What does state of the art mean?
State of the art (in German law: Stand der Technik) means that a security measure matches what is advanced, available on the market and recognized by experts as effective. The law refers to the term instead of listing measures, so the obligation moves with technology. A measure that sufficed five years ago may therefore fall short today, and you have to justify the classification yourself.
The German BSI Act (BSIG) does not define the term. The TeleTrusT guideline "Stand der Technik in der IT-Sicherheit" (V 1_2025-06) defines it as methods, equipment or operating practices "available in the movement of goods and services" that can effectively ensure statutory protection goals. In short form it calls it the "best performance of an IT security measure available on the market for achieving the statutory IT security goal" (our translation). The guideline itself states that it is neither a legally binding interpretation nor a technical standard.
Which laws require the state of the art?
In IT security, the BSI Act, the NIS2 Directive, the GDPR and the German Telecommunications Act (TKG) require the state of the art, with different degrees of obligation.
| Provision | Addressee | Wording | Degree of obligation |
|---|---|---|---|
| § 30(2), first sentence, BSIG | particularly important and important entities | measures "should comply with the state of the art" (our translation of "sollen … einhalten") | should-provision: comply |
| § 31(2) BSIG | operators of critical installations, for attack detection systems | "the state of the art should be complied with" (our translation) | should-provision: comply |
| Art. 21(1), second subparagraph, Directive (EU) 2022/2555 | Member States, for essential and important entities | "taking into account the state-of-the-art" | take into account, weighed against cost |
| Art. 32(1) GDPR | controllers and processors | "Taking into account the state of the art, the costs of implementation …" | take into account, weighed against cost and risk |
| Art. 25(1) GDPR | controllers | data protection by design, also "taking into account the state of the art" | take into account |
| § 165(1) TKG | anyone providing or involved in providing telecommunications services | "the state of the art must be taken into account" (our translation) | take into account |
| § 3(1), second sentence, no. 27 BSIG | BSI | describes and publishes a state of the art for security requirements for IT products | a task of the authority, not a duty for companies |
§ 30 BSIG does not apply to financial entities under DORA (§ 28(6) BSIG). Under § 28(5) BSIG it does not apply, in principle, to operators of public telecommunications networks, providers of publicly available telecommunications services and energy companies under the Energy Industry Act (EnWG). For them, the requirements of DORA, the TKG or §§ 5c to 5e EnWG apply. The measures § 30 BSIG requires in detail are set out in the NIS2 guide.
Comply with or take into account?
Complying is stricter than taking into account. Where the state of the art only has to be taken into account, as under Art. 32 GDPR, you weigh it against implementation cost and risk and justify the result. Treat the "should" in § 30(2), first sentence, BSIG as the default and record every deviation with its reasons.
The BSIG also requires weighing: § 30(1) BSIG requires "appropriate, proportionate and effective" measures (our translation). It names the proportionality criteria: the extent of risk exposure, the size of the entity, implementation costs, and the likelihood and severity of security incidents together with their societal and economic impact.
The same paragraph obliges the entity to document compliance.
Three levels: accepted rules, state of the art, state of science
The TeleTrusT guideline traces the three technology levels to the Federal Constitutional Court's Kalkar decision of 1978 (BVerfGE 49, 89). It calls the top level "state of science and research" to set it apart from the state of the art.
| Level | Recognition among experts | Proven use |
|---|---|---|
| Generally accepted rules of technology | broad, described in standards and catalogs | long proven, widespread |
| State of the art | recognized by leading experts | available on the market, tested in use |
| State of science and research | discussed in specialist publications | not yet on the market |
According to the guideline, a measure passes through the levels in turn: it reaches the state of the art when it comes to market and moves to the accepted rules as it spreads. By that logic, implementing only what a standard such as ISO/IEC 27002 describes tends to stay at the level of accepted rules. § 30(2), first sentence, BSIG requires both side by side: comply with the state of the art and take the relevant European and international standards into account.
At the end of the cycle, recognition is lost. Compromised measures and products at the end of their life cycle without vendor support "must no longer be used," according to the German edition of the guideline (our translation).
A statutory definition exists only outside IT security. § 3(6) of the Federal Immission Control Act (BImSchG) defines the state of the art for environmental law. It is "the stage of development of advanced processes, facilities or modes of operation which makes the practical suitability of a measure … appear assured" (our translation). In patent law, the term means something else: all knowledge made available to the public before the filing date, against which an invention's novelty is measured (§ 3(1) PatG).
How do you determine the state of the art in 5 steps?
You determine the state of the art per measure and repeatedly. According to the TeleTrusT guideline, proof succeeds only if the measure "is compared with the alternatives available on the market at regular intervals using a transparent method" (our translation).
- Set the protection goal. For the asset concerned, decide whether confidentiality, integrity or availability comes first and how high the protection need is.
- Use references. Draw on the TeleTrusT guideline, the BSI's Technical Guidelines, ISO/IEC 27002 and, where one exists, the sector-specific security standard (B3S).
- Classify the measure. The guideline assesses two dimensions, recognition by experts and proven use, with four guiding questions each and points from 1 to 5, from which an average is formed for each.
- Weigh alternatives and proportionality. Compare with alternatives available on the market and document the weighing against the criteria of § 30(1) BSIG or Art. 32(1) GDPR.
- Set a review. Fix a review date and name triggers for an earlier review, such as a newly disclosed vulnerability or an announced end of vendor support.
Example: an assessment record
Fictional example; product, dates and amounts are invented for illustration. This is what the record could look like for the remote access of a mid-sized company that is an important entity under § 30 BSIG.
| Field | Entry |
|---|---|
| Asset and protection goal | VPN gateway for remote access by 300 employees; confidentiality high, availability high |
| Measure | VPN with certificate and second factor, gateway "Model A" |
| References | TeleTrusT guideline, chapter on VPN; vendor information on end of support |
| Classification | state of the art; averages and answers to the eight guiding questions in the annex |
| Finding | The vendor ends support for Model A on June 30, 2027. |
| Alternatives | successor model from the same vendor (EUR 40,000); product from another vendor (EUR 55,000, training effort) |
| Weighing under § 30(1) BSIG | high risk exposure because it is reachable from the internet; cost acceptable relative to size |
| Decision | continued operation until replacement by the successor model by March 31, 2027; approved by management |
| Review | April 1, 2027, or earlier on a critical vulnerability in Model A |
The record changes the decision at one point. Without the finding on end of support, the gateway would have run past June 30, 2027, as a measure that according to the guideline must no longer be used.
Check the record by holding each row against a source. A finding without vendor information or a decision without approval is a gap. A maintained asset inventory shows the life-cycle status; how the assessment fits into ISMS operations is covered in the guide ISMS implementation.