{"id":10112,"date":"2026-10-19T14:12:22","date_gmt":"2026-10-19T12:12:22","guid":{"rendered":"https:\/\/www.trusteddecisions.com\/?post_type=blog-new&#038;p=10112"},"modified":"2026-10-19T14:52:17","modified_gmt":"2026-10-19T12:52:17","slug":"nis2-2026","status":"publish","type":"blog-new","link":"https:\/\/www.trusteddecisions.com\/en\/blog\/nis2-2026\/","title":{"rendered":"NIS2 2026: Requirements, Reporting Obligations and Implementation for SMEs"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>NIS2<\/strong> is the EU directive for a high common level of cybersecurity. In Germany it has applied through the NIS2 Implementation Act since 6 December 2025, without a transitional period.<\/li>\n\n\n\n<li>According to the German Federal Office for Information Security (BSI), around 29,500 companies from 18 sectors are affected, including many mid-sized companies with 50 or more employees or more than EUR 10 million in annual turnover and balance sheet total.<\/li>\n\n\n\n<li>The core obligations: registration with the BSI, ten minimum risk management measures, a three-stage reporting procedure (24 hours, 72 hours, one month) and implementation and training obligations for management.<\/li>\n\n\n\n<li>Violations can result in fines of up to EUR 10 million or 2 percent of worldwide turnover. Managing directors are liable to their company for culpably caused damage.<\/li>\n\n\n\n<li>Anyone who wants to manage NIS2 rather than merely document it needs key figures, robust reporting and planned budgets.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Is NIS2?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 stands for the second directive on measures for a high common level of cybersecurity across the European Union. The abbreviation derives from Network and Information Security. The legal basis is <a href=\"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj\" target=\"_blank\" rel=\"noopener noreferrer\">Directive (EU) 2022\/2555<\/a>, which entered into force in January 2023.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Purpose of the NIS2 Directive: Securing Network and Information Systems in the European Union<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The aim of the directive is a uniform level of security for network and information systems in all member states. Cyberattacks on energy suppliers, hospitals and logistics companies have shown how heavily the economy and society depend on functioning IT. NIS2 responds with binding minimum requirements for risk management, incident reporting and governance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The focus is on the availability, integrity and confidentiality of the systems that entities use to provide their services. NIS2 therefore goes well beyond classic IT security and makes cyber resilience a matter for corporate management: it is about business continuity, crisis management and securing the entire supply chain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the readers of our blog, NIS2 is above all a management task. You can find the fundamentals of protection against cyber threats in our article on <a href=\"https:\/\/www.trusteddecisions.com\/en\/blog\/cybersecurity-companies-recognize-risks-avoid-damage\/\">cybersecurity in companies<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Distinction from GDPR, DORA and Critical Infrastructure Rules<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 does not stand alone but is part of a dense regulatory framework. The GDPR protects personal data, whereas NIS2 protects the functioning of systems and services. A security incident can therefore trigger both a notification to the data protection authority and a report to the BSI, each with its own deadlines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For banks, insurers and other financial entities, the requirements of the Digital Operational Resilience Act (DORA) largely take precedence. Operators of critical facilities must additionally meet the specific requirements of Section 31 of the German BSI Act. Companies subject to several sets of rules should design processes and evidence so that they are collected once and used several times.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">From the NIS Directive to the NIS2 Directive: What Has Changed<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 replaces the first NIS Directive from 2016. The most important changes at a glance:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Broader scope:<\/strong> Instead of a small number of critical infrastructure operators, 18 sectors are now covered, including manufacturing, food, chemicals and waste management.<\/li>\n\n\n\n<li><strong>Size thresholds instead of individual designation:<\/strong> Companies must check for themselves whether they fall under the rules. Designation by an authority is no longer required.