administrative regulation. Each federal state also decides for itself whether its municipalities are included.

The digital laws of the 16 federal states at a glance

The following overview shows the central e-government or digital law of each federal state together with the rules on information security and the status of NIS2 implementation in the state administration (as of October 2026):

Federal state	E-government or digital law	Information security and NIS2 implementation
Baden-Württemberg	E-Government Act Baden-Württemberg (EGovG BW, 2015)	Cyber Security Act (CSG, 2021) with the Cyber Security Agency Baden-Württemberg (CSBW); NIS2 implemented by the Cyber Security Ordinance (CSVO, in force since 24 April 2025)
Bavaria	Bavarian Digital Act (BayDiG, 2022)	IT security in Part 3 of the BayDiG (Art. 41 to 49c) with the Bavarian State Office for Information Security (LSI); NIS2 requirements in Art. 49a to 49c (2024)
Berlin	E-Government Act Berlin (EGovG Bln, 2016)	ISMS according to BSI standards, Berlin-CERT and reporting obligation (§ 23 EGovG Bln); NIS2 implementation for the state administration in preparation
Brandenburg	Brandenburg E-Government Act (BbgEGovG, 2018)	Security concepts, CERT and reporting obligation for security incidents (§ 16 BbgEGovG)
Bremen	Act on the Promotion of Electronic Administration in Bremen (EGovG BR, 2018)	NIS2 implemented by administrative regulation (VV NIS2Ums FHB, 2025); a comprehensive Bremen Cyber Security Act is planned
Hamburg	Hamburg Administrative Digitalisation Act (HmbVwDiG, 2024)	No separate information security law yet; one is planned to meet the NIS2 requirements
Hesse	Hessian E-Government Act (HEGovG, 2018)	Hessian IT Security Act (HITSiG, 2023) with the Hessen CyberCompetenceCenter (Hessen3C); NIS2 implemented by a joint decree (NIS2 Joint Decree, StAnz. 2024, p. 1215)
Mecklenburg-Western Pomerania	E-Government Act Mecklenburg-Western Pomerania (EGovG M-V, 2016)	Information Security Act (ISichG M-V, 2026): BSI IT-Grundschutz, security operations centres and reporting obligations for state and municipal bodies
Lower Saxony	Lower Saxony Act on Digital Administration and Information Security (NDIG, 2019)	Information security in Part 3 of the NDIG (§§ 13 to 30); NIS2 implemented by decree (NIS2UmsRdErl, 2024)
North Rhine-Westphalia	E-Government Act North Rhine-Westphalia (EGovG NRW, 2016)	Information Security Act (InfoSiG NRW, in force since 16 January 2026) implements NIS2 for the state administration
Rhineland-Palatinate	E-Government Act Rhineland-Palatinate (EGovGRP, 2020)	Information security and state CERT (CERT-rlp) in § 17 EGovGRP; NIS2 implemented by administrative regulation (NIS2 Administrative Regulation, 2024, amended 2026)
Saarland	E-Government Act Saarland (E-GovG SL, 2017)	Information Security Act Saarland (IT-SiG SL, 2019); the draft of a new Information Security Act (InfoSiG) implementing NIS2 was approved by the state government in October 2026
Saxony	Saxon E-Government Act (SächsEGovG, 2014)	Saxon Information Security Act (SächsISichG, 2019) for state and municipal authorities; NIS2 requirements integrated in 2024
Saxony-Anhalt	E-Government Act Saxony-Anhalt (EGovG LSA, 2019)	Security standards in the EGovG LSA (§ 22); information security act in preparation, based on the state's cyber security strategy (2026)
Schleswig-Holstein	E-Government Act (EGovG SH, 2009), IT Deployment Act (ITEG) and Open Data Act (ODaG)	Security association and binding minimum standards (§ 4 EGovG SH); NIS2 implemented by the information security guideline (IS-LL, 2025); draft Digitalisation Acceleration Act (DigiBeschlG, 2026)
Thuringia	Thuringian E-Government Act (ThürEGovG, 2018)	IT security standards and analysis of log data (§§ 26 and 32 ThürEGovG); further rules in administrative regulations, which are being adapted to NIS2

The law names link to the official legal portals of the federal states. This overview has been compiled with great care but does not constitute legal advice. Laws, ordinances and administrative regulations change frequently – the official law gazettes and legal portals of the federal states are authoritative.

