Operators or their associations can specify how to meet the state-of-the-art requirements in (B3S). These (B3S) can be submitted to the BSI to determine their suitability. There is no legal obligation to develop a (B3S). Preparing a B3S is an opportunity for an industry to formulate its own 'state-of-the-art' specifications based on its own expertise. It also gives operators who are audited in line with recognised (B3S) legal certainty with regard to the 'state of the art' that is required and checked during an audit.

Distinction between (B3S) and the BNetzA IT security catalogue

Note: Section 8a of the BSI-Act does not apply in some dedicated areas of critical infrastructures because special legal regulations apply here. This applies to the areas of public telecommunications, energy networks and energy systems specified by the BSI Kritis Regulation in particular. The Federal Network Agency (BNetzA) has drawn up catalogues of security requirements for the areas mentioned.

• Catalogue of security requirements pursuant to Section 109 (6) Sent. 1 of the Telecommunications Act (TKG) for the operation of telecommunications and data processing systems as well as for the processing of personal data as a basis for the security concept according to Section 109 (4) TKG and for the technical precautions and other safeguards to be taken pursuant to Section 109 (1) and (2) TKG.
• IT security catalogue for networks pursuant to Section 11 (1a) of the EnWG, which serves to protect against threats to the telecommunications and electronic data processing systems necessary for secure grid operation.
• IT security catalogue for energy systems pursuant to Section 11 (1b) of the EnWG, which serves to protect against threats to the telecommunications and electronic data processing systems necessary for secure system operation.

Further information on the Federal Network Agency's IT security catalogue is available at:www.bundesnetzagentur.de/it-sicherheitskatalog-energie.