Cybersecurity is a fundamental prerequisite for the functioning of our society, because information technology is ubiquitous and vulnerable. The state is therefore called upon to ensure cybersecurity. A key element of this duty of assurance is the prevention of attacks: regulatory approaches cannot prevent cyberattacks in every case. Carolin Kemper shows that safeguarding against threats to cybersecurity is part of the state's security mandate and examines the concrete implications that follow from this. Which measures should be considered to achieve the greatest possible level of cybersecurity? Possible state strategies range from preventive information gathering, to supporting of affected parties responding to cyberattacks, to issuing orders to manufacturers of insecure products or operators of insecure IT systems. In closing, the author takes a look at the administrative responsibilities that have differentiated within the multi-level system.