Managed Security Services: CISO Does Not Bear Sole Liability
Benedikt Langer
8 min. read In many organisations, the CISO is seen as the person who stands accountable for security. ...
8 Min. read time
The special-funds year is over. The honest question isn’t whether Germany got faster. The honest question is which three decisions in mid-sized corporations and conglomerates cut so deep that they’ll shape the next decade. Everything else was just theatre.
Key takeaways
RelatedCloud Repatriation 2026: Why hybrid architecture is the CIO’s statistical illusion / Edge Computing: How CIOs are redrawing factory architectures
Three decisions stick. Not the ones with the biggest press conferences, but those quietly nodded through in boardrooms that shifted the cost base of entire corporations. One built capability. One only generated consultant fees. And one remains unresolved—determining whether this reboot becomes a lasting structure or just an interlude.
The assessment follows the peer perspective: Who ultimately pays, who benefits. And where decisions were substantive rather than rhetorical. This year, management teams learned more about what they no longer want to hear than what they actually want.
The quiet shift wasn’t the special fund itself, but the moment dual-use moved from grant-program jargon into standard investment accounting. When a semiconductor line can produce both civilian and military chips, the break-even calculation changes fundamentally. Payback periods shrink, risk classifications at banks shift. Suddenly, locations that were dismissed as uneconomical just two years earlier start to make sense.
For management, this means one thing: contracts with BAAINBw, BWI and their EU counterparts are no longer a niche—they’re baseline portfolio. If you offer manufacturing, sensor technology, communications hardware or cybersecurity services and don’t have a dual-use clause in your standard contract architecture, you’ll lose access to the tenders that will drive volume in the years ahead.
Source: Federal Ministry of Finance, 2022 legislative explanatory notes
The figure itself isn’t the lever. The real lever is the constitutional authorization that ties the funds to a specific purpose and makes them spendable until fully exhausted. This changes the time horizons: an IT program with a four-year term and fixed funding is entirely different from a budget item that must be defended annually. CIOs who align their supply chains with this exact timeline come out ahead.
Those who think this is defense-specific are underestimating it. Dual-use also impacts enterprise software: identity management, log aggregation, video analytics, encrypted storage. Certification under BSI standards becomes the ticket to a market that remains closed to those who don’t adapt. If you haven’t already initiated Common Criteria or C5 certification for your platform, you’re pushing market entry back by at least twelve months.
The second underestimation lies in contract logic. Dual-use tenders come with different durations, exit clauses and SLAs than typical B2B sales. Show up with a standard SaaS contract, and you’ll lose in the first round. Companies that recognized this have spent this year setting up their own frameworks—complete with fixed escalation procedures for outages, documented supply chains and named operational teams. The upfront cost is six to nine months of legal and architectural work. But it’s the difference between market access and exclusion.
Germany’s second pivotal choice leaves a less visible—but no less lasting—mark. Since 2025, federal agencies have made sovereign cloud clusters the default for new specialist procedures. Not universally, not with uniform depth, but at a level that can no longer be undone. Tenders from the federal administration now follow a clear logic: using hyperscalers requires additional governance documentation, while sovereign providers (STACKIT, IONOS Cloud, Open Telekom Cloud) get the smoother path.
For companies with a large public-sector footprint, this shifts internal cloud strategy. Multi-cloud was once an optimization decision. Now, it’s a prerequisite for access. Those relying solely on AWS, Azure, or GCP will find themselves locked out of critical tenders for the foreseeable future—regardless of price or feature set. The 2026 DACH hyperscaler comparison reveals where cost-performance arguments still hold—and where governance requirements override them.
The operational cost isn’t trivial. Drafting a cloud exit clause means legally separating data sovereignty, encryption keys, and operational responsibility—without letting the architecture collapse under normal conditions. Realistic estimates put the effort in the high six-figure range per enterprise agreement. Steep? Yes. But still cheaper than losing a major contract.
The third decision is the one that hasn’t been made yet. The Federal Ministry of the Interior and the Federal Ministry for Economic Affairs have proposals for a governance overhaul of public IT procurement sitting in a drawer. The goal: shift from price as the primary criterion to lifecycle costs and operational quality. Those who’ve read the drafts know this is where the real reboot lies. Those who’ve only watched press conferences haven’t even noticed the reform exists.
The Federal Audit Office has repeatedly criticized in its latest reports that large IT projects routinely blow their budgets because procurement logic rewards vendors who bid low and profit later through change requests. The proposed reform would structurally change that. Whether it happens will be decided in the next four quarters.