<\/li>\n\n\n\n<li><strong>Stricter obligations:<\/strong> A binding catalogue of risk management measures and a staged reporting procedure with short deadlines.<\/li>\n\n\n\n<li><strong>Management responsibility:<\/strong> Cybersecurity explicitly becomes a management task, with implementation, monitoring and training obligations.<\/li>\n\n\n\n<li><strong>Higher sanctions:<\/strong> Fines in the millions and extended supervisory powers for the authorities.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">The NIS2 Implementation Act in Germany<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As an EU directive, NIS2 does not apply directly but must be transposed into national law. In Germany this is done through the Act to Implement the NIS2 Directive, often referred to by its German abbreviation NIS2UmsuCG. It is an omnibus act that above all completely revises the <a href=\"https:\/\/www.gesetze-im-internet.de\/bsig_2025\/\" target=\"_blank\" rel=\"noopener noreferrer\">German BSI Act (BSIG)<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Timeline from the EU Directive to the German Implementation Act<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The implementation of NIS2 in Germany took considerably longer than planned:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>January 2023:<\/strong> The NIS2 Directive enters into force at EU level.<\/li>\n\n\n\n<li><strong>October 2024:<\/strong> The deadline for transposition into national law expires. Germany misses it, partly because the previous legislative period ended early.<\/li>\n\n\n\n<li><strong>5 December 2025:<\/strong> The NIS2 Implementation Act is promulgated in the Federal Law Gazette.<\/li>\n\n\n\n<li><strong>6 December 2025:<\/strong> The act enters into force. The new requirements apply from this day without a transitional period.<\/li>\n\n\n\n<li><strong>6 January 2026:<\/strong> The new BSI portal for registration and reporting goes live.<\/li>\n\n\n\n<li><strong>6 March 2026:<\/strong> The three-month registration deadline for entities affected since entry into force expires.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For companies this means: the obligations already apply. Anyone who has not yet started has an urgent need for action.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Planned Changes at EU Level<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The legal framework continues to evolve. In November 2025, the European Commission proposed a single entry point for incident reporting as part of the Digital Omnibus. In January 2026, this was followed by a proposal for targeted amendments to the NIS2 Directive itself, together with a revision of the EU Cybersecurity Act.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The proposals aim at a more clearly defined scope, relief for smaller companies and the possibility of demonstrating compliance through European certifications. The core risk management obligations are largely to remain in place. Until adoption, the existing legal framework applies unchanged. Companies should therefore monitor the changes but not wait for them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who Is Affected? Sectors, Thresholds and Entity Types<\/h2>\n\n\n\n<style>\n.td-kpi-box { --td-gold: #C9A75F; --td-gold-deep: #9E7D42; --td-dark: #3C4B53; --td-heading: #F2F1EE; --td-text: #A9B4BA; background: linear-gradient(158deg, #273238 0%, #1A2226 100%); color: var(--td-text); font-family: \"Open Sans\", \"Helvetica Neue\", Arial, sans-serif; padding: 46px 44px; margin: 40px auto; max-width: 900px; border-top: 1px solid rgba(201,167,95,0.45); border-radius: 2px; box-shadow: 0 24px 60px -20px rgba(0,0,0,0.55); }\n.td-kpi-header { display: flex; align-items: center; justify-content: center; gap: 14px; padding-bottom: 24px; margin-bottom: 32px; border-bottom: 1px solid rgba(255,255,255,0.09); }\n.td-kpi-header h3 { color: var(--td-heading); margin: 0; font-size: 1.1rem; font-weight: 600; text-transform: uppercase; letter-spacing: 1.6px; line-height: 1.4; }\n.td-kpi-icon { color: var(--td-gold); margin-right: 0; display: flex; align-items: center; }\n.td-kpi-grid { display: grid; grid-template-columns: repeat(6, 1fr); gap: 18px; }\n.td-kpi-card { background-color: rgba(255,255,255,0.035); border: 1px solid rgba(255,255,255,0.07); border-left: 2px solid rgba(201,167,95,0.45); border-radius: 2px; padding: 24px 24px 26px; grid-column: span 2; box-sizing: border-box; transition: background-color 0.25s ease, border-color 0.25s ease, transform 0.25s ease; }\n.td-kpi-card:nth-child(4), .td-kpi-card:nth-child(5) { grid-column: span 3; }\n.td-kpi-card:hover { background-color: rgba(255,255,255,0.065); border-left-color: var(--td-gold); transform: translateY(-3px); }\n.td-kpi-card strong { display: block; color: var(--td-gold); font-size: 0.8rem; text-transform: uppercase; letter-spacing: 1.1px; margin-bottom: 12px; font-weight: 700; }\n.td-kpi-card p { margin: 0; font-size: 0.88rem; line-height: 