NIS2 Is Here.
Is Your Company Ready?

On December 6, 2025, the German NIS2 Implementation Act (NIS2UmsuCG) entered into force — over a year after the originally EU-wide binding deadline. Since then: companies in 18 sectors are obligated to maintain minimum cybersecurity standards, report incidents within 24 hours, and register with the BSI.

The statutory registration deadline ended on March 6, 2026. Because only part of the affected entities had registered, the BSI set a grace period until July 31, 2026. By then, according to ZfK (August 2026), more than 19,000 entities had registered; the BSI reserves the right to impose fines. The technical and organizational obligations apply since entry into force — violators risk fines of up to €10 million and personal liability of management.

Why NIS2 hits mid-sized companies

The original NIS Directive from 2016 only regulated “critical infrastructure operators” — essentially energy suppliers, banks, and hospitals. NIS2 massively expands the scope: fundamentally, any company with at least 50 employees or more than €10 million annual revenue and balance sheet operating in one of the 18 sectors is affected (§ 28 BSIG). Some providers, such as DNS services or qualified trust services, are covered regardless of size.

That sounds narrow at first — but it includes machinery manufacturers, food producers, chemical companies, IT service providers, logistics companies, and many more. Even those not directly affected will feel it through the supply chain: NIS2-obligated companies must assess the security of their suppliers and service providers. Those who cannot provide this proof put contracts at risk.

The 10 minimum obligations from § 30 BSIG

NIS2 prescribes not only the “what” but also the “how.” The German BSIG (§ 30) lists ten risk management measures that every affected company must implement. They must be proportionate to size and risk and take the state of the art into account. See the wording of § 30 BSIG (German).

The new reporting chain: 24 / 72 / 1 month

One of the most impactful changes is the three-stage reporting obligation for significant security incidents:

• Within 24 hours — an early warning to the BSI with initial information about the incident.
• Within 72 hours — a more comprehensive incident report with damage assessment.
• Within one month — the final report with root cause, consequences, and measures taken.

The deadlines are set out in § 32 BSIG. Failing to report, or reporting incompletely or late, is a regulatory offense. In practice: decide in advance who reports, through which channel, and with what information.

Personal liability of the management board

NIS2 no longer addresses just the company, but directly the management. Managing directors and board members must approve the risk management measures and monitor their implementation (§ 38 BSIG). They must attend regular training — and are liable to their own company for culpably caused damage. Responsibility cannot be handed off to the IT department.

What you should do now

The bad news first: a NIS2 program is not a weekend project. The good news: you are not the only one running late. What matters is that you demonstrably start and document every step.

1. Clarify your affected status — documented

Have it formally assessed whether and how you are affected. The assessment must be documented in writing — in an audit, this is the first proof that you have engaged with the topic.

2. Complete BSI registration

Registration runs through the BSI portal and requires an ELSTER organization certificate via “Mein Unternehmenskonto”. Allow a few days for this. A late registration is better than none: being affected and not registered is a regulatory offense (up to €500,000, § 65 BSIG).

3. Gap analysis against the 10 obligations

Compare your current state against the ten obligations from § 30 BSIG. For most mid-sized companies, gaps emerge in supply chain security, incident response, cryptography, and access management.

4. Implement quick wins

Multi-factor authentication (MFA), a structured backup concept, and documented incident response processes can be implemented with limited effort and cover multiple obligations simultaneously. Companies using Microsoft 365 can make clear progress within a few weeks with Conditional Access, Defender for Business, and Intune.

5. Document, document, document

NIS2 is an accountability obligation. Measures that are not documented do not exist from the BSI's perspective. Policies, processes, training records, test results — everything must be retained and producible on request.

Conclusion: Delay is no longer an option

The deadlines have passed, obligations are active, fines are possible. Those who wait now risk not only compliance but also contracts: NIS2-obligated customers must assess their supply chain and therefore ask suppliers for evidence. The good news: the required measures are nothing more than solid modern IT security — something your company benefits from regardless. NIS2 is the reason to finally get it done.

As a Managed Service Provider, we guide SMBs through NIS2 implementation: from the affected-status analysis to the gap analysis to the technical implementation of measures in your Microsoft 365 and Azure environment, with traceable documentation of every step. A security audit costs €1,500 to €3,000 (excl. VAT). German companies can use BAFA consulting funding (up to 50% of consulting costs, max. €1,750; we are accredited).

Sources

• § 28 BSIG (thresholds), § 30 BSIG (measures), § 65 BSIG (fines) (German)
• BSI: NIS-2 regulated companies, registration and applicability check
• ZfK, August 4, 2026: grace period July 31, more than 19,000 registrations