The political resistance isn’t coming from the usual suspects. Big consulting firms have no reason to sabotage the reform—they have the capacity to adapt to both models. The pushback comes from the specialist departments themselves, where project managers see lifecycle thinking as added complexity and operational quality as harder to measure than a tender price. To push this through, proponents need operational metrics—not just legal mandates.
The dividing line isn’t the size of the budget—it’s operational accountability. Every program that ends with a named owner, a dedicated budget, and an escalation path has delivered real substance. Every program that concludes with a final report has merely generated consulting revenue. The metric CFOs and supervisory boards should scrutinize isn’t cost per project, but the ratio of completed programs with an active operational owner.
Next year won’t be a repeat of the special fund era. It’s the phase where the rubber meets the road—whether those three critical decisions translate into action. Every CIO whose company depends on the public sector or operates in the dual-use space should prioritize these three steps in their annual planning:
The sequence isn’t arbitrary. Without dual-use architecture, market access is off the table. Without cloud exit clauses, participation is disqualified. Without skill quotas, the pricing model won’t survive the new governance logic. Skip one, and you’re not building on the special fund year—you’re squandering it.
The analysis above assumes the three decisions will deliver their intended impact. That’s far from guaranteed. Three structural risks could still derail the reboot.
First, political sustainability. The special fund is a one-off authorization. If the next government reverts IT budgets to standard fiscal logic, multi-year framework contracts lose their foundation. Suppliers who banked on funding certainty will bear the risk alone. Political cycles, in the end, tend to override planning logic.
Second, the skills shortage. A sovereign cloud demands operational teams with deep expertise in both German regulation and hyperscaler architectures. This profile is rare. Without a robust training pipeline, architectural ambitions will falter in day-to-day operations—leading back to consultant dependencies the reboot aimed to reduce.
Third, EU harmonization. The EU AI Act, NIS2 implementation, and the upcoming Cyber Resilience Regulation each introduce their own governance requirements. Companies that fail to align German and EU frameworks will face compliance overhead that erodes the benefits of a sovereign cloud. Harmonization won’t happen automatically.
When executives look back in summer 2026 and ask what remains of the reboot year, they shouldn’t measure success by their communications—but by their contract architecture. Three questions for the CIO: Are our framework contracts dual-use capable? Do we have documented cloud exit options in major enterprise agreements? Can we demonstrate operational teams in tenders, not just senior consultants billed by the hour?
If the answer to all three is a solid *yes*, the special fund year was well spent. Anything less was just background noise—visible on consultants’ invoices, but not in the substance of your business.
The reboot didn’t happen in the past. It’s happening now, in how contracts, architectures, and procurement logic are shaped over the next four quarters. The decisions that stick will be the ones made in this window. As of April 2026.
The Bundeswehr Special Fund is a one-off constitutional provision (Article 87a(1a) of the Basic Law) amounting to around 100 billion euros, approved in 2022. It enables earmarked spending on defence capabilities beyond regular budget allocations, providing multi-year planning certainty for supply chains, armaments projects, and IT equipment.
Dual-use infrastructure, which shifted from grant programmes to standard investment accounting. Mandatory sovereign cloud clusters in public-sector tenders. And the still-pending governance reform of public IT procurement, set to transition from price-based logic to lifecycle costing.
Dual-use now extends to enterprise software: identity management, log aggregation, encrypted storage, video analytics. Without BSI certification, Common Criteria, or C5 attestation, companies lose access to tenders in defence, public authorities, and critical infrastructure. The contractual logic differs fundamentally from standard B2B SaaS sales.
Legally, yes—if public-sector contracts are part of your portfolio. Federal agencies increasingly demand documented migration capability to sovereign clusters. The effort per enterprise agreement runs into the high six figures, but pays off after the first major contract win. Companies that fail to adapt will exclude themselves from this market segment in the medium term.
Drafts are with the Federal Ministry of the Interior (BMI) and the Federal Ministry for Economic Affairs. Implementation with initial application is expected no earlier than Q4 2026, with full impact in 2027/28. Resistance comes less from industry than from specialist departments, which view lifecycle costs as added complexity. Operational metrics will determine whether the reform gains traction or gets bogged down at the Federal Audit Office.
The ratio of completed programmes with an active operational owner to the total number of completed programmes. This metric separates substance from consulting theatre more clearly than cost per project or number of deliverables. It enforces operational accountability post-project—precisely where many Special Fund initiatives falter.
More from the MBF Media Network
Source header image: Pexels / Paul Schärf (px:32863809)