1.7; color: var(--td-text); }\n@media (max-width: 768px) {\n.td-kpi-box { padding: 28px 22px; }\n.td-kpi-header { justify-content: flex-start; text-align: left; }\n.td-kpi-header h3 { font-size: 1rem; }\n.td-kpi-grid { grid-template-columns: 1fr; }\n.td-kpi-card, .td-kpi-card:nth-child(4), .td-kpi-card:nth-child(5) { grid-column: span 1; }\n}\n@media (prefers-reduced-motion: reduce) {\n.td-kpi-card { transition: none; }\n.td-kpi-card:hover { transform: none; }\n}\n<\/style>\n<div class=\"td-kpi-box\">\n <div class=\"td-kpi-header\">\n <div class=\"td-kpi-icon\">\n <svg width=\"28\" height=\"28\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\"><line x1=\"18\" y1=\"20\" x2=\"18\" y2=\"10\"><\/line><line x1=\"12\" y1=\"20\" x2=\"12\" y2=\"4\"><\/line><line x1=\"6\" y1=\"20\" x2=\"6\" y2=\"14\"><\/line><\/svg>\n <\/div>\n <h3>NIS2 in Figures: What Decision-Makers Need to Know<\/h3>\n <\/div>\n <div class=\"td-kpi-grid\">\n <div class=\"td-kpi-card\"><strong>18 sectors<\/strong><p>Eleven sectors of high criticality and seven other critical sectors fall under the directive.<\/p><\/div>\n <div class=\"td-kpi-card\"><strong>Around 29,500 companies<\/strong><p>According to the BSI, this is how many entities in Germany are affected by the new obligations.<\/p><\/div>\n <div class=\"td-kpi-card\"><strong>24 h, 72 h, 1 month<\/strong><p>The three stages of the reporting obligation for significant security incidents.<\/p><\/div>\n <div class=\"td-kpi-card\"><strong>From 50 employees<\/strong><p>Or more than EUR 10 million in annual turnover and balance sheet total: from here, a company in a covered sector is an important entity.<\/p><\/div>\n <div class=\"td-kpi-card\"><strong>Up to EUR 10 million<\/strong><p>Fine ceiling for particularly important entities; with turnover above EUR 500 million, up to 2 percent of worldwide turnover.<\/p><\/div>\n <\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Whether a company falls under NIS2 depends on two questions: in which sector does it operate, and how large is it? Every company must assess its applicability itself.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The 18 Sectors of the NIS2 Directive<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The directive distinguishes eleven sectors of high criticality and seven other critical sectors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sectors of high criticality (Annex I):<\/strong> energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Other critical sectors (Annex II):<\/strong> postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Manufacturing in particular makes NIS2 relevant for mid-sized companies. It covers, for example, manufacturers of machinery, vehicles, electronic products and medical devices. Digital infrastructure also includes providers of cloud computing services and data centres. German law reflects these sectors in Annexes 1 and 2 to the BSI Act, while the federal administration is regulated separately.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Particularly Important and Important Entities<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">German law distinguishes two types of entity. The directive refers to essential and important entities. The German BSI Act uses the terms particularly important entities and important entities instead.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Particularly important entities<\/strong> under Section 28 of the BSI Act are primarily companies from Annex 1 sectors with at least 250 employees or more than EUR 50 million in annual turnover and more than EUR 43 million in annual balance sheet total. Operators of critical facilities are considered particularly important entities regardless of their size, as are certain providers of telecommunications and trust services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important entities<\/strong> are companies from the sectors in Annexes 1 and 2 that employ at least 50 people or have an annual turnover and an annual balance sheet total of more than EUR 10 million each, provided they are not already particularly important.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The distinction mainly affects supervision and the level of fines. The risk management and reporting obligations apply to both groups.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Checking Applicability: What Affected Companies Need to Clarify Now<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Checking applicability is the first step. You should clarify the following points:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In which sector does the business activity lie, covering not only the core business but all relevant activities?<\/li>\n\n\n\n<li>Which headcount, turnover and balance sheet total are decisive, also taking affiliated companies into account?<\/li>\n\n\n\n<li>Is the company an operator of a critical facility?