30,000 companies are in scope. Management is personally liable.

NIS2: implement the EU cybersecurity directive before the BSI audits you

NIS2 is binding law in Germany: risk management under Art.

  • 01Applicability settled reliably: essential or important entity, with BSI-ready documentation
  • 02Gap analysis against all ten Art. 21 minimum measures in two to three weeks
  • 03Reporting processes that pass the 24-hour test: playbooks, templates, exercises
  • 04Management body training with attendance evidence, as required by law
  • 05ISO 27001 and IT-Grundschutz are credited instead of rebuilt
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

What is NIS2? Obligations, deadlines and liability at a glance

The NIS2 Directive (EU 2022/2555) is Europe's framework for corporate cybersecurity and, since the German NIS2 Implementation Act (NIS2UmsuCG) entered into force, directly binding law: around 30,000 companies in Germany must run risk management according to the state of the art, report incidents within tight deadlines and hold their management bodies personally accountable. Eighteen sectors are in scope, from energy, transport and healthcare to digital infrastructure, manufacturing and food, divided into essential and important entities.

The short history: the first NIS Directive arrived in 2016, NIS2 entered into force at EU level in 2023, Germany transposed it with the NIS2UmsuCG, the BSI registration deadline expired on 6 March 2026, and the enforcement phase is running. Unlike earlier IT security laws there is no grace period: the obligations apply, the BSI audits, and fining practice is picking up speed.

The 18 sectors at a glance. Annex I (high criticality): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, B2B ICT service management, public administration and space. Annex II (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers (marketplaces, search engines, social networks) and research. The rule of thumb is the size threshold of 50 employees or 10 million euros in turnover; special rules apply to areas such as digital infrastructure regardless of size.

The core obligations under Art. 21: ten minimum measures ranging from risk analysis, incident handling, business continuity and supply chain security to cryptography, access control and multi-factor authentication. Added to this are the reporting obligations under Art. 23: early warning to the BSI within 24 hours, follow-up within 72 hours, final report within one month. Companies that missed the registration deadline should register immediately; the BSI can impose fines of up to 10 million euros or 2 percent of global turnover.

The sharpest lever is personal accountability: management bodies must approve the risk management measures, monitor their implementation and undergo regular training. Delegating this responsibility is excluded; breaches of duty can lead to personal liability. Cybersecurity is now unambiguously a board-level matter.

For companies that also fall under DORA (financial sector) or the Cyber Resilience Act (product manufacturers): the frameworks overlap in risk management and reporting, with DORA taking precedence as lex specialis. Mapping the requirements once saves duplicate work; our comparison pages on NIS2 vs DORA and CRA vs NIS2 show the exact boundaries.

ADVISORI supports you across the entire journey: applicability and scope assessment, gap analysis against Art. 21, implementation including ISMS integration, BSI registration and reporting processes, and management body training. Pragmatic, audit-proof and clearly prioritised.

We offer end-to-end NIS2 compliance solutions covering all aspects of the NIS2 Directive, from initial gap analysis to continuous monitoring.

6 service modules

Service scope

01

NIS2 scope and applicability assessment

Legally sound clarification within days: does your company fall under NIS2, as an essential or important entity, and which obligations follow in concrete terms.

  • Sector and size test under the NIS2UmsuCG including group perspective
  • Classification as essential or important with BSI-ready documentation
  • Derivation of the concrete obligation catalogue per classification
02

Gap analysis against Art. 21

Structured baseline against the ten minimum measures: from risk analysis and incident handling to supply chain security, MFA and cryptography.

  • Maturity rating per measure based on evidence, not self-assessment
  • Reconciliation with your existing ISMS (ISO 27001, BSI IT-Grundschutz)
  • Prioritised roadmap by risk, effort and audit relevance
03

Implementation of security measures

Delivery with your teams: policies, processes and technology, integrated into existing structures instead of building a parallel world.

  • Measure implementation along the roadmap with clear ownership
  • ISMS integration: existing certifications are credited, not duplicated
  • Evidence documentation that withstands BSI audits
04

BSI registration and reporting processes

Catch up on registration, set up and rehearse reporting channels: a 24-hour early warning only works with prepared playbooks.

  • BSI registration including late registration after missed deadlines
  • 24h/72h/1M reporting process with playbooks and templates
  • Incident response exercises with your teams
05

Management body training

NIS2 requires demonstrable training of management bodies. We train boards and managing directors compactly, liability-focused and documented.