What do the laws require in IT operations?

The state laws differ in detail, but their technical and organisational core requirements are very similar – not least because most of them refer to the BSI standards or the NIS2 Directive:

Information security management - An information security management system (ISMS) based on the BSI standards or BSI IT-Grundschutz, security concepts and information security officers.
Risk management measures - Appropriate technical, operational and organisational measures based on a risk analysis – including asset management, vulnerability management, business continuity and supply chain security.
Reporting obligations - Security incidents must be reported to the state CERT, the cyber security agency or the central IT service provider. Where NIS2 has been implemented, significant incidents are reported in three stages: an early warning within 24 hours, a notification within 72 hours and a final report one month later.
Detection of attacks - Evaluation of log data, security operations centres (SOC) and central CERTs.
Management responsibility and evidence - The management approves the measures and monitors their implementation; supervisory authorities may request information, documents and evidence.

For each of these topics, the following sections list the relevant provisions of all federal states.

Your solution for the digital laws of the federal states: Versio.io

All state laws share a common foundation: you can only protect what you know. Versio.io automatically inventories the entire IT landscape, monitors versions, configurations and changes and provides audit-proof evidence for information security officers, the state CERT and the supervisory authorities. This relieves state and municipal administrations as well as their IT service providers of a large part of the manual documentation work that the laws entail.

The following sections show which requirements Versio.io supports and where they are laid down in the individual federal states. Federal states without a specific provision on a topic are not listed – Hamburg, for example, has not yet adopted its own information security law. Organisational measures such as security guidelines, training courses or emergency drills remain the responsibility of your organisation.

IT inventory and structure analysis

Every ISMS according to BSI IT-Grundschutz starts with the structure analysis: which business processes, applications, IT systems, networks and rooms are involved, and how do they depend on each other? Versio.io automatically inventories servers, clients, network components, virtualisation and cloud platforms, software and users, including their dependencies, and keeps this information permanently up to date – instead of in manually maintained spreadsheets. The network scanner also detects devices that are not yet documented anywhere.

Legal basis in the federal states:

Baden-Württemberg - § 3(2) and § 3(5) no. 9 CSVO
Bavaria - Art. 43(1) and Art. 49a(4) BayDiG
Berlin - § 23(1) and § 21(2) no. 11 EGovG Bln
Brandenburg - § 16(1) BbgEGovG
Bremen - § 5(2) no. 9 VV NIS2Ums FHB
Hesse - § 3(1) HITSiG; No. 2.2(i) NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 3(2) no. 9, § 3(3) and (5) ISichG M-V
Lower Saxony - No. 4.3(i) NIS2UmsRdErl
North Rhine-Westphalia - § 8(2) no. 9 InfoSiG NRW
Rhineland-Palatinate - § 17(1) EGovGRP; No. 3.2 NIS2 Administrative Regulation
Saarland - § 3(1) IT-SiG SL
Saxony - § 4(1) and (1a) no. 9 SächsISichG
NIS2 and BSI - Art. 21(2)(i) NIS2 Directive; BSI Standard 200-2

Versio.io CMDB

Versio.io network scanner

Protection requirement assessment

Which security measures are appropriate depends on the protection requirements of the information processed. Baden-Württemberg, Lower Saxony and Schleswig-Holstein explicitly link information security to the protection requirements; the other federal states do so via BSI IT-Grundschutz. In Versio.io, you record the protection requirements for confidentiality, integrity and availability of business processes and applications or import them from third-party systems. Versio.io automatically derives the protection requirements of every server, database and network component involved using inheritance rules such as the maximum principle – and updates them whenever the IT landscape changes.

