What NIS2 is
NIS2 is an EU directive on cybersecurity. In Germany it was transposed into the BSI Act by the NIS2 implementation law, in force since 6 December 2025. It obliges entities in certain sectors to implement security measures, report incidents and register with the Federal Office for Information Security (BSI).
Who is affected?
Two things matter: the sector and the size. Covered are, among others, energy, transport, health, water, digital infrastructure, IT services, manufacturing, food, waste management, chemicals and postal services. As a rule, companies from roughly 50 employees or more than 10 million euros in annual turnover and balance sheet total fall under it, with differences between "essential" and "important" entities. Suppliers and service providers of affected companies also feel the requirements in practice through contracts.
Whether you are affected should be checked against the sectors and thresholds in the law. The BSI provides aids for this. If in doubt, a short legal assessment helps.
What the law requires
- Risk management: documented measures including risk analysis, incident handling, backup and crisis management, supply chain security, access control and multi-factor authentication, encryption.
- Reporting duties: significant incidents must be reported in stages; under the directive with an early warning within 24 hours and a report within 72 hours.
- Management responsibility: management must approve and oversee measures and undergo training. Delegation does not remove responsibility.
- Registration: affected entities must register with the BSI.
- Sanctions: violations can lead to substantial fines.
What you can do now
- Check whether you are affected and document the decision.
- Clarify registration with the BSI if affected.
- Take stock: systems, services, permissions, suppliers.
- Identify gaps against the obligations and draw up a prioritised action plan.
- Put backup, emergency plan, multi-factor authentication and permission concept in order.
- Train management and assign responsibilities.
Support from INZOSO
We help with technical implementation: inventory, hardening, access and permission concepts, backup and emergency planning. Legal assessments are for specialist lawyers. This article is not legal advice and reflects the state of research; check deadlines and obligations against the current legal texts and BSI guidance.