NIS2: Directive, German Implementation Act and Duties for Companies

NIS2 replaces the first NIS Directive from 2016. It covers far more companies than before. Besides classic critical infrastructure operators, it now applies to many mid-sized firms in manufacturing, logistics and IT services. This page sums up the key points. At the end you will find in-depth articles on specific sectors and questions.

What is NIS2?

NIS stands for "Network and Information Security". The directive was published in the EU Official Journal at the end of 2022. Member states had to turn it into national law by October 2024. The goal is a high, uniform level of security for network and information systems across the EU.

Compared with the first NIS Directive, three things change most:

• More companies: instead of a few critical infrastructure operators, whole sectors above a certain company size are now covered.
• Clearer duties: the directive lists minimum measures and fixed reporting deadlines.
• Management responsibility: management must implement and oversee the measures and take part in regular training.

German NIS2 Implementation Act (NIS2UmsuCG) and the new BSIG

Germany implemented NIS2 with the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). It came into force on 6 December 2025. Its core is a fully revised BSI Act (BSIG), which sets out the duties for companies. The supervisory authority is the Federal Office for Information Security (BSI).

A note on terms: the EU directive speaks of "essential" and "important" entities. The German BSIG calls them "particularly important entities" (besonders wichtige Einrichtungen) and "important entities" (wichtige Einrichtungen).

Who is affected by NIS2?

Whether your company falls under NIS2 depends on two questions: which sector do you work in, and how large is your company? The sectors are listed in Annex 1 and Annex 2 of the BSIG.

Sectors

• Annex 1: energy, transport, finance, health, water, digital infrastructure (including data centers, cloud and managed service providers) and space.
• Annex 2: transport (postal and courier services), waste management, chemicals, food, manufacturing (for example medical devices, electronics, electrical equipment, machinery and vehicles), digital service providers and research.

Size: particularly important and important entities

• Particularly important entity: companies in Annex 1 with at least 250 employees, or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total. Regardless of size, this also covers operators of critical facilities, qualified trust service providers, TLD registries and DNS service providers.
• Important entity: companies in Annex 1 or 2 with at least 50 employees, or more than EUR 10 million in both turnover and balance sheet total, unless they are already particularly important.

The BSIG covers some providers regardless of size: providers of public telecommunications networks and services are particularly important entities from 50 employees or more than EUR 10 million in turnover and balance sheet total, and important entities below that. Non-qualified trust service providers are always important entities.

Under the EU SME recommendation, partner and linked companies generally count toward size. The BSIG makes an exception if your company is truly independent of them in its IT systems and processes. So check the whole group, not just a single legal entity. Your category mainly decides how closely the BSI supervises you and how high fines can be.

Which duties apply?

Risk management under Section 30 BSIG

Affected entities must take suitable and proportionate technical and organizational measures. The law names at least these ten areas:

1. Policies for risk analysis and IT security
2. Incident handling
3. Business continuity: backup management, disaster recovery and crisis management
4. Supply chain security for direct suppliers and service providers
5. Security in acquisition, development and maintenance, including vulnerability handling
6. Procedures to assess how effective the measures are
7. Basic cyber hygiene and training
8. Policies for cryptography and encryption
9. Personnel security, access control and management of IT systems
10. Multi-factor authentication and secured voice, video and text communication

Reporting duties under Section 32 BSIG

You report significant security incidents in fixed stages to the joint reporting office of BSI and BBK:

• Early warning: without delay, at the latest 24 hours after you become aware of the incident
• Incident notification: at the latest 72 hours after you become aware, with a first assessment of severity and impact
• Intermediate report: on request of the BSI
• Final report: at the latest one month after the 72-hour notification. If the incident is still ongoing, a progress report comes first.

To meet these deadlines, you need a practiced incident response process with clear roles.

Registration under Section 33 BSIG

Particularly important and important entities must register with the BSI at the latest three months after they fall under the law. For companies that were already affected when the law came into force, this deadline ended in March 2026. Registration runs through the BSI portal using "Mein Unternehmenskonto". You provide, among other things, company details, contact data, public IP address ranges, your sector and the member states you operate in. Changes must be reported within two weeks.

Management duties under Section 38 BSIG

Management must implement the risk management measures and oversee their implementation. If it breaches these duties culpably and the company suffers damage as a result, it is liable under the applicable company law. Management must also take part in training on a regular basis. Read more in our article on management liability under NIS2.

Fines

Section 65 BSIG sets high fines for breaches of the risk management and reporting duties:

• Particularly important entities: up to EUR 10 million, or up to 2% of worldwide turnover if total turnover exceeds EUR 500 million
• Important entities: up to EUR 7 million, or up to 1.4% of worldwide turnover if total turnover exceeds EUR 500 million
• Missing or late registration: up to EUR 500,000

Implementing NIS2: a six-step checklist

1. Check whether you are affected: compare the sector and size of your group with Annex 1 and 2. Record the result in writing.
2. Register: if you have not done so yet, register with the BSI right away.
3. Gap analysis: compare your current state with the ten areas in Section 30 and prioritize the gaps.
4. Set up the reporting process: who detects an incident, who assesses it, who reports within 24 hours? Define roles, templates and availability.
5. Map your supply chain: document critical service providers and add security requirements to contracts.
6. Involve management: have the measures approved, report regularly and document training.

NIS2 and ISO 27001

An ISMS based on ISO/IEC 27001 covers a large part of the measures in Section 30, such as risk analysis, access control, cryptography and business continuity. But it does not replace everything. Registration, the legal reporting deadlines and management duties need to be handled on top. Our article on multi-framework compliance with ISO 27001, NIS2 and BSI IT-Grundschutz shows how to combine several frameworks in one system.

Frequently asked questions about NIS2

Does NIS2 apply to small companies?

Usually only from 50 employees or more than EUR 10 million in turnover and balance sheet total. Some entities are covered regardless of size, for example DNS service providers or operators of critical facilities. Smaller suppliers are often affected indirectly: their customers must prove supply chain security and pass requirements on.

What is the difference between KRITIS and NIS2?

KRITIS operators run critical facilities whose failure would put the supply of the population at risk. Under NIS2 they are automatically particularly important entities and have extra duties. NIS2 also covers many companies that are not KRITIS operators.

We missed the registration. What now?

Register right away. Missing registration is an administrative offense. The other duties, such as risk management and reporting, already apply regardless.

Is ISO 27001 certification enough for NIS2?

It is a very good basis, but not automatic proof. Check the NIS2-specific points in particular: reporting deadlines, registration, supply chain and management duties.

In-depth articles on NIS2

• Management liability under NIS2
• NIS2 in mechanical engineering and the mid-market (IEC 62443)
• Hospitals between KRITIS, B3S and NIS2
• NIS2 and AI systems
• DORA, NIS2 and ISO 27001 at the same time
• NIS2-ready: health monitoring, audit log and alert rules

Support with implementation

Want to know whether NIS2 affects your company and what exactly you need to do? In our NIS2 consulting we check whether you are affected, run the gap analysis and support you with the reporting process, supply chain and management training.