<\/li>\n\n\n\n<li>Is it a supplier or service provider to an affected entity?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The last point is often underestimated. Suppliers do not automatically fall under NIS2. However, their customers must demonstrate supply chain security and pass requirements on contractually. Non-regulated organisations therefore also feel the effects of NIS2 in tenders, audits and contracts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Registration with the Federal Office for Information Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">All affected entities must register with the German Federal Office for Information Security (BSI). Under Section 33 of the BSI Act, the registration deadline is three months after an entity first falls under the rules. For companies affected since entry into force, it expired on 6 March 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Registration takes place in two steps:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>My Company Account (MUK):<\/strong> First, companies set up an organisation account based on an ELSTER certificate, as used in German tax procedures.<\/li>\n\n\n\n<li><strong>BSI portal:<\/strong> The actual registration then takes place in the BSI portal. Required information includes name, legal form, contact details, sector and entity type, as well as a reachable point of contact.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Anyone who has missed the deadline should register immediately. The obligation continues to apply, and failure to register can result in a fine. On its page on <a href=\"https:\/\/www.bsi.bund.de\/DE\/Themen\/Regulierte-Wirtschaft\/NIS-2-regulierte-Unternehmen\/nis-2-regulierte-unternehmen_node.html\" target=\"_blank\" rel=\"noopener noreferrer\">NIS2-regulated companies<\/a>, the BSI provides an applicability check and instructions. Changes to the information must be reported.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Registration is more than a formality. Reports of security incidents and BSI warnings will also be handled via the portal.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Risk Management Under Section 30 BSIG: Minimum IT Security Requirements<\/h2>\n\n\n\n<style>\n.td-table-wrapper { --td-gold: #C9A75F; --td-heading: #F2F1EE; --td-text: #A9B4BA; width: 100%; margin: 40px 0; overflow-x: auto; -webkit-overflow-scrolling: touch; background: linear-gradient(158deg, #273238 0%, #1A2226 100%); border-top: 1px solid rgba(201,167,95,0.45); border-radius: 2px; box-shadow: 0 24px 60px -20px rgba(0,0,0,0.55); }\n.td-table { width: 100%; min-width: 620px; border-collapse: collapse; font-family: \"Open Sans\", \"Helvetica Neue\", Arial, sans-serif; text-align: left; background: transparent; }\n.td-table th { background-color: rgba(255,255,255,0.03); color: var(--td-heading); padding: 18px 22px; font-weight: 600; text-transform: uppercase; font-size: 0.78rem; letter-spacing: 1.2px; line-height: 1.4; vertical-align: bottom; border-bottom: 1px solid rgba(201,167,95,0.45); }\n.td-table td { padding: 18px 22px; border-bottom: 1px solid rgba(255,255,255,0.07); color: var(--td-text); font-size: 0.88rem; line-height: 1.7; vertical-align: top; }\n.td-table tbody tr { transition: background-color 0.25s ease; }\n.td-table tr:nth-child(even) { background-color: rgba(255,255,255,0.025); }\n.td-table tbody tr:hover { background-color: rgba(255,255,255,0.065); }\n.td-table tr:last-child td { border-bottom: none; }\n.td-table td strong { color: var(--td-gold); font-weight: 700; }\n@media (max-width: 768px) {\n.td-table { min-width: 580px; }\n.td-table th { padding: 14px 16px; font-size: 0.72rem; }\n.td-table td { padding: 14px 16px; font-size: 0.85rem; }\n}\n@media (prefers-reduced-motion: reduce) {\n.td-table tbody tr { transition: none; }\n}\n<\/style>\n<div class=\"td-table-wrapper\" tabindex=\"0\" role=\"region\" aria-label=\"The ten minimum measures under Section 30 BSIG\">\n  <table class=\"td-table\">\n    <thead>\n      <tr><th>Measure under Section 30(2) BSIG<\/th><th>Key question for management<\/th><th>Required data and evidence<\/th><\/tr>\n    <\/thead>\n    <tbody>\n      <tr><td><strong>Risk analysis and security policies<\/strong><\/td><td>Do we know our critical systems and risks?<\/td><td>Asset inventory, risk register, security policies<\/td><\/tr>\n      <tr><td><strong>Incident handling<\/strong><\/td><td>Can we detect and report an incident within 24 hours?<\/td><td>Incident process, reporting templates, incident logs<\/td><\/tr>\n      <tr><td><strong>Business continuity<\/strong><\/td><td>How quickly can we operate again after an outage?<\/td><td>Backup tests, contingency plans, recovery times<\/td><\/tr>\n      <tr><td><strong>Supply chain security<\/strong><\/td><td>Which suppliers are critical and how secure are they?<\/td><td>Supplier register, risk assessments, contracts<\/td><\/tr>\n      <tr><td><strong>Acquisition, development and maintenance<\/strong><\/td><td>Are vulnerabilities detected and closed promptly?