Registration within three months, incident reporting within 24 hours, 72 hours and one month, proof every three years — and for operators of critical installations, a duty to run attack-detection systems (§ 31 BSIG). The planner works with these provisions, not with outdated citations.
Back to the AI Toolkit Current legal position The new BSIG has been in force since December 2025 Official benchmark BSI orientation guide on attack detection (SzA) Make or buy The operating model follows classification, not gut feeling
AiLoft · AI Toolkit · SOC Planner
Set up a SOC as a regulatory project, not a tool purchase.
The planner locates your organisation in the new German BSIG and the CER implementation act, derives the duties — from central logging to reporting within 24 hours — with their legal references, recommends an operating model and a sensible depth of automation, and ends with a four-phase roadmap you can actually work through.
Free · no sign-up · everything stays in your browser
The planner is available in German only.
Its content is built on German law (BSIG, KRITIS-Dachgesetz) and on BSI orientation guides, and is deliberately not translated: the legal references only carry meaning in the original wording. You are welcome to use the German version, and we are happy to walk you through it in English.
Open the German assistantLogging, detection, response — the BSI guide details the duties down to a named group of people responsible for detection and grades implementation on a 0–5 scale. Level 3 is the floor; level 4 is the honest target.
For critical installations with industrial control systems, the workable model is hybrid: buy the 24x7 backbone, keep plant knowledge and reporting decisions in-house. For essential and important entities without a critical installation, a managed SOC is the norm. The recommendation follows from your answers.
Legal position as of .
Recommendation
Structure is no substitute for experience.
The assistant brings your initiative to an audit-ready state: you know where you stand, what needs clarifying and in what order. The decisions that follow — architecture, vendor selection, contracts, works council agreements and the question of when a pilot becomes production — determine the value and the cost of the whole endeavour.
Bring in proven AI expertise for that. NC AGENTIC GmbH supports organisations across the German-speaking market at exactly this stage and is available at any time for an informal conversation.