Objectives:
To enhance the resilience and security of networks and information systems, the European Parliament and the Council adopted EU Directive 2022/2555 (known as the NIS 2 Directive)on December 14, 2022. The implementation of this directive has required member states to align their national legal frameworks with new cybersecurity management standards. In Germany, this process has led to the development of the draft "IT-Sicherheitsgesetz 3.0" (IT Security Act 3.0) and amendments to the Act on the Federal Office for Information Security (BSI). This article aims to analyze the legal and administrative mechanisms through which the federal authorities tasked with cybersecurity responsibilities operate.

Methods:
The methods employed are, first and foremost, the dogmatic-legal method.

Results:
The German federal government’s cybersecurity policy is consistent with the cybersecurity policy of the European Union. Ever since the first cybersecurity act in 2009 and the cybersecurity strategy in 2011, Germany has consistently designated the authorities responsible for cybersecurity.

Conclusions:
The Act on the Security of ICT Networks (IT-2.0) and subsequent legal acts stemming from the implementation of the 2016 NIS Directive, followed by the NIS-2 Directive, as well as amendments within the proposed IT-30 legislation and the Act on the Security of ICT Networks (BSI Act) have significantly strengthened the mandate of the BSI as the competent authority for cybersecurity.