Germany Braces for Overhaul of Public Sector Internal Controls in 2026
New regulations driven by cybersecurity threats and evolving financial standards will force a fundamental shift in how German public administrations manage risk and ensure compliance.
Germany’s public authorities are facing a sweeping modernization of their internal control systems (ICS) as stricter IT security requirements and new financial standards take effect in 2026. A paradigm shift is underway, demanding a reorganization of compliance and risk management structures across the nation. These changes, triggered by updated ICS guidelines, signal the end of “checkbox compliance” and a move towards demonstrable resilience.
The Regulatory Landscape Tightens
The impetus for this overhaul stems from a more stringent regulatory environment following the implementation of the NIS-2 policy in January. Recent announcements from the Federal Office for Information Security (BSI) and updates to financial risk standards have collectively created a more rigorous accountability framework. Beginning in February 2026, the requirements for ICS in the public sector will be significantly expanded, largely driven by the implementation of the NIS-2 Implementing Act.
According to a press release from the BSI, new regulations concerning “Principles for Information Security Management in the Federal Administration” are now operational. The BSI launched a new reporting portal on January 6, 2026, initiating stricter supervision of approximately 30,000 institutions, including federal authorities.
Financial Compliance Evolves Beyond “Check-the-Box”
Parallel to these digital security demands, significant updates are occurring in the financial sector, impacting state banks and savings banks. On February 3, 2026, IT Financial Magazine reported on the draft 9th MaRisk Short Story (Minimum risk management requirements). While primarily aimed at financial institutions, experts believe these standards will increasingly serve as benchmarks for financial compliance throughout the public sector.
The amendment explicitly calls for an end to superficial compliance exercises. Instead, authorities will be required to provide “comprehensible chains of justification” and demonstrate a stronger focus on risk-bearing capacity. This shift emphasizes the quality of risk assessment over the quantity of documentation.
Cybersecurity Takes Center Stage
The integration of cybersecurity into traditional ICS is emerging as the defining trend for 2026. An industry analysis by Security-Insider, dated January 30, 2026, identifies four strategic trends, with a key development being the elevation of KI-Governance – the management of artificial intelligence – to a core leadership task. This directly influences how authorities manage automated decision-making processes.
Under the new guidelines, administrations must demonstrate not only the existence of security controls, but also their effectiveness in real-time. The BSI’s new reporting portal and associated obligations will compel authorities to document their ICS processes with unprecedented transparency, aiming to strengthen “digital sovereignty” – a key priority for the federal government.
Municipalities Face New Procurement Risks
Strict ICS guidelines are also reshaping administration at the state level. In North Rhine-Westphalia (NRW), a fundamental change in municipal procurement law took effect on January 1, 2026. According to an analysis by the procurement platform cosinex, the revised § 75a of the municipal code (GO NRW) removes the mandatory application of sub-threshold procurement regulations (UVgO) for certain tenders.
Instead, municipalities must now rely on their own internal guidelines, based on principles of efficiency and thrift. This deregulation, paradoxically, increases the need for robust internal control systems to prevent corruption and ensure compliance, lacking the previous safety net of the UVgO. Experts caution that this increased flexibility introduces new compliance risks that must be mitigated through enhanced ICS measures.
From Formal Compliance to Material Compliance
The developments at the beginning of 2026 mark a clear departure from purely formal compliance towards “material compliance.” This broader trend, underscored by the MaRisk amendment on February 3rd, prioritizes the quality of risk assessment.
This creates a double burden for public sector decision-makers: first, the introduction of Information Security Management Systems (ISMS) that meet NIS-2 standards for digital compliance, and second, adaptation to more flexible, yet riskier, procurement rules (as seen in NRW) and stricter financial risk standards for financial and process compliance. Observers suggest the simultaneous tightening of IT security rules and the increased flexibility of procedural rules are creating a complex environment where the ICS becomes the central control instrument.
Preparing for Increased Scrutiny
In the coming months, authorities will require concrete implementation assistance to meet these federal and state requirements. The BSI has announced plans to develop sector-specific profiles for public administration to support NIS 2 implementation throughout 2026. Additionally, the BSI’s ThemenRadar 2025/2026 survey, running until the end of February, aims to provide further data on how deeply these new ICS requirements are penetrating administrative culture. Public managers should prepare for increased audit intensity, with a focus on the effectiveness of their controls, not merely their existence.
