Germany's NIS-2 Implementation Act has been in force since December 6, 2025, and almost 30,000 companies and organizations are affected. The registration deadline expired long ago and the BSI is starting enforcement. Find out what applies now, what violations cost and how to build risk management, reporting processes and evidence in a structured way with our 7-step plan and the Aeneis ISMS app.
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
Germany's NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) came into force on December 6, 2025. There is no transition period: the obligations apply to affected companies with immediate effect.
The Act was published in the Federal Law Gazette on December 5, 2025 (BGBl. 2025 I No. 301) and has applied without a transition period since the following day. (Full text of the BSI Act, in German)
The Bundestag had passed the Act on November 13, 2025. The deadline for registering with the German Federal Office for Information Security (BSI) already expired on March 6, 2026 for organizations in scope at that time. At the end of September 2026, only around 20,000 of the almost 30,000 expected organizations had registered. The BSI has announced that it will take action against unregistered organizations in the fourth quarter of 2026, starting with formal hearings. Targeted audits with evidence requirements are to follow from 2027. A missed registration can be fined up to €500,000, missing risk management measures up to €7 million or €10 million. This applies all the more to operators of critical facilities (KRITIS): they are subject to the strictest obligations and must regularly prove their implementation to the BSI. Anyone who has not yet completed registration or the required measures should do so immediately and document it. (Source: BSI figures via ChannelPartner, October 2026)
Germany transposed the Directive around 14 months after the EU deadline (October 2024). That makes it all the more important to anchor risk management, reporting processes and management duties in a verifiable way now.
In the video, a NIS-2 expert from our partner SHD answers the key questions: from scope and deadlines to the ten risk management measures and executive liability.
1) Since December 2025, far more companies in Germany have been subject to NIS-2 obligations than under the previous critical infrastructure (KRITIS) rules.
2) Affected organizations fall into three groups:
The Act, in force since December 6, 2025, has significantly widened the circle of affected organizations. Besides companies in energy, health, transport, digital infrastructure and manufacturing, federal administration bodies are explicitly in scope for the first time.
3) These groups must carry out risk management, report security incidents, register with the BSI and meet further requirements. The registration deadline for organizations already in scope expired on March 6, 2026; organizations that newly fall into scope have three months (BSI).
4) Particularly relevant for executive management: it must approve the measures, oversee their implementation and undergo regular training (Section 38 BSIG). Breaches of duty can lead to personal liability.
5) There is no transition period: the Act has applied since December 6, 2025. Anyone, including KRITIS operators, who has not yet completed registration or the required measures is already in breach of the law and must expect hearings, audit orders and fines (Federal Government, ChannelPartner).
As an “important entity”, a mid-sized company with 400 employees and €50 million turnover risks fines of up to €7 million for NIS-2 violations.
In addition, management faces personal liability if it fails to meet its legal obligations.
Introducing an ISMS costs only a fraction of that and protects against fines, reputational damage and management liability.
.avif)
At first glance, NIS-2 fines look intimidating:
But these fines are just the tip of the iceberg.
The fine itself is expensive, but the hidden follow-up costs are usually many times higher.
Implementing NIS-2 properly not only saves money, it also secures your company's future viability and reputation.
As digitalization and connectivity grow, so does the risk of cyberattacks. Since the start of Russia's war against Ukraine, the threat level has risen once again. Ransomware, DDoS attacks and supply chain attacks are increasing steadily.
The NIS-2 Directive (EU 2022/2555) aims to ensure a consistently high level of cybersecurity across the EU. Germany transposed it with the “NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG)”, which came into force on December 6, 2025. The Federal Cabinet had adopted the government draft on July 30, 2025 (Federal Government).
The Act builds on the previous IT Security Act 2.0 and amends more than 26 existing laws (including the BSI Act, the Energy Industry Act, the Telecommunications Act and the Social Code). The BSI Act (BSIG) has been fundamentally restructured: well-known provisions such as “Section 8a BSIG” have been replaced by new ones, for example “Section 30 BSIG” on risk management measures.
While only a few hundred critical infrastructure (KRITIS) operators were regulated before, the BSI now expects almost 30,000 affected organizations in Germany (BSI via ChannelPartner). Under the Act in force since December 6, 2025, federal administration bodies are also explicitly in scope, not only operators of critical infrastructure.
The requirements are set out in Section 30 BSIG. Ten key areas of measures are mandatory:
In addition:
Reporting obligations for significant security incidents (initial report within 24 h, notification within 72 h, final report no later than one month after that) (Section 32 BSIG).