<\/td><td>Patch status, vulnerability reports, release processes<\/td><\/tr>\n      <tr><td><strong>Assessment of effectiveness<\/strong><\/td><td>How do we know the measures are working?<\/td><td>Key figures, audit and test results<\/td><\/tr>\n      <tr><td><strong>Training and awareness<\/strong><\/td><td>Are employees and management trained?<\/td><td>Training records, participation rates<\/td><\/tr>\n      <tr><td><strong>Cryptography<\/strong><\/td><td>Are sensitive data and connections encrypted?<\/td><td>Cryptography policy, key management<\/td><\/tr>\n      <tr><td><strong>Human resources security and access control<\/strong><\/td><td>Does everyone have only the rights they need?<\/td><td>Authorisation concept, recertifications<\/td><\/tr>\n      <tr><td><strong>MFA and secured communication<\/strong><\/td><td>Are critical accesses protected by multiple factors?<\/td><td>MFA coverage, communication policies<\/td><\/tr>\n    <\/tbody>\n  <\/table>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Risk management is the core of the NIS2 obligations. Particularly important and important entities must take appropriate, proportionate and effective technical and organisational measures. They are intended to prevent disruptions to the availability, integrity and confidentiality of their systems and to keep the impact of security incidents to a minimum.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Ten Minimum Measures<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Section 30(2) of the BSI Act lists ten measures that must be implemented as a minimum:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Policies on risk analysis and information security<\/li>\n\n\n\n<li>Incident handling<\/li>\n\n\n\n<li>Business continuity, backup management, disaster recovery and crisis management<\/li>\n\n\n\n<li>Supply chain security<\/li>\n\n\n\n<li>Security in the acquisition, development and maintenance of systems, including vulnerability handling<\/li>\n\n\n\n<li>Assessment of the effectiveness of risk management measures<\/li>\n\n\n\n<li>Training and awareness<\/li>\n\n\n\n<li>Use of cryptography<\/li>\n\n\n\n<li>Human resources security, access control and management of ICT systems<\/li>\n\n\n\n<li>Multi-factor authentication and secured communication<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The measures should reflect the state of the art, take relevant European and international standards into account and be based on an all-hazards approach. This means that in addition to cyberattacks, physical risks, technical failures and human error also count.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Proportionality is decisive. Risk exposure, company size, implementation costs and the likelihood and severity of potential incidents must be weighed. Compliance must be documented. For certain digital providers, such as cloud computing service providers, the technical requirements of a Commission regulation, Implementing Regulation (EU) 2024\/2690, also apply.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Supply Chain Security<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Supply chain security is one of the most demanding requirements. Entities must manage the security-related aspects of their relationships with their direct suppliers and service providers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, this means a register of critical suppliers, a risk assessment for each supplier, contractual security requirements and regular reviews. Providers of ICT services, managed services and software components with direct access to systems are particularly relevant.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reporting Obligations for Security Incidents<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 introduces a staged reporting procedure. Significant security incidents must be reported to the BSI in three stages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Initial report within 24 hours:<\/strong> Without undue delay, no later than 24 hours after becoming aware, stating whether unlawful or malicious action is suspected and whether cross-border effects are possible.<\/li>\n\n\n\n<li><strong>Report within 72 hours:<\/strong> An update with an initial assessment of the incident, its severity and impact, as well as indicators of compromise where available.<\/li>\n\n\n\n<li><strong>Final report after one month:<\/strong> No later than one month after the 72-hour report, a detailed report follows covering the cause, measures taken and impact. If the incident is still ongoing, a progress report is due first.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">At the BSI&#8217;s request, interim reports may also be required. An incident is significant above all if it can cause severe operational disruption or financial loss, or cause considerable damage to third parties.