Legal basis in the federal states:

Baden-Württemberg - § 3(2) and (7) CSVO
Berlin - § 23(1) EGovG Bln
Hesse - § 3(1) HITSiG
Mecklenburg-Western Pomerania - § 3(5) ISichG M-V
Lower Saxony - § 13(1) NDIG
Rhineland-Palatinate - § 17(1) EGovGRP; No. 3.2 NIS2 Administrative Regulation
Saxony - § 4(1) SächsISichG
Schleswig-Holstein - § 4(3) EGovG SH
BSI - BSI Standard 200-2

Versio.io protection requirement assessment

Risk management

Versio.io brings together outdated product versions, known vulnerabilities and configurations that violate your security guidelines as risks. Each risk is weighted according to its severity and the protection requirements of the affected component, so that you can prioritise measures in a comprehensible way. All corrective measures are tracked in an audit-proof manner – from detection to resolution.

Legal basis in the federal states:

Baden-Württemberg - § 3(3) to (5) CSVO
Bavaria - Art. 43(1) and Art. 49a(4) BayDiG
Berlin - § 23(1) EGovG Bln
Brandenburg - § 16(1) BbgEGovG
Bremen - § 5 VV NIS2Ums FHB
Hesse - § 3(1) HITSiG; No. 2 NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 3(1) and (2) no. 1 ISichG M-V
Lower Saxony - § 13(1) NDIG; No. 4 NIS2UmsRdErl
North Rhine-Westphalia - § 8 InfoSiG NRW
Rhineland-Palatinate - § 17(1) EGovGRP; No. 3.2 NIS2 Administrative Regulation
Saarland - § 3(1) IT-SiG SL
Saxony - § 4(1) and (1a) no. 1 SächsISichG
Schleswig-Holstein - § 4(3) EGovG SH
NIS2 - Art. 21 NIS2 Directive

Versio.io risk management

Vulnerability and end-of-life management

Versio.io continuously compares all detected software and hardware versions with an up-to-date CVE database and with the end-of-life dates of thousands of products. You are informed immediately when a new vulnerability affects your systems or when a product is no longer supported by the manufacturer – a risk that the explanatory memorandum to the ISichG M-V explicitly mentions alongside misconfigurations. Versio.io also recommends which versions you should switch to.

Legal basis in the federal states:

Baden-Württemberg - § 3(5) no. 5 and § 7 CSVO
Bavaria - Art. 49a(4) BayDiG
Bremen - § 5(2) no. 5 and § 11 VV NIS2Ums FHB
Hesse - No. 2.2(e) NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 3(2) no. 5 and § 9(1) no. 3 ISichG M-V
Lower Saxony - Nos. 2.3(e) and 4.3(e) NIS2UmsRdErl
North Rhine-Westphalia - § 8(2) no. 5 InfoSiG NRW
Rhineland-Palatinate - No. 3.2 NIS2 Administrative Regulation
Saxony - § 4(1a) no. 5 SächsISichG
NIS2 - Art. 21(2)(e) NIS2 Directive

Versio.io product lifecycle and vulnerability management

Versio.io end-of-life management

Change monitoring

In Hesse and Saxony, significant changes to IT systems may only be made in consultation with the information security officer; in Mecklenburg-Western Pomerania, putting IT into operation and making significant changes require their agreement. Berlin obliges authorities to comply with the requirements of the central IT management when changing IT procedures. Versio.io automatically detects every change to hardware, software, configurations and user rights and historises it in an audit-proof manner. This allows you to compare actual changes with approved change requests and to identify unauthorised changes immediately.

Legal basis in the federal states:

Berlin - § 20(3) EGovG Bln
Hesse - § 3(4) HITSiG
Mecklenburg-Western Pomerania - § 3(7) ISichG M-V
Saxony - § 4(4) SächsISichG
BSI - IT-Grundschutz module OPS.1.1.3

Versio.io change monitoring

Policy monitoring and system hardening

Almost all e-government laws oblige authorities to implement the binding IT security standards adopted by the IT Planning Council (IT-Planungsrat); several federal states also set their own binding minimum standards. Versio.io translates such requirements, your own security guidelines and recognised hardening benchmarks into rules and checks all configurations against them continuously – from TLS settings and certificates to open ports and application-specific parameters. Deviations are reported immediately and documented as risks.

