Supervision under Sections 59 to 62 BSIG

NIS2 Authority Communication: Supervision, Evidence and Working with the BSI

In Germany, the BSI has been the competent supervisory authority for essential and important entities since 6 December 2025 (Section 59 BSIG): you must be reachable via the BSI portal, keep your registration data current and handle evidence requests, information requests and orders on time.

  • 01Named contacts and deputies for every BSI request
  • 02Registration data kept current: changes reported within two weeks
  • 03Evidence ready for inspections under Section 61 BSIG
  • 04Reachable for BSI warnings and queries, also outside business hours
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

What BSI supervision under NIS2 means in practice

For essential and important entities established in Germany, the BSI is the competent supervisory authority (Section 59 BSIG) and the central reporting body and single point of contact (Section 40 BSIG). For cloud and data centre providers, managed service providers and similar digital providers it is competent only if their main establishment in the EU is in Germany (Section 60 BSIG, Article 26 NIS2).

Supervision depends on the category: for essential entities the BSI can order audits, inspect on site and request evidence (Section 61 BSIG, ex ante supervision as in Article 32 NIS2); for important entities it acts when facts indicate shortcomings (Section 62 BSIG, ex post as in Article 33 NIS2); operators of critical facilities provide evidence every three years (Section 39 BSIG).

Communication runs through the BSI portal, with access via ELSTER organisation certificates from "Mein Unternehmenskonto".

We define who speaks to the BSI, who manages portal access and who reports changes to registration data, build an evidence file for the measures under Section 30 BSIG, and support you through information requests, inspections and orders up to the remediation plan. Initial registration is covered step by step in our guide to NIS2 registration with the BSI; reporting deadlines and contents on our NIS2 reporting requirements page.

2 service modules

Service scope

01

Responsibilities and Channels to the BSI

We set up the organisational interface to the BSI: who receives requests, who decides, who answers and how deadlines are tracked, including BSI portal access and reachability for BSI warnings.

  • Name contacts and deputies for BSI requests
  • Manage BSI portal access via ELSTER organisation certificates
  • Ensure BSI warnings are forwarded at night and at weekends
  • Maintain registration data and track the two-week deadline
02

Evidence, Inspections and Orders

We prepare you for evidence requests and inspections and support you when the BSI requests information or documents or issues orders, from the first reply to verified completion of remediation.

  • Build an evidence file for the ten measures under Section 30 BSIG
  • Prepare inspections under Section 61 BSIG and critical facility evidence under Section 39 BSIG
  • Coordinate replies to information requests and orders and submit them on time
  • Draft remediation plans and evidence their completion

5 phases

Our Approach

We start with your classification and competent authorities and finish with a mock inspection, so the BSI's first real request is no surprise.

  1. Check classification, competent authorities and registration status

  2. Define roles, deputies and portal access

  3. Build the Section 30 BSIG evidence file and close gaps

  4. Rehearse procedures for information requests, inspections and orders

  5. Keep registration data and evidence current

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Why ADVISORI

  • 01Every obligation referenced to the section of the current BSI Act
  • 02Registration, reporting and supervision handled together
  • 03Inspection-ready documentation instead of slide decks
  • 04Management involved from the start, as Section 38 BSIG requires

Report changes within two weeks

If your name, legal form, address, contact details, public IP ranges, sector, Member States of activity or competent authorities change, you must notify the BSI without undue delay and at the latest within two weeks of becoming aware (Section 33(5) BSIG). Decide who spots such changes and enters them in the BSI portal.

Further reading

10 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about NIS2 Authority Communication

What obligations do NIS2 entities have towards the BSI?

Essential and important entities in Germany have five ongoing obligations towards the BSI: 1) registration within three months of coming into scope and notification of changes within two weeks (Section 33 BSIG), 2) reporting significant incidents to the joint reporting office (Section 32 BSIG; deadlines and contents on our NIS2 reporting requirements page), 3) documenting their risk management measures (Section 30(1) BSIG), 4) cooperating with inspections, evidence requests and orders (Sections 61 and 62 BSIG, plus Section 39 BSIG for operators of critical facilities), 5) regular training for management (Section 38(3) BSIG), which the BSI can also review.

How do you register with the BSI for NIS2?