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, the 24-hour deadline is the biggest hurdle. It requires clear responsibilities, availability at weekends and prepared reporting templates. Without a practised incident handling process, it can hardly be met.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Obligations and Liability of Management<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 explicitly makes cybersecurity a management responsibility. Under Section 38 of the BSI Act, the management of particularly important and important entities must implement the risk management measures and monitor their implementation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If they breach this duty, they are liable to their entity for culpably caused damage in accordance with the applicable company law. This responsibility cannot be fully delegated to the IT department or external service providers. Execution can be delegated, monitoring cannot.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, there is a training obligation: management must attend training regularly. They should be able to identify and assess risks and risk management practices and evaluate their impact on the entity&#8217;s services. The BSI has published guidance on this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For decision-makers, this results in a clear governance task: they need regular, understandable information on the status of measures, on risks and on incidents. An annual report from the IT department is not sufficient.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Fines and Supervision by the BSI<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The provisions on fines are set out in Section 65 of the BSI Act. For the most serious violations, for example of risk management or reporting obligations, the following applies:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Particularly important entities:<\/strong> Fines of up to EUR 10 million. With a worldwide total turnover of more than EUR 500 million, up to 2 percent of that turnover is possible.<\/li>\n\n\n\n<li><strong>Important entities:<\/strong> Fines of up to EUR 7 million or 1.4 percent of worldwide total turnover for companies with more than EUR 500 million in turnover.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Violations of the registration obligation are also subject to fines. The BSI can request evidence, order audits and issue binding instructions. Supervisory powers over particularly important entities are broader than over important entities, where the BSI acts mainly on specific occasions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Beyond the fine, the consequential damage often weighs more heavily: business interruption, loss of customer trust and exclusion from tenders in which clients require NIS2 compliance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Implementing NIS2 in Mid-Sized Companies: A Six-Step Roadmap<\/h2>\n\n\n\n<!-- HINWEIS: Titelbild-URL im CSS (.td-premium-cta-visual) durch das Artlist-Titelbild ersetzen: nis2-titelbild.webp -->\n<style>\n.td-premium-cta-split { display: flex; flex-direction: column; background-color: #FFFFFF; border-radius: 12px; overflow: hidden; max-width: 700px; margin: 60px auto; box-shadow: 0 15px 40px rgba(0,0,0,0.08); border-top: 5px solid #9E7D42; font-family: \"Open Sans\", -apple-system, sans-serif; }\n.td-premium-cta-visual { width: 100%; height: 300px; background-image: url('https:\/\/www.trusteddecisions.com\/wp-content\/uploads\/2026\/07\/Investitions-Controlling.webp'); background-size: cover; background-position: center; position: relative; overflow: hidden; }\n.td-premium-cta-visual::after { content: \"\"; position: absolute; top: 0; left: 0; width: 100%; height: 100%; background: linear-gradient(180deg, rgba(60, 75, 83, 0.2) 0%, rgba(255, 255, 255, 0.3) 100%); z-index: 1; }\n.td-premium-cta-content { padding: 50px 40px; display: flex; flex-direction: column; justify-content: center; align-items: center; background-color: #FFFFFF; text-align: center; }\n.td-premium-cta-logo { max-width: 200px; height: auto; margin-bottom: 25px; display: block; }\n.td-premium-cta-title { color: #3C4B53; font-weight: 700; font-size: 1.8rem; line-height: 1.3; margin-bottom: 20px; text-transform: uppercase; letter-spacing: 0.5px; position: relative; padding-bottom: 12px; }\n.td-premium-cta-title::after { content: \"\"; position: absolute; bottom: 0; left: 50%; transform: translateX(-50%); width: 80px; height: 3px; background-color: #9E7D42; border-radius: 2px; }\n.td-premium-cta-text { color: #555555; font-size: 1rem; line-height: 1.7; margin-bottom: 30px; max-width: 650px; }\n.td-premium-cta-text strong { color: #3C4B53; }\n.td-premium-cta-button { display: inline-block; background-color: #9E7D42; color: #FFFFFF !important; font-weight: 700; font-size: 1rem; text-transform: uppercase; letter-spacing: 1px; text-decoration: none; padding: 16px 35px; border-radius: 50px; border: 2px solid #9E7D42; transition: transform 0.3s ease, background-color 0.3s ease; box-shadow: 0 8px 20px rgba(158,125,66,0.15); }\n.td-premium-cta-button:hover { background-color: #3C4B53; border-color: #3C4B53; transform: translateY(-3px) scale(1.02); }\n@media (max-width: 768px) { .td-premium-cta-split { margin: 40px 15px; } .td-premium-cta-visual { height: 200px; } .td-premium-cta-content { padding: 35px 20px; } .td-premium-cta-title { font-size: 1.4rem; } .td-premium-cta-button { width: 100%; box-sizing: border-box; } }\n<\/style>\n<div class=\"td-premium-cta-split\">\n  <div class=\"td-premium-cta-visual\">&nbsp;<\/div>\n  <div class=\"td-premium-cta-content\">\n    <img decoding=\"async\" class=\"td-premium-cta-logo\" src=\"https:\/\/www.trusteddecisions.com\/wp-content\/uploads\/2023\/11\/cropped-TD-Logo-Transparent_250x76.png\" alt=\"Trusted Decisions Logo\" \/> \n    <span class=\"td-premium-cta-title\">Make Cyber Risks Manageable<\/span>\n    <p class=\"td-premium-cta-text\"><strong>Transparency for management:<\/strong> We bring your security and risk data together in reporting that lets you monitor NIS2 obligations, budget measures and demonstrate progress.<\/p>\n    <a class=\"td-premium-cta-button\" href=\"https:\/\/kontakt.trusteddecisions.com\/kontakt\/page_ghq1xw\/\">Get in Touch Now<\/a>\n  <\/div>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">The requirements seem extensive but can be approached in a structured way. A six-step approach has proven effective. The following steps build on one another:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Check applicability:<\/strong> Clarify sector, size and entity type and document the result.<\/li>\n\n\n\n<li><strong>Register:<\/strong> Set up a MUK account and complete registration in the BSI portal.<\/li>\n\n\n\n<li><strong>Carry out a gap analysis:<\/strong> Assess the status of each of the ten minimum measures and prioritise gaps.<\/li>\n\n\n\n<li><strong>Assign responsibilities:<\/strong> Appoint roles for information security, incident reporting and supplier management, and train management.<\/li>\n\n\n\n<li><strong>Implement and document measures:<\/strong> Close gaps according to risk, with clear deadlines and budgets.<\/li>\n\n\n\n<li><strong>Measure effectiveness:<\/strong> Define key figures, report regularly and practise the reporting procedure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">ISO 27001 as the Foundation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Many companies use an information security management system based on ISO 27001 or the BSI&#8217;s IT-Grundschutz as a basis. These compliance standards cover a large part of the risk management requirements with their security measures. However, they do not automatically fulfil all NIS2 obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Obligations specific to NIS2 include registration, the staged reporting procedure with fixed deadlines and the duties of management. Certification also does not replace checking whether the scope of the ISMS covers all relevant services and locations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Making Cybersecurity Manageable: Key Figures and Reporting for Management<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This is where many implementation projects stall. Measures are adopted and documented, but management does not receive an ongoing picture of whether they are working. This is exactly what the monitoring obligation in Section 38 of the BSI Act requires.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Effective management needs three elements. First, key figures that make the state of security measurable, such as the share of systems with multi-factor authentication, the time to close critical vulnerabilities, the training rate, the risk status of critical suppliers and compliance with reporting deadlines during exercises.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, reporting that consolidates this data from various sources and presents it clearly to management, for example in a dashboard. Third, the link to planning: security measures cost money and staff and therefore belong in the budget and medium-term planning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our article on <a href=\"https:\/\/www.trusteddecisions.com\/en\/blog\/cyber-risk-management-mit-qlik-corporate-planner-risiken-in-zahlen-fassen-2\/\">cyber risk management with Qlik and Corporate Planner<\/a> shows how cyber risks can be quantified and integrated into corporate management with Qlik and Corporate Planner. This turns NIS2 from a compliance exercise into part of corporate management, and management can demonstrate that it fulfils its monitoring obligation.<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions About NIS2<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What Exactly Is NIS2?