NIS2 Is Here.
Is Your Company Ready?

On December 6, 2025, the German NIS2 Implementation Act (NIS2UmsuCG)entered into force — over a year after the originally EU-wide binding deadline. Since then: companies in 18 sectors are obligated to maintain minimum cybersecurity standards, report incidents within 24 hours, and register with the BSI.

The registration deadline ended on March 6, 2026. Estimates suggest that at that point, more than half of affected companies had not even checked whether they fall under the regulation. The problem: there is no grace period. The technical and organizational obligations apply since entry into force — violators risk fines in the tens of millions and personal liability of the management board.

Why NIS2 hits mid-sized companies

The original NIS Directive from 2016 only regulated “critical infrastructure operators” — essentially energy suppliers, banks, and hospitals. NIS2 massively expands the scope: fundamentally, any company with at least 50 employees or €10 million annual revenue operating in one of the 18 sectors is affected.

That sounds narrow at first — but it includes machinery manufacturers, food producers, chemical companies, IT service providers, logistics companies, and many more. Even those not directly affected will feel it through the supply chain: NIS2-obligated companies must assess the security of their suppliers and service providers. Those who cannot provide this proof lose contracts.

The 10 minimum obligations from § 30 BSIG

NIS2 prescribes not only the “what” but also the “how.” The German BSIG (§ 30) lists ten risk management measures that every affected company must implement — regardless of size. The benchmark is the state of the art.

The new reporting chain: 24 / 72 / 1 month

One of the most impactful changes is the three-stage reporting obligation for significant security incidents:

• Within 24 hours — an early warning to the BSI with initial information about the incident.
• Within 72 hours — a more comprehensive incident report with damage assessment.
• Within one month — the final report with root cause, consequences, and measures taken.

These deadlines are non-negotiable. Failure to meet them is treated as if no report was filed at all — with full fine consequences.

Personal liability of the management board

NIS2 no longer addresses just the company, but directly the management. Managing directors and board members are personally responsible for ensuring risk management measures are implemented and monitored. They must complete mandatory cybersecurity training — and are liable for violations with their personal assets. Delegation to the IT department does not protect them.

What you should do now

The bad news first: a NIS2 program is not a weekend project. The good news: you are not the only one running late — and the BSI has signaled that companies demonstrably taking action will be treated differently from those ignoring the topic.

1. Clarify your affected status — documented

Have it formally assessed whether and how you are affected. The assessment must be documented in writing — in an audit, this is the first proof that you have engaged with the topic.

2. Complete BSI registration

The BSI registration portal remains accessible. A late registration is better than none. Being affected and not registered is a separate regulatory offense.

3. Gap analysis against the 10 obligations

Compare your current state against the ten obligations from § 30 BSIG. For most mid-sized companies, gaps emerge in supply chain security, incident response, cryptography, and access management.

4. Implement quick wins

Multi-factor authentication (MFA), a structured backup concept, and documented incident response processes can be implemented with limited effort and cover multiple obligations simultaneously. Companies using Microsoft 365 can achieve significant progress in just a few days with Conditional Access, Defender for Business, and Intune.

5. Document, document, document

NIS2 is an accountability obligation. Measures that are not documented do not exist from the BSI's perspective. Policies, processes, training records, test results — everything must be retained and producible on request.

Conclusion: Delay is no longer an option

The deadline has passed, obligations are active, fines are real. Those who wait now risk not only compliance but also contracts: large companies and public-sector clients are already beginning to require NIS2 conformity as a qualification criterion for suppliers. The good news: the required measures are nothing more than solid modern IT security — something your company benefits from regardless. NIS2 is the reason to finally get it done.

As a Managed Service Provider, we guide SMBs through NIS2 implementation: from the affected-status analysis to the gap analysis to the technical implementation of measures in your Microsoft 365 and Azure environment. We document every step in an audit-ready manner.