§30 BSIG: The 10 Mandatory Measures and What They Mean for Email
The 10 mandatory measures under §30 BSIG in detail – with specific email relevance for each individual measure.
2 minNIS2 & Compliance
§30 BSIG: The 10 Mandatory Measures and What They Mean for Email
§30 of the revised BSI Act is the centerpiece of NIS2 implementation in Germany. It defines ten specific areas of measures that affected companies must implement. Many of them have a direct connection to email security – the No. 1 attack vector.
The 10 Measures at a Glance
No. 1: Risk Analysis and Security Concepts
Legal requirement: Concepts for risk analysis and security for information systems.
Email relevance: Email is the most important attack vector. Every risk analysis must centrally consider the email infrastructure:
- What sensitive data is sent via email?
- What threats exist (phishing, BEC, malware)?
- What protective measures are implemented?
Conbool solution: The dashboard provides real-time transparency across the entire mail flow. Compliance reports provide the basis for risk analysis.
No. 2: Management of Security Incidents
Legal requirement: Detection, analysis, containment, and management of security incidents.
Email relevance: Most incidents start via email. Required are:
- Real-time detection of phishing, malware, and anomalous behavior
- Automatic quarantine of suspicious emails
- Complete traceability through tracing
- Reporting processes: 24h early warning, 72h full report
Conbool solution: MailGuard detects threats with AI-based analysis. Quarantine, tracing, and audit logs enable rapid incident management.
No. 3: Business Continuity, Backup Management
Legal requirement: Business continuity management and crisis management.
Email relevance: Email availability is business-critical. Backup strategies for email configurations and archiving are required.
No. 4: Supply Chain Security
Legal requirement: Security in the supply chain including security-related aspects of relationships between entities and their service providers.
Email relevance: Communication with suppliers and partners must be encrypted. Even small suppliers without their own encryption must be included.
Conbool solution: The Message Portal enables encrypted communication with partners – even without their own S/MIME or PGP infrastructure.
No. 5: Security in Acquisition, Development, and Maintenance
Weitere Artikel
Die neuesten Beiträge aus unserem Blog.
2 minIT-Sicherheit / Best Practices
Secure Email Gateway: 10 Best Practices für die Einrichtung
Die richtige Konfiguration eines Secure Email Gateways entscheidet über Sicherheit und Nutzererfahrung. Diese 10 Best Practices helfen IT-Teams bei der optimalen Einrichtung.
2 minIT-Sicherheit / Vergleich
Email Security Gateway Vergleich 2026: Worauf es wirklich ankommt
Die Auswahl des richtigen Email Security Gateways ist entscheidend für die Sicherheit der Unternehmenskommunikation. Dieser Vergleich zeigt die wichtigsten Kriterien und typische Fallstricke.
2 minIT-Sicherheit / Microsoft 365
Email Security Gateway für Microsoft 365: So schließen Sie die Sicherheitslücken
Microsoft 365 bietet Basis-Sicherheit, aber kein vollständiges Email Security Gateway. Dieser Guide zeigt, welche Lücken bestehen und wie ein externes Gateway sie schließt.