GERMANY Law and Practice Contributed by: Bettina Mertgen, Felix Siebler, Michael Herold and Sebastian Faust, GvW Graf von Westphalen
5.6 Supply Chain Security Germany has no single defence-sector-wide supply- chain security regime or general list of prohibited countries or suppliers. Requirements arise mainly from defence procurement law, classified-information rules, the BSI Act and contract-specific provisions. Under the Ordinance on the Award of Public Contracts in the Defence and Security Sectors, authorities may require evidence that a bidder’s supply chain ensures security of supply, including crisis capacity, mainte - nance and notification of material changes. Classified contracts require security obligations to be passed to subcontractors. Since 14 February 2026, the Bun - deswehr Procurement Acceleration Act has also per - mitted certain procurements to restrict participation by bidders and subcontractors or require supplies to originate from the EU or equivalent states. Additional contractual measures may include supplier transpar - ency, traceability, control of component changes, software updates, audits and continuity planning. Non-compliance can result in exclusion, contractual remedies, termination, loss of security clearance or regulatory action. 5.7 Counter-Espionage and Insider Threat Obligations Germany imposes specific security obligations on defence companies and personnel to protect against espionage, sabotage and insider threats. These obli - gations arise primarily under the Security Clearance Act, classified information regulations, and cyberse - curity laws applicable to defence contractors and criti - cal infrastructure operators. Defence contractors must: • conduct security vetting of personnel with access to classified information; • implement physical, organisational and IT security measures; • restrict access to classified information on a need- to-know basis; and • maintain procedures to detect and prevent espio - nage, sabotage and unauthorised disclosures. Security assessments and counterintelligence func - tions are carried out principally by the Military Coun - terintelligence Service in the defence sector and the
Entities classified as critical infrastructure are subject to additional obligations, including: • implementation of appropriate cybersecurity and information security measures; • incident reporting requirements for significant cyber-attacks or security breaches; • regular security audits and compliance assess - ments; and • enhanced protection of sensitive systems and data. In some cases, scrutiny under Germany’s foreign investment screening regime is heightened, particu - larly for defence and security-related companies. Oversight is primarily exercised by the Federal Office for Information Security, while the Federal Ministry for Economic Affairs and Energy may review foreign acquisitions involving defence-related or other secu - rity-sensitive assets. 5.5 Cybersecurity Requirements for Defence Contractors Germany has no defence-sector-wide cybersecurity certification equivalent to the US Cybersecurity Matu - rity Model Certification. Requirements instead depend on the contract, classification level and whether the contractor is subject to the BSI Act implementing NIS- 2. Contractors handling classified information are sub - ject to the applicable requirements under the Security Clearance Act, the Classified Information Instructions, the Manual on the Safeguarding of Classified Informa - tion (GHB) and relevant contractual security instruc - tions. For VS-NfD, the lowest of the four classifica - tion levels, this generally entails contractual security instructions, need-to-know access, staff instruction and technical safeguards. The VS-Vertraulich classi - fication or higher normally requires the contractor to participate in the federal industrial-security procedure, obtain the necessary personnel clearances and imple - ment approved physical and IT security arrangements. Entities covered by the BSI Act must also implement proportionate cybersecurity risk-management and incident-reporting measures. Procurement authorities may impose additional requirements, including ISO/ IEC 27001, BSI IT-Grundschutz, vulnerability report - ing, audits and supply chain controls.
69 D EFENCE CON TRACTS 2 026
CHAMBERS.COM
Powered by FlippingBook