www.simplify-data.de
Germany has transposed the EU's NIS2 Directive into national law. Far more companies than before are now subject to statutory cybersecurity obligations, including many mid-sized businesses that never had to deal with this before. This article explains who is affected, what needs to be done and where to find official information.
Please note: this article provides general information and is not legal advice. Whether your company is covered should be assessed against the statutory text and, where in doubt, with legal counsel.
What is NIS2 and when did it take effect?
NIS2 is the second EU directive on measures for a high common level of cybersecurity (Directive (EU) 2022/2555). Germany implemented it through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz, NIS2UmsuCG).
The Bundestag passed the act on 13 November 2025. It was published in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I No. 301) and entered into force on 6 December 2025. At its core is a fully revised BSI Act (BSIG), the law governing Germany's Federal Office for Information Security (BSI). According to the BSI, there is no general transition period: the obligations apply from entry into force.
The BSI estimates that around 29,500 companies and federal administration bodies are covered (as of November 2026).
Who is affected?
Whether a company falls under NIS2 depends on two factors: its sector and its size. The sectors are listed in two annexes to the BSIG.
Annex 1 (sectors of high criticality) includes, among others:
- Energy (electricity, gas, district heating, fuel and heating oil)
- Transport (air, rail, shipping, road)
- Banking, financial market infrastructure and health
- Water (drinking water, wastewater)
- Digital infrastructure, including cloud and data centre services, DNS services, managed service providers and managed security service providers
- Space
Annex 2 (other critical sectors) includes, among others:
- Postal and courier services
- Waste management
- Chemicals and food production and distribution
- Manufacturing, such as machinery, medical devices, electrical equipment, motor vehicles and computer equipment
- Digital service providers and research
Essential and important entities
The act distinguishes two categories. The thresholds are set out in Section 28 BSIG:
| Category | Sector | Size (one criterion is enough) |
|---|---|---|
| Essential entity (besonders wichtige Einrichtung) | Annex 1 | at least 250 employees, or annual turnover above EUR 50 million and balance sheet total above EUR 43 million |
| Important entity (wichtige Einrichtung) | Annex 1 or 2 | at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million |
Some entities are covered regardless of size, for example operators of critical facilities, qualified trust service providers, top-level domain registries and DNS service providers. Telecoms providers have their own thresholds.
One point is often overlooked: even if your company is not covered itself, NIS2 can reach you indirectly. Covered entities must address supply chain security and frequently pass requirements on to service providers and suppliers by contract.
The key obligations
Registration with the BSI
Covered entities must register with the BSI no later than three months after they first (or once again) fall under NIS2 (Section 33 BSIG). The process has two steps: first create an account with "Mein Unternehmenskonto" (MUK), the German government's business account, then register in the BSI portal. Changes to your details must be submitted without delay, and within two weeks at the latest.
For companies that were covered when the act took effect, the three-month period therefore ended in March 2026. If you missed it, register as soon as possible. If a company becomes covered later, for instance through growth, the period starts from that point.
Reporting significant incidents
If a significant security incident occurs, a staged reporting process to the BSI applies:
- Within 24 hours of becoming aware: early warning
- Within 72 hours: incident notification with an initial assessment, including severity, impact and indicators of compromise
- Within one month: final report
These deadlines are tight. You can only meet them if it is clear in advance who decides, who reports and what information is ready.
Risk management measures
Under Section 30 BSIG, covered entities must take appropriate and proportionate technical and organisational measures. The act lists at least ten areas, including:
- Risk analysis and security policies
- Incident handling
- Business continuity, such as backup management and crisis management
- Supply chain security
- Staff training and awareness
- Policies on cryptography and encryption
- Access control and asset management
- Multi-factor authentication and secured communication
Measures should reflect the state of the art and be documented. Standards such as ISO/IEC 27001 or the BSI's IT-Grundschutz can make evidence easier, but according to the BSI they do not replace a check against the statutory list of measures.
Management responsibility
NIS2 is explicitly a board-level matter. Under Section 38 BSIG, management must implement and oversee the risk management measures. If it breaches these duties, it is liable to its own organisation for culpably caused damage. Management must also attend training regularly. According to the BSI, responsibility stays with management even if IT is fully outsourced.
Supervision and fines
The BSI supervises compliance. It can request information, carry out audits and issue orders. According to the BSI, fines can reach EUR 10 million or 2 percent of total turnover for essential entities and EUR 7 million or 1.4 percent for important entities.
Checklist: what to do now
- Assess applicability: Compare your business activities with Annexes 1 and 2 of the BSIG and check the size thresholds. The BSI offers an applicability check on its website.
- Document the outcome: Record how you reached your conclusion, even if you are not covered.
- Register: If covered, create an MUK account and register in the BSI portal.
- Define the reporting process: Name responsible people and deputies and rehearse the 24-hour early warning.
- Take stock: Check which of the ten areas are already covered, for example MFA, backups and access control.
- Include your supply chain: Clarify with IT service providers which security services are contractually agreed.
- Train management: Schedule regular training for the executive team.
How Simplify Data can help
We support small and mid-sized companies in Kiel, Schleswig-Holstein and Hamburg with the technical side of security measures, for example with a zero trust network based on WireGuard and managed email. This does not replace a legal assessment of whether you are covered, but it gives you a structured way to tackle many of the measures in Section 30 BSIG. Explore our managed services