Legal basis in the federal states:

Baden-Württemberg - § 3(1) no. 3 CSG; § 4 CSVO
Bavaria - Art. 46 BayDiG
Berlin - § 20(2) no. 1 and § 21(2) nos. 4 and 16 EGovG Bln
Brandenburg - § 12 BbgEGovG
Bremen - § 16 EGovG BR
Hesse - § 3(2) HITSiG
Lower Saxony - § 15(3) NDIG
Rhineland-Palatinate - § 17(2), § 26 and § 27(3) no. 2 EGovGRP
Saarland - § 18 E-GovG SL
Saxony - § 5(6) SächsISichG; § 12b(2) no. 3 and § 13 SächsEGovG
Saxony-Anhalt - § 14 and § 22(1) no. 3 EGovG LSA
Schleswig-Holstein - § 4(4) and § 9 EGovG SH
Thuringia - § 26 ThürEGovG

Versio.io policy monitoring

Versio.io benchmark governance

Reporting obligations and incident handling

Twelve federal states oblige their authorities to report security incidents. Where NIS2 has been implemented, the 24-hour deadline for the early warning leaves no time for lengthy research. Versio.io alerts you immediately to security-relevant events, creates tickets in your ITSM solution and shows which applications, services and organisational units are affected and what protection requirements they have. The complete history – from detection to resolution – is documented in an audit-proof manner and provides the facts for the notification and the final report to the state CERT or the competent authority.

Legal basis in the federal states:

Baden-Württemberg - § 4(3) CSG; §§ 5 and 6 CSVO
Bavaria - Art. 43(3) and Art. 49b BayDiG
Berlin - § 23(2) EGovG Bln
Brandenburg - § 16(2) BbgEGovG
Bremen - § 8 VV NIS2Ums FHB
Hesse - § 18 HITSiG; No. 5.1 NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 16 ISichG M-V
Lower Saxony - § 14(2) NDIG; No. 6 NIS2UmsRdErl
North Rhine-Westphalia - § 9 InfoSiG NRW
Rhineland-Palatinate - § 17(3) EGovGRP; No. 3.2 nos. 5 and 6 NIS2 Administrative Regulation
Saarland - § 3(2) IT-SiG SL
Saxony - §§ 15 to 17 SächsISichG
NIS2 - Art. 23 NIS2 Directive

Versio.io event processing and alerting

Context for SOC and CERT

Most federal states have created a legal basis for detecting attacks by evaluating log data; in Mecklenburg-Western Pomerania, every public body must also operate or join a security operations centre. To assess an alert, SOCs and CERTs need context: which system is affected, which software versions run on it, who is responsible for it and which services depend on it? Versio.io provides this information via its API. In addition, Versio.io detects unauthorised modifications to programs, libraries and configuration files by means of checksums.

Legal basis in the federal states:

Baden-Württemberg - § 5(2) CSG
Bavaria - Art. 44(2) BayDiG
Berlin - § 23(3) EGovG Bln
Brandenburg - § 16(3) to (6) BbgEGovG
Hesse - §§ 8 and 9 HITSiG
Mecklenburg-Western Pomerania - §§ 10 and 12 ISichG M-V
Lower Saxony - § 19 NDIG
North Rhine-Westphalia - § 6 InfoSiG NRW
Rhineland-Palatinate - §§ 18 and 19 EGovGRP
Saarland - §§ 4 and 5 IT-SiG SL
Saxony - §§ 6, 12 and 13 SächsISichG
Thuringia - § 32 ThürEGovG

Versio.io integrity verification of binary files

Business continuity and backup monitoring

All NIS2 implementations of the federal states require measures to maintain operations, such as backup management and recovery after an emergency. Versio.io monitors backup and batch job runs and documents their results. In the event of a disruption, the digital twin of your IT landscape remains available with the current and last known state of every component – an objective basis for root cause analysis and recovery.