Registration has two steps: first you apply for an ELSTER organisation certificate via "Mein Unternehmenskonto" (MUK), which requires a German tax number but not a seat in Germany; then you use it to register the entity in the BSI portal. Required data include name and legal form, contact details, public IP ranges, sector and subsector, the EU Member States where you operate and your competent authorities (Section 33(1) BSIG). Our guide to NIS2 registration with the BSI explains each step.

Which authorities are responsible for NIS2 supervision in Germany?

The competent supervisory authority is the BSI (Section 59 BSIG), which is also the central reporting body and single point of contact (Section 40 BSIG). For DNS and cloud providers, data centres, managed service providers, online marketplaces and similar digital providers it is competent only if their main EU establishment is in Germany (Section 60 BSIG). Financial entities within the scope of DORA are exempt from the BSI Act's risk management and reporting obligations and meet them under DORA (Section 28(6) BSIG). Operators of telecommunications networks and energy facilities are largely subject to sector-specific rules (Section 28(5) BSIG). Regional and local public administration is governed by state law.

How does a BSI inspection work?

It depends on the category. For essential entities the BSI can order audits, inspections or certifications by independent bodies, request evidence at the earliest three years after the Act entered into force (five years for approved hospitals) and inspect on site, in which case premises must be accessible, documents provided and information given (Section 61 BSIG). For important entities the BSI inspects when facts suggest obligations are not being met (Section 62 BSIG). Operators of critical facilities prove implementation every three years through audits, inspections or certifications (Section 39 BSIG). If shortcomings are found, the BSI can require a remediation plan and proof of remediation.

What happens if NIS2 registration is missing or late?

Failing to register, or registering incorrectly or late, is an administrative offence (Section 65(2) no. 6 BSIG) punishable by a fine of up to EUR 500,000 (Section 65(5) no. 5 BSIG). The BSI can also register the entity itself and request documents (Section 33(3) and (4) BSIG). The higher fines of up to EUR 10 million (essential) or EUR 7 million (important entities) apply to breaches of risk management and reporting obligations. The registration deadline is three months from the date an entity first or again falls within scope; for entities in scope when the Act entered into force on 6 December 2025 it ended on 6 March 2026. The BSI advises registering without delay if the deadline was missed.

NIS2 notification and GDPR notification: what is the difference?

A cyberattack can trigger both obligations at once. The GDPR requires a personal data breach to be notified to the data protection authority within 72 hours (Article 33 GDPR). The BSI Act requires an early notification of a significant incident to the BSI within 24 hours, even if no personal data are affected (Section 32 BSIG). The two notifications go to different authorities and must be made separately. If the BSI finds during supervision that a breach may lead to a notifiable personal data breach, it informs the data protection authorities (Section 61(11) BSIG).

Does our company have to be reachable by the BSI around the clock?

The BSI expects entities to be able to receive, review and assess its warnings and information. These are usually sent during business hours, but urgent warnings may in exceptional cases be sent at night, at weekends or on public holidays. The BSI therefore recommends internal forwarding processes, for example via a permanently staffed point such as reception or an on-call service, that can alert suitable contacts outside business hours.

Can a service provider communicate with the BSI on our behalf?

Yes. A service provider can submit reports for your entity using its own ELSTER organisation certificates that you authorise in the BSI portal. According to the BSI, responsibility for the incident and the content of the report remains with your entity. Larger organisations can manage registrations and certificates through a central unit.

What happens after you report to the BSI?

The BSI confirms receipt without undue delay and where possible within 24 hours, and on request provides guidance or operational advice on remediation (Section 36(1) BSIG). It can order you to inform the recipients of your services about the incident (Section 35 BSIG) and require you to inform the public where this is in the public interest (Section 36(2) BSIG). Follow-up questions from the BSI should be answered through named contacts.

What orders can the BSI issue to entities?

For essential entities the BSI can order measures to prevent or remedy an incident or shortcoming, require a remediation plan and progress reports, order customers to be informed about cyber threats and require infringements to be made public (Section 61(6) to (8) BSIG). If orders are not followed despite a deadline, the competent authority can, as a last resort, temporarily suspend authorisations and temporarily prohibit unreliable management from exercising their functions (Section 61(9) BSIG). For important entities these powers apply when facts indicate breaches (Section 62 BSIG).