NIS2: implement the EU cybersecurity directive before the BSI audits you

NIS 2 is the EU directive on cybersecurity, transposed in Germany through the NIS 2 Implementation Act (NIS2UmsuCG). It obliges around 30,

000 companies from

18 sectors to run state-of-the-art risk management (Art. 21), to report security incidents to the BSI (24-hour early warning, 72-hour follow-up, one-month final report) and to register with the BSI. Management bodies are personally accountable; fines reach up to

10 million euros or

2 percent of global turnover.

Essential and important entities from

18 sectors, including energy, transport, banking, healthcare, water, digital infrastructure, IT service providers, public administration, postal services, waste, chemicals, food, manufacturing and research. As a rule of thumb: from

50 employees or

10 million euros in turnover in one of the sectors. Smaller companies can also be pulled into scope contractually as suppliers of affected customers. Our scope assessment settles applicability reliably.

The NIS2UmsuCG is in force; the BSI registration deadline expired on

6 March 2026, and late registrants should act immediately. The reporting obligations apply continuously: early warning within

24 hours of becoming aware of a significant incident, follow-up within

72 hours, final report within one month. The BSI has been actively auditing the Art.

21 measures since 2026; there is no transition period.

Annex I (sectors of high criticality): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space. Annex II (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing (including medical devices, electronics, machinery and vehicles), digital providers and research. Annex I companies from

250 employees generally count as essential entities; smaller and Annex II companies as important entities.

Three questions settle the first assessment: First, does your company belong to one of the

18 sectors in Annex I or II? Second, do you have

50 or more employees or more than

10 million euros in annual turnover? Third, are you an operator of critical facilities, a qualified trust service provider or a TLD registry (NIS 2 then applies regardless of size)? Two yes answers mean: very likely in scope. And even with three no answers, customer contracts can pass NIS 2 requirements down your supply chain. Our scope assessment delivers the legally reliable classification including BSI documentation.

Three non-delegable duties: First, management bodies must approve the Art.

21 risk management measures themselves and monitor their implementation. Second, they must attend regular cybersecurity training and be able to prove it. Third, they are personally liable for breaches of duty. For CISOs this means establishing reporting lines to management, delivering board-ready risk reports and organising the training obligation. Compliance officers anchor NIS 2 in the internal control system and in supplier governance.

Art.

21 obliges regulated companies to secure their supply chain. In practice they pass the requirements on contractually: security evidence, audit rights, incident notification duties, sometimes certifications. Suppliers of essential or important entities will therefore have to meet NIS 2 requirements without being in scope themselves. Proactive preparation becomes a sales argument: those who can provide evidence win tenders against unprepared competitors.