The BSI, Germany's federal cybersecurity agency, has been allowed to inspect the security of federal IT since December 2021. In 2024 and 2025 it checked 15 federal bodies on site. That is the finding of a report by the Bundesrechnungshof, the federal audit court, to the Bundestag budget committee, dated 12 August 2026, which netzpolitik.org published on 8 October 2026. Without a change of approach, the auditors write, the BSI would need more than 20 years to check every federal body once. For the overview, the government plans to rely mainly on a yearly self-report survey. In my view, a self-report measures the paperwork, and a firewall rule base is where you see the difference.
I work as an independent firewall and network-security contractor inside large German organisations. Part of that job is sitting next to people who fill in security questionnaires and then opening the rule base the questionnaire describes. The audit court's report reads to me like that gap, written up for the whole federal administration.
How often does the BSI audit federal agencies on site?
The BSI audited 15 federal bodies on site in 2024 and 2025 combined, and planned ten more on-site checks for 2026, according to section 3.1 of the Bundesrechnungshof report. The power comes from § 7 BSI Act, which since the December 2025 reform replaces the old § 4a that came into force on 1 December 2021. It lets the BSI demand documents and enter the premises of federal IT.
The report gives the history. In September 2021 the BSI planned a standard on-site audit of every federal body on a three-year cycle. It piloted the procedure from January 2024 and changed it substantially twice. In 2023 it estimated 400 to 500 bodies to audit; in March 2025 it lowered that to about 200. A footnote adds that some of the 15 audits ran as voluntary pilots. With at least 200 bodies and no change in approach, the auditors put one full round at "rund 20 Jahre" in the body text and "mehr als 20 Jahre" in the summary. The December 2025 reform widened the circle further, to all bodies of the federal administration, so both figures are optimistic.
The report has been covered by Esther Menhard at netzpolitik.org and Christian Grams at grams-it on 9 October 2026. Grams adds his own sum: at the observed 7.5 audits a year, a round takes almost 27 years. That figure is his arithmetic, not the court's.
Ten on-site checks against more than 200 self-reports
For anyone who has done audit work, one sentence in the report stands out: "Denn zehn Kontrollen stehen nun weit über 200 Selbstauskünften gegenüber." Ten on-site checks now stand against well over 200 self-reports. The ten are the on-site audits planned for 2026. The 200-plus are the yearly "Basisdatenerhebung", a form- and tool-based survey that the BSI wants to roll out across the federal administration to give it an overview it cannot get with its own inspectors. The report notes that where data looks inconsistent, the BSI and the agency can fill in the questionnaire together.
The audit court's judgement on this is blunt. It writes that the push for more on-site audits was meant to counter the agencies' "oft wenig kritischen Selbsteinschätzungen", their often uncritical self-assessments. It says self-reports deliver no objective results measured against uniform standards. And it notes that the BSI has more than 1,700 posts, calling the repeated reference to missing resources “weder zielführend noch sachgerecht”, neither helpful nor appropriate.
The federal government disagrees. The digital ministry (BMDS) replied that the BSI lacks staff for more on-site work and that its three-step method strikes an optimal balance of data quality and effort. On the proof that federal bodies must deliver under the new law, the BSI's position, as the report records it, is that such proof is in essence always only a self-report: "Im Kern handele es sich bei einem solchen Nachweis immer nur um eine Selbstauskunft." That sentence is the agency's own description of its plan. The audit court notes that the BMDS does not intend to follow its main recommendations.
What does NIS2 require companies to prove, and what does the Bund prove?
Since the German NIS2 law took effect in December 2025, operators of critical facilities must prove their security measures to the BSI every three years through audits, inspections or certifications, under § 39 BSI Act. For federal bodies, § 43(1) BSI Act sets the first deadline for proof at five years after the law came into force, which the audit court dates to 6 December 2030. The same report counts around 29,500 companies and organisations in Germany now bound to mandatory security measures.
| Question | Critical operators and large companies | Federal administration |
|---|---|---|
| Form of proof | Security audits, inspections or certifications (§ 39, critical facilities) | Planned as a yearly self-report survey, per the BSI's own position in the report |
| Who checks | Security audits, inspections or certifications; the BSI can order audits at particularly important entities (§ 61) | The BSI, on site, at 15 bodies in two years |
| Rhythm | Every three years for critical facilities | One full round in about 20 years at the current pace |
| First hard deadline | Timing set by the BSI, at the earliest three years after an operator first qualifies (§ 39) | 6 December 2030 (§ 43) |
Sources: the linked paragraphs of the BSI Act on gesetze-im-internet.de, and sections 3.1 and 3.2 of the Bundesrechnungshof report of 12 August 2026.