Duties of executive management: it must approve the measures, oversee their implementation, take part in regular training and is liable for culpable breaches of duty (Section 38 BSIG).
All ten measures serve the three protection goals of availability, integrity and confidentiality. Because the law describes them rather abstractly, we recommend starting with an information security management system (ISMS) based on ISO/IEC 27001 or BSI IT-Grundschutz. ISO 27001 contains 93 concrete controls that largely map to the NIS-2 measures, for example access restrictions or security zones in which a server room is better protected than an office.
At the beginning, concepts and evidence are the main focus. Over time, these concepts must then be turned into technical measures.
For emergencies, an ISMS alone is usually not enough, as it treats emergencies as just one of many topics. We additionally recommend a business continuity management system (BCMS), for example based on BSI Standard 200-4 or ISO 22301. It defines what to do when nothing works anymore and how to get your systems running again quickly.
“State of the art” means applying established frameworks such as ISO/IEC 27001, NIST or BSI IT-Grundschutz. Which measures are required depends on your risk situation.
Example: in one company an authorization concept may be sufficient, in another database encryption is state of the art.
Which parts of the company does NIS-2 apply to?
To the entire company, not just to individual departments.
Does implementation have to be proven?
There is no fixed deadline for full implementation; the obligations have applied since the Act came into force. Comprehensive evidence will be due after around three years, but the BSI has already announced targeted audits from 2027. By then you should not only have started but be able to show visible progress. Experience, for example from the KRITIS environment, shows that implementation alongside day-to-day business takes months to a year. And because around 30,000 companies are looking for support at the same time, those who start early have more options. The first step is a scope check or a maturity assessment.
It depends on the level. As a federal law, the NIS2UmsuCG covers federal administration bodies. Whether state authorities and municipalities must meet NIS-2 obligations is up to the federal states; some, such as Saxony, already have their own information security laws. Many state bodies and municipalities are also already required to implement BSI IT-Grundschutz.
Hardly. The NIS2UmsuCG follows the EU Directive very closely and does not make it stricter. Differences are mainly in wording and in how the sectors are named.
As a rule, from 50 employees or more than €10 million in annual turnover and balance sheet total, provided the company operates in one of the sectors listed in Annex 1 or 2 of the BSIG. For certain providers, such as qualified trust services, TLD registries and DNS service providers, NIS-2 applies regardless of size. The best way to clarify your status is the BSI scope check.
Register immediately, the deadline already expired on March 6, 2026. Registration takes two steps: first set up “Mein Unternehmenskonto”, which requires an ELSTER organization certificate sent by post that can take a few days. Then register in the BSI portal, which has been available since January 6, 2026. Since the fourth quarter of 2026, the BSI has been taking action against unregistered organizations, starting with formal hearings; a missed registration can be fined up to €500,000. Registering on your own initiative usually works in your favor compared to waiting for a hearing. (BSI: information for NIS-2-regulated companies, in German)
Significant security incidents must be reported to the BSI in stages: an initial report within 24 hours, a notification within 72 hours and a final report no later than one month after that (Section 32 BSIG). The reporting obligation also applies if registration is still outstanding.
It can be: executives are liable for damage caused culpably. To avoid this, executive management must approve the ten risk management measures under Section 38 BSIG, oversee their implementation and take part in regular training. A practical rule of thumb is at least a half-day training every three years on NIS-2, risk management and the impact of information security risks. Operational implementation can be delegated, responsibility cannot. Insurance against this risk exists, but insurers usually require the same measures as NIS-2 and, in case of doubt, only pay if they were implemented.
Indirectly, yes. Supply chain security is one of the mandatory measures under Section 30 BSIG. Affected companies must assess risks at suppliers and service providers and therefore often pass security requirements on contractually, including to companies that are not themselves subject to NIS-2.
With an ISMS based on ISO 27001, especially a certified one, you are in a very good position: almost all NIS-2 measures are already covered. Still, check the delta between ISO 27001 and NIS-2; the missing points are usually manageable. Pay particular attention to scope: many ISMS cover only part of the company, whereas NIS-2 looks at the entire company. Registration and reporting obligations apply in any case.
In the Aeneis ISMS app, you map risks, measures, security incidents and responsibilities centrally and link them to your business processes. Reports and analyses give you the evidence you need for executive management, audits and the BSI at any time.
