Content
The NIS 2 Directive expands European cybersecurity requirements. Affected companies must systematically manage security risks, report significant security incidents, and establish clear lines of responsibility. In Germany, the NIS 2 Implementation Act has been in effect since December 6, 2025. Companies should therefore assess whether they are affected and review the implementation of their obligations.
What is the NIS-2 Directive?
Directive (EU) 2022/2555, known as NIS 2 for short, establishes the European framework for a higher common level of cybersecurity. It expands the scope of regulated entities and strengthens requirements for risk management, incident reporting, and management-level accountability.
The directive entered into force on January 16, 2023. Member states were required to transpose it into national law by October 17, 2024. Germany implemented it late; today, the applicable BSI Act (BSIG) and relevant sector-specific regulations are particularly relevant for companies.
Which companies are affected?
The specific nature of the business, the size of the company, and any special regulations are key factors.
As a general rule, a company must fall under one of the facility types listed in Annexes 1 or 2 of the BSIG and must either:
- have at least 50 employees, or
- Have annual revenue and total assets of more than 10 million euros each.
Size alone does not determine whether an entity is covered. Certain entities, such as DNS service providers, may be covered regardless of size. In the case of corporate groups, data from affiliated companies may need to be included; statutory exceptions must be reviewed.
The BSIG distinguishes between particularly important facilities and important facilities. The classification is based on the type of facility, its size, and specific circumstances. For financial institutions, as well as certain energy and telecommunications companies, the respective special regulations must also be observed.
What security measures must companies implement?
Affected organizations must implement appropriate, proportionate, and effective technical and organizational measures and document their implementation. Factors to be considered include, among others, risks, company size, potential damages, and implementation costs.
The list of statutory minimum requirements includes:
- Risk analyses and safety concepts;
- Detection and response to security incidents;
- Backups, recovery, business continuity, and crisis management;
- Security of direct suppliers and service providers;
- secure procurement, development, and maintenance, as well as vulnerability management;
- regular assessment of the effectiveness of protective measures;
- Training and awareness-raising;
- Concepts in Cryptography and Encryption;
- Personnel security, access controls, and IT management;
- Secure authentication and communication.
Ein Informationssicherheits-Managementsystem, etwa auf Grundlage von ISO 27001 oder BSI-Grundschutz, kann die Umsetzung strukturieren. This does not imply a general requirement for ISO 27001 certification. Entscheidend ist, dass die jeweils geltenden Anforderungen tatsächlich erfüllt werden.
For certain digital service providers, additional specifications apply under Implementing Regulation (EU) 2024/2690. These include, among others, cloud providers, data centers, managed service providers, and managed security service providers. The regulation specifies both security measures and criteria for significant security incidents.
What registration and reporting requirements apply?
Registration must generally take place no later than three months after the incident occurs. The BSI provides the BSI Portal for this purpose.
The following generally applies to significant security incidents:
| Notice | Deadline |
|---|---|
| Early Initial Report | Immediately, no later than 24 hours after becoming aware of the matter |
| Detailed Incident Report | Immediately, no later than 72 hours after becoming aware of the incident |
| Interim Report | As required by the authorities |
| Closure Notice | No later than one month after the specific incident report has been filed |
In the event of ongoing incidents, a progress message initially replaces the completion message.
What responsibilities does management have?
Management must implement the necessary risk management measures and monitor their implementation. It must also regularly participate in training sessions to be able to assess cyber risks and protective measures.
Responsibilities can be delegated within the organization. However, the statutory management and oversight obligations remain in effect. In the event of a culpable breach of duty, management may be liable to its own institution for any resulting damages.
What are the potential consequences of violations?
The BSIG provides for different fines depending on the nature of the violation and the category of the facility. The following maximum limits apply to certain violations:
| Facility Category | Possible maximum fine |
|---|---|
| Particularly important institutions | 10 million euros; up to 2 percent for companies with total global revenue exceeding 500 million euros |
| Major facilities | 7 million euros; up to 1.4 percent for total worldwide revenue exceeding 500 million euros |
Revenue is calculated in accordance with legal requirements and includes the company to which the facility belongs. Lower maximum amounts apply to other violations.
How can companies assess their vulnerability?
The review should begin with the services actually offered. A sector designation alone is often too vague. A documented assessment that addresses the following questions is recommended:
- What specific services and products does the company offer?
- What types of legal entities are eligible for this?
- What size criteria and corporate affiliations should be taken into account?
- Do special provisions or sector-specific regulations apply?
- What obligations and responsibilities arise from this?
The results should be documented in a transparent manner and reviewed again in the event of significant changes to the company.
What measures should companies take now?
For practical implementation, a binding action plan is recommended:
- Clarify the scope of impact: Document and evaluate the type of facility, size specifications, and special cases.
- Verify registration: Ensure that the required information was submitted by the deadline.
- Prioritize security vulnerabilities: Compare existing protective measures with current requirements and designate responsible parties.
- Test incident response processes: Test reporting channels, substitutions, and escalations using realistic scenarios.
- Involve management: Organize decision-making, training, and regular reporting in a binding manner.
- Demonstrate effectiveness: Document measures, exercises, and improvements in a transparent manner.
A sustainable security process helps ensure compliance with regulatory requirements and minimizes the impact of cyberattacks on business operations.
Zurück zur Übersicht des Glossars