Legal basis in the federal states:

Baden-Württemberg - § 3(5) no. 3 CSVO
Bavaria - Art. 49a(4) BayDiG
Bremen - § 5(2) no. 3 VV NIS2Ums FHB
Hesse - No. 2.2(c) NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 3(2) no. 3 ISichG M-V
Lower Saxony - No. 4.3(c) NIS2UmsRdErl
North Rhine-Westphalia - § 8(2) no. 3 InfoSiG NRW
Rhineland-Palatinate - No. 3.2 no. 4 NIS2 Administrative Regulation
Saxony - § 4(1a) no. 3 SächsISichG
NIS2 - Art. 21(2)(c) NIS2 Directive

Versio.io business process & batch job monitoring

Audit-proof evidence and management reporting

The management of an authority is responsible for information security – under the NIS2 implementations, it must approve the security measures and monitor their implementation – and supervisory authorities may request information, documents and evidence. Versio.io historises all inventory data, changes and risks in its temporal database. This allows you to show at any time what state a system was in on a given date, which vulnerabilities were known at that time and which measures were taken. Dashboards, metrics and PDF reports provide information security officers, management and supervisory authorities with the evidence they need – without additional manual effort.

Legal basis in the federal states:

Baden-Württemberg - § 3(1) no. 3 CSG; § 3(8) and § 4 CSVO
Bavaria - Art. 43(2), Art. 45(1) and Art. 49c(1) BayDiG
Berlin - § 20(3) EGovG Bln
Bremen - § 5(1), § 7 and § 12 VV NIS2Ums FHB
Hesse - § 3(3) HITSiG; Nos. 2.6, 3 and 7 NIS2 Joint Decree
Mecklenburg-Western Pomerania - § 3(2) no. 6, § 3(3) and (4) and § 17 ISichG M-V
Lower Saxony - Nos. 4.1, 5 and 7 NIS2UmsRdErl
North Rhine-Westphalia - § 8(2) no. 6, § 8(6) and § 12 InfoSiG NRW
Rhineland-Palatinate - § 27(3) no. 2 EGovGRP; No. 3.2 no. 1 NIS2 Administrative Regulation
Saxony - § 4(3) and § 5(7) SächsISichG

Versio.io PDF reports

Digital sovereignty: on-premises or SaaS from Germany

Versio.io is developed in Germany. You can operate the platform on-premises in your own data centre or that of your IT service provider, or use the SaaS environment, which is hosted in an ISO 27001-certified data centre in Germany in full compliance with the GDPR. Your inventory and security data therefore remain under your control – an important prerequisite for many public administrations.

Also relevant for municipalities and IT service providers

Some federal states also place obligations on their municipalities: the Saxon Information Security Act has applied to state and municipal authorities since 2019 (§ 2 SächsISichG), and the ISichG M-V makes BSI IT-Grundschutz mandatory for municipal bodies as well from 1 May 2028 – until then, the IT-Grundschutz profile "Basis-Absicherung Kommunalverwaltung" applies (§ 3(5) ISichG M-V). The Saarland Information Security Act also applies to municipalities (§ 1 IT-SiG SL), Hesse recommends its principles to them (§ 3(5) HITSiG), and Thuringia makes the security standards of the IT Planning Council binding for municipalities as well (§ 26 ThürEGovG). In Mecklenburg-Western Pomerania and Rhineland-Palatinate, authorities must also oblige their IT service providers to comply with the information security requirements (§ 3(6) ISichG M-V; No. 3.2 no. 7 NIS2 Administrative Regulation). Thanks to its high degree of automation, Versio.io is suitable for smaller municipalities with limited IT staff as well as for IT service providers who manage the IT of many authorities.

Further information

The BSI provides background information on NIS2 for state and municipal administrations. You can find the NIS2 Directive in the official wording here:

🇩🇪 BSI: NIS2 for state and municipal administrations

🇪🇺 EU NIS2 directive