Do you already meet the NIS-2 obligations fully and verifiably?
We show you how to implement, document and evidence the requirements to the BSI in a structured way with the Aeneis BPM & GRC software, saving a lot of time and effort.
The NIS-2 Directive is the updated version of the first NIS Directive and
aims to achieve a higher level of cybersecurity and resilience across the EU. To implement the obligations and be able to prove them at any time, companies should keep a few key points in mind. This guide shows you which steps to take and how you and your employees can implement NIS-2 securely in the ISMS app of the Aeneis BPM & GRC software.
Understand the specific requirements introduced by NIS-2, including the expanded scope and the new security and reporting obligations.
Check whether your organization qualifies as a particularly important or important entity. The registration deadline in the BSI portal expired in March 2026: complete a missing registration immediately.
In the ISMS app of the Aeneis BPM & GRC software, you can integrate entire manuals and make them available company-wide. You can also map your information security organization graphically and assign responsibilities clearly.
Your employees know exactly what their responsibilities and tasks are and can look up important standards, policies and requirements. Everything in one place, on one platform.
Assess network and information systems risks and identify where vulnerabilities could exist.
Create plans to minimize these risks, including implementing appropriate security measures.
Aeneis provides you with a risk management process to identify and correctly manage risks that may arise in the context of your cyber and information security. You can implement this process in three simple steps, from risk identification to risk analysis and risk treatment.
There, you can identify which risks may arise directly in your business processes, assess their criticality and develop a plan for treatment with appropriate measures.
Implement both technical and organizational measures to increase the security of your systems. This can include encryption, access controls, regular security audits, and more.
Security measures should be continuously assessed and adapted to new threats.
To maintain information security in your company, you can access a generic pool of measures in the GRC software Aeneis. This helps you to quickly start implementing security measures. When creating your own measures, you can access the pool of measures and directly assign the measure to employees for implementation. You can overview all measures in reports and thus adapt them continuously and quickly to changes.
Set up processes to report significant security incidents to the BSI on time: initial report within 24 hours, notification within 72 hours, final report no later than one month after that.
Make sure plans for managing security incidents are in place, including recovery plans.
Use the Aeneis ISMS software to document and manage your security incidents. In a dedicated area, you can record incidents in detail as required. The recorded incidents also reveal relevant training topics and help you refine your risks and measures.
Work with the BSI as the competent supervisory authority and with other relevant bodies.
Share information and best practices with other affected organizations within the EU.
Send your documented incidents, risks and measures to organizations and authorities. In the Aeneis BPM & GRC software, you can not only store content centrally but also generate print reports with just a few clicks. Export tables to Excel and save documents as PDF. This makes it easier to share information with relevant bodies and to provide evidence in audits.
Review regularly whether your measures are effective and report to executive management, which is responsible for implementation and oversight under Section 38 BSIG.
Use external audits to verify compliance and build trust with stakeholders.
Reports and analyses that present your security risks and measures in charts and tables let you check the state of your information security at any time. In the ISMS software, you document NIS-2 requirements verifiably and can prove them easily in audits. This increases security within your company and builds trust with customers and partners.
Train your employees regularly on cybersecurity and the NIS-2 requirements. Don't forget executive management: under Section 38 BSIG, it is itself obliged to undergo regular training, as a rule of thumb at least a half-day session every three years.
Run internal campaigns to raise awareness of cybersecurity and its importance.
In the Aeneis BPM & GRC software, you can document security incidents and derive directly where internal training is needed. You can also raise cybersecurity awareness among your employees by providing information centrally in Aeneis and involving them in implementing measures.
The NIS-2 Directive is EU-wide legislation that every Member State must transpose into national law. The aim is a consistently high level of cybersecurity across Europe.
Germany, Belgium, Denmark, Finland, Italy, Croatia, Latvia, Lithuania, Luxembourg, Malta, Romania, Slovakia, Slovenia, Hungary and Liechtenstein (as an EEA state).
Some Member States have not yet passed their laws or are still working on supplementary regulations. Check the current status for every country you operate in.
The European Cyber Security Organisation (ECSO) maintains an up-to-date NIS2 Transposition Tracker.
If you operate in several European countries, you need to keep an eye on NIS-2 not only in Germany but in every country where you have branches or business activities. Each country implements the Directive with its own laws and deadlines.
NIS-2 is a European issue. Internationally active companies should closely track the implementation status in each country and integrate the requirements into their own processes early on.