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">NIS2 is EU Directive (EU) 2022\/2555 for a high common level of cybersecurity. It obliges companies from 18 sectors to carry out risk management, report security incidents and register. In Germany it is implemented through the NIS2 Implementation Act and the new BSI Act.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who Has to Implement NIS2?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Companies from the 18 covered sectors that employ at least 50 people or have more than EUR 10 million in annual turnover and annual balance sheet total. Operators of critical facilities and certain digital providers are affected regardless of their size.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Am I Affected by NIS2?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Companies must assess this themselves. The decisive factors are the sector of business activity and size in terms of employees, turnover and balance sheet total. The BSI offers an online applicability check for this purpose.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When Do NIS2 Obligations Apply to My Company?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As soon as a company meets the criteria, the obligations apply immediately. Registration with the BSI must take place within three months of the entity first falling under the rules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Since When Has NIS2 Applied in Germany?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The NIS2 Implementation Act entered into force on 6 December 2025. There is no transitional period for the substantive requirements.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What Happens If the Registration Deadline Was Missed?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The registration obligation continues to apply and registration should be completed immediately. Failure to register can be punished with a fine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which Reporting Deadlines Apply to Security Incidents?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Significant security incidents must be reported to the BSI within 24 hours as an initial report, within 72 hours with an initial assessment and no later than one month thereafter with a final report.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Are Managing Directors Personally Liable?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Management must implement and monitor the risk management measures. If they culpably breach this duty, they are liable to their company for the resulting damage under the applicable company law.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How High Are the Fines Under NIS2?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Particularly important entities face fines of up to EUR 10 million, important entities up to EUR 7 million. For companies with a turnover of more than EUR 500 million, up to 2 or 1.4 percent of worldwide turnover is possible.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is ISO 27001 Sufficient for NIS2?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An ISMS based on ISO 27001 is a good foundation and covers many risk management requirements. NIS2-specific obligations such as registration, reporting deadlines and management duties must be implemented in addition.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does NIS2 Also Apply to Suppliers?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not directly, unless the supplier meets the criteria itself. However, affected customers must manage the security of their supply chain and pass requirements on contractually.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways What Is NIS2? NIS2 stands for the second directive on measures for a high common level of cybersecurity<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":2,"featured_media":10106,"parent":0,"template":"","format":"standard","meta":[],"blog-tag":[],"blog-type":[135],"class_list":["post-10112","blog-new","type-blog-new","status-publish","format-standard","has-post-thumbnail","hentry","blog-type-ki-technologie"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/blog-new\/10112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/blog-new"}],"about":[{"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/types\/blog-new"}],"author":[{"embeddable":true,"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/users\/2"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/media\/10106"}],"wp:attachment":[{"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/media?parent=10112"}],"wp:term":[{"taxonomy":"blog-tag","embeddable":true,"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/blog-tag?post=10112"},{"taxonomy":"blog-type","embeddable":true,"href":"https:\/\/www.trusteddecisions.com\/en\/wp-json\/wp\/v2\/blog-type?post=10112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}