In my view this is the part a Mittelstand board member will find hardest to accept. The state asks critical operators for an auditor's signature, and under § 38 BSI Act company management must implement and monitor the security measures and is liable to the company for culpable breaches. For its own house it plans a form and a deadline four years away. I wrote about how unprepared many mid-sized firms are in why German SMEs are dangerously unprepared for NIS2. The report suggests the federal administration is not far ahead of them; it just grades itself.
What does a self-assessment miss in a firewall rule base?
A self-assessment misses whatever the person filling it in does not look at, and in firewall work that is usually the rule base itself. A questionnaire asks whether a process exists. An on-site check opens the configuration and asks whether the process produced the result. In my experience the two answers differ more often than they match, and nobody in the room is lying when they do.
| Control | What a self-report records | What an on-site check finds (my experience) |
|---|---|---|
| Rule recertification | "Yes, yearly review process exists" | Rules with no owner, last touched years ago, recertified by a bulk approval |
| Least privilege | "Rules follow need-to-know" | Broad any-to-any service objects added during an outage and never removed |
| Logging | "Logging enabled" | Logging on the default rule only, or logs nobody reads |
| Change control | "All changes via ticket" | Emergency changes at night, ticket created afterwards or not at all |
| Management access | "Admin access restricted" | Management interfaces reachable from wide internal ranges, shared admin accounts |
None of these show up as "No" on a form. The person answering knows the process exists, because they wrote it. The configuration knows something different. That is the pattern I described in the security controls that pass the audit and do nothing: a control can exist on paper and stop nothing in practice, and only someone who tests it will notice.
This is also why I do not share the ministry's faith in a supported self-report. When an auditor sits with an agency to fill in a questionnaire together, the result is a better questionnaire. It is still not a look at the rule base. The audit court makes a related point in its own terms: self-reports only become reliable if they rest on standardised, automatically collected and objectively measurable inputs. In firewall terms that means exporting the configuration and analysing it, which is closer to an audit than to a survey.
Where did the €1.2 billion go?
The second half of the report is about money. The German constitution lets the federal government take on extra debt for the protection of IT systems, a carve-out called the Bereichsausnahme. In the 2025 and 2026 budgets, 4.5 billion euros were assigned to that category. The audit court found that the government moved at least 1.2 billion euros into it that do not serve the protection of IT systems. The money sits in five research-funding budget titles of the research ministry (BMFTR), and none of their funding guidelines names IT protection as the primary purpose. In 2025 more than 600 million euros flowed out of those budget lines. Funded projects included, among other things, an app that recognises bird calls.
The government's answer, as recorded in the report, is that the 1.2 billion euros serve IT protection directly, because protection is only possible if you control the whole architecture in the sense of technological sovereignty. The audit court rejects that: assigning sovereignty spending wholesale to the carve-out does not respect its exceptional character. I wrote about the sovereignty debate in German cloud exit: everyone wants it, nobody tested it. My reading is that "sovereignty" has become a label wide enough to cover almost any IT budget, and the audit court has now pushed back on that for the federal budget.
Put the two findings side by side. The government cites a lack of BSI staff to explain the missing on-site audits. At the same time, money booked under the constitutional carve-out for IT protection funded research whose guidelines do not name IT protection as their primary purpose. The report keeps the two findings in separate chapters. I read them together.
What would an honest federal audit regime look like?
The audit court recommends that the BSI aim to check every federal body every three years on site, plus checks triggered by warning signs in the yearly survey, and that self-reports be validated quickly. From the contractor's seat, I would add two things that cost less than inspectors.
- Collect configuration, not answers. Firewall and gateway configurations can be exported and analysed centrally. A yearly config export from each federal body would tell the BSI more about segmentation and exposed management than any questionnaire.
- Audit a random sample, and publish the hit rate. If ten on-site checks a year is the capacity, choose some of them at random and report how often the self-report matched what the auditors found. That number would show whether the 200-plus forms are worth reading.
The pattern is not unique to the state. Two of the lessons in what 17 years of enterprise security compliance taught me apply here directly: compliance is a floor, and continuous checks beat an annual one. The same pattern shows up in the AI labs that set their own safety thresholds, as in what a self-declared safety threshold is worth. In each case the organisation grading itself is also the one that loses if the grade is bad.
The federal administration is a large German organisation like the ones I work in. Its networks are run by the same kind of people, on the same kind of firewalls, with the same backlog of rules nobody wants to remove. In my view, the Bund will learn what its rule bases look like only when someone opens them. A questionnaire returned on time does not do that.