Does my company have to implement NIS2?
NIS2.
Cyber security becomes a matter for the boss. What the German NIS2 law requires from companies, in clear steps.
In 60 seconds
- Since 6 December 2025, NIS2 has applied in Germany to significantly more companies.
- 10 measures, registration with the BSI and reporting deadlines of 24 hours, 72 hours and one month.
- The management is responsible and can be held liable.
Briefly explained.#
What is NIS2?
An EU directive (2022/2555) for a high level of cyber security. In Germany it applies through the NIS2 Implementation Act and the revised BSI Act, since 6 December 2025 and without a transition period.
Who does it affect?
Significantly more companies than before. Estimates assume around 29,500 entities in 18 sectors, from medium company size upwards.
What is new?
The management is responsible, companies must register with the BSI, report security incidents quickly and expect high fines.
Am I affected?#
2 questions decide: sector and size.
Sectors of high criticality
Energy, transport, banking and financial market infrastructure, health, drinking water and waste water, digital infrastructure and business-to-business IT services, public administration, space.
Other critical sectors
Postal and courier services, waste management, chemicals, food, manufacturing (for example machinery, electronics, vehicles), digital services such as marketplaces or search engines, research.
Size
At the core, medium-sized and large companies are affected, meaning from 50 employees or more than €10 million annual turnover and balance sheet total. There are exceptions for smaller entities in special cases.
| Essential entities | Important entities | |
|---|---|---|
| Who | Large companies in sectors of high criticality, plus other entities such as operators of critical facilities | Medium-sized companies there, and medium-sized and large companies in the other critical sectors |
| Supervision | The BSI can also carry out checks without a specific reason | The BSI mainly intervenes after indications or incidents |
| Fine up to | €10 million or 2% of worldwide annual turnover | €7 million or 1.4% of worldwide annual turnover |
The BSI offers an online applicability check. If in doubt, have the classification checked by experts or lawyers. Rough guidance, not legal advice.
Applicability assistant.#
2 questions, a rough classification.
Rough classification without legal advice. The exact activity, group structure and exceptions are decisive. The BSI offers its own assessment tool.
10 measures that apply.#
The law requires effective risk management. In practice, this means:
| Measure | In practice this means | |
|---|---|---|
| Risk analysis and security concepts | Assess risks systematically and have a documented concept | IT security |
| Handling security incidents | Detect, report and handle incidents, with roles and practice | Crisis management |
| Business continuity | Backups, recovery and crisis management | Crisis management |
| Supply chain security | Assess suppliers and service providers and bind them by contract | Glossary |
| Procurement, development, maintenance | Manage vulnerabilities, patch systems, develop securely | Monitoring |
| Check effectiveness | Tests, audits, metrics and penetration tests | Monitoring |
| Training and cyber hygiene | Train employees and management regularly | Basic check |
| Cryptography and encryption | Concepts for encrypting data and connections | High-security networks |
| Personnel, access, asset management | Keep permissions, physical access and inventory under control | Access control |
| MFA and secured communication | Multi-factor sign-in and protected emergency communication | IT security |
NIS2, ISO 27001 and IT-Grundschutz.#
Law, standard and method compared directly.
| NIS2 (BSI Act) | ISO/IEC 27001 | BSI IT-Grundschutz | |
|---|---|---|---|
| What is it? | A law with cyber security obligations | International standard for an information security management system (ISMS) | BSI method with standards 200-1 to 200-3 and the IT-Grundschutz Compendium |
| Mandatory? | Yes, for affected entities | Voluntary, often required by customers | Voluntary, common in public authorities and among their service providers |
| Focus | Risk management, reporting obligations, registration, management responsibility | Risk-based set-up of an ISMS, 93 controls in Annex A | Specific modules and requirements per system and process |
| Evidence | Evidence on request of the BSI, regularly for operators of critical facilities | Certificate from an accredited body, valid for 3 years with annual surveillance audits | ISO 27001 certificate based on IT-Grundschutz, issued by the BSI |
| Effort | Depends on size and sector | Medium, scales well | High, but very specific |
How does it fit together?
The frameworks complement each other. Anyone running an ISMS according to ISO 27001 or IT-Grundschutz already covers many NIS2 measures. Reporting obligations, registration and management duties still come on top.
Guidance, not legal advice.
Reporting deadlines for incidents.#
The clock starts when you become aware of a significant incident.
Early warning after 24 hours
Brief first information: incident detected, suspicion of an unlawful cause or cross-border impact?
Notification after 72 hours
Initial assessment of the incident, its severity, its impact and, as far as known, the cause.
Final report after one month
Detailed description, cause, measures taken and impact.
Deadline calculator.#
When do the reporting deadlines expire?
Guidance without legal advice. The BSI Act and the BSI's reporting requirements are decisive.
Management responsibility.#
Approve and supervise
The management must approve the risk management measures and supervise their implementation. Delegating is possible, handing over responsibility is not.
Build knowledge
Managing directors should take part in training regularly in order to assess risks and measures.
Liability
In the event of breaches of duty, the management can be held personally liable. Documentation protects.
Implementation roadmap.#
6 steps that have proven themselves.
Check applicability
Check sector and size. The BSI offers a tool for this.
Register
Affected entities register via the BSI portal.
Identify gaps
Compare risk analysis and inventory against the 10 measures.
Prioritise measures
First MFA, backups, patches, emergency plan, then depth.
Practise the reporting process
Who reports what within 24 hours? Play it through once.
Prove and repeat
Document, review regularly and update.
Frequently asked questions.#
Does NIS2 also affect my suppliers?
Indirectly, yes. Affected companies must take the security of their supply chain into account and pass requirements on in contracts. Smaller suppliers therefore also receive questionnaires and requests for evidence.
Is an ISO 27001 certification enough?
It covers many technical and organisational requirements, but does not replace registration, reporting obligations and management responsibility.
What about critical infrastructure?
Operators of critical facilities are also subject to stricter rules. Since 17 March 2026 the KRITIS Umbrella Act applies to physical protection, more under Protected infrastructure.
Are there other rules I should know?
Yes. The EU Cyber Resilience Act brings obligations for manufacturers of connected products, including reporting obligations. Which rules apply to you depends on your business model.
As of November 2026. Basis: Act implementing the NIS 2 Directive (BGBl. 2025 I No. 301) with the revised BSI Act. Guidance, not legal advice. Current details and the portal are available from the BSI: bsi.bund.de.
Questions about implementation?
Tell me which point is still open for you, and we will add it.