  • Mandatory training under the NIS2UmsuCG with attendance evidence
  • Liability scenarios and oversight duties, hands-on
  • Board reporting: the right questions to ask your own organisation
06

Supply chain security and provider governance

Art. 21 demands supply chain security: we build the processes for supplier assessment, contract clauses and continuous monitoring.

  • NIS2 requirement catalogue for procurement and supplier contracts
  • Assessment of critical providers including cloud
  • Connection to outsourcing and third-party risk management

5 phases

Our Approach

We pursue a systematic, risk-minimizing approach to NIS2 compliance that combines technical excellence with strategic governance integration.

  1. Comprehensive current-state analysis and NIS2 gap assessment

  2. Design of tailored cybersecurity governance frameworks

  3. Phased implementation with continuous testing

  4. Integration into existing risk management structures

  5. Continuous optimization and compliance monitoring

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Our Strengths

  • 01In-depth NIS2 expertise and EU cybersecurity knowledge
  • 02Proven cybersecurity governance methodologies
  • 03Sector-specific critical infrastructure experience
  • 04Integrated risk management and compliance automation

The BSI has been auditing actively since 2026

The BSI registration deadline expired on 6 March 2026 and the enforcement phase is running: the BSI reviews evidence and can impose fines of up to 10 million euros or 2 percent of global turnover. Management bodies are personally accountable for implementing the risk management measures.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about NIS2 Consulting

What is NIS2 in simple terms?

NIS2 is the EU directive on cybersecurity, transposed in Germany through the NIS2 Implementation Act (NIS2UmsuCG). It obliges around 30,000 companies from 18 sectors to run state-of-the-art risk management (Art. 21), to report security incidents to the BSI (24-hour early warning, 72-hour follow-up, one-month final report) and to register with the BSI. Management bodies are personally accountable; fines reach up to 10 million euros or 2 percent of global turnover.

Who is affected by NIS2?

Essential and important entities from 18 sectors, including energy, transport, banking, healthcare, water, digital infrastructure, IT service providers, public administration, postal services, waste, chemicals, food, manufacturing and research. As a rule of thumb: from 50 employees or 10 million euros in turnover in one of the sectors. Smaller companies can also be pulled into scope contractually as suppliers of affected customers. Our scope assessment settles applicability reliably.

Which deadlines apply under NIS2 in Germany?

The NIS2UmsuCG is in force; the BSI registration deadline expired on 6 March 2026, and late registrants should act immediately. The reporting obligations apply continuously: early warning within 24 hours of becoming aware of a significant incident, follow-up within 72 hours, final report within one month. The BSI has been actively auditing the Art. 21 measures since 2026; there is no transition period.

Which 18 sectors fall under NIS2?

Annex I (sectors of high criticality): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space. Annex II (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research. Annex I companies from 250 employees generally count as essential entities; smaller and Annex II companies as important entities.

Am I affected by NIS2? The quick check.

Three questions settle the first assessment: First, does your company belong to one of the 18 sectors in Annex I or II? Second, do you have 50 or more employees or more than 10 million euros in annual turnover? Third, are you an operator of critical facilities, a qualified trust service provider or a TLD registry (NIS2 then applies regardless of size)? Two yes answers mean: very likely in scope. And even with three no answers, customer contracts can pass NIS2 requirements down your supply chain. Our scope assessment delivers the legally reliable classification including BSI documentation.

What does NIS2 specifically require from management?

Three non-delegable duties: First, management bodies must approve the Art. 21 risk management measures themselves and monitor their implementation. Second, they must attend regular cybersecurity training and be able to prove it. Third, they are personally liable for breaches of duty. For CISOs this means establishing reporting lines to management, delivering board-ready risk reports and organising the training obligation. Compliance officers anchor NIS2 in the internal control system and in supplier governance.

What does NIS2 mean for suppliers that are not regulated themselves?

Art. 21 obliges regulated companies to secure their supply chain. In practice they pass the requirements on contractually: security evidence, audit rights, incident notification duties, sometimes certifications. Suppliers of essential or important entities will therefore have to meet NIS2 requirements without being in scope themselves. Proactive preparation becomes a sales argument: those who can provide evidence win tenders against unprepared competitors.