What does NIS2 regulate?
NIS2 is the short name for Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaces Directive (EU) 2016/1148.
As a directive, NIS2 takes effect only through national law. The transposition deadline was 17 October 2024. In Germany, the BSI Act (BSIG) as amended by the NIS2 Implementation Act applies, in force since 6 December 2025.
The BSI expects around 29,500 supervised entities, up from about 4,500 before. The NIS2 guide covers the path from scope to implementation.
Who does NIS2 apply to?
Under § 28 BSIG, the BSIG distinguishes three groups:
| Category under the BSIG | Sectors | Size criterion |
|---|---|---|
| Operators of critical installations | installations above the thresholds of the BSI Critical Infrastructure Ordinance (BSI-KritisV) | regardless of company size |
| Besonders wichtige Einrichtungen (particularly important entities) | Annex 1 | at least 250 employees, or annual turnover above EUR 50 million and at the same time a balance sheet total above EUR 43 million (§ 28(1) no. 4) |
| Wichtige Einrichtungen (important entities) | Annex 1 and Annex 2 | at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million (§ 28(2) no. 3) |
Regardless of size, qualified trust service providers, top-level domain name registries and DNS service providers also count as besonders wichtige Einrichtungen. What is loosely called critical infrastructure is covered in the BSIG through the critical installation under § 2 no. 22 BSIG.
The directive speaks of essential and important entities; "essential" becomes "besonders wichtig" in the BSIG. The sector counts also describe the same thing from two sides: Annexes I and II of the directive make 18 sectors, Annexes 1 and 2 of the BSIG seven each. In Germany, the entity types in the BSIG annexes decide the classification.
How do you check whether your company is in scope?
The check follows three questions:
- Does the company carry out an activity that matches an entity type in Annex 1 or 2? Activities that are negligible in relation to the business as a whole may be disregarded (§ 28(3)).
- What are its headcount, annual turnover and balance sheet total under Recommendation 2003/361/EC? Figures of partner or linked enterprises are not added if the company is independent of them in the design and operation of its IT systems (§ 28(4)).
- Does a special rule apply: operating a critical installation, trust or DNS services, or an exemption for telecommunications, energy or financial entities (§ 28(5) and (6))?
Fictional example: a machinery manufacturer has 180 employees, EUR 38 million annual turnover and a EUR 30 million balance sheet total. Machinery manufacturing is listed in Annex 2 no. 5.4. With at least 50 employees, the company is a wichtige Einrichtung. It would not become besonders wichtig even with 300 employees, because its activity is listed only in Annex 2.
If it belongs to a group with 2,000 employees but runs its IT independently, only its own figures count. The figures are invented.
Record the result with date, data basis and reasoning. A company that counts as an entity must register with the BSI no later than three months afterwards under § 33(1) BSIG.
What duties does NIS2 trigger?
| Duty | Provision | Core |
|---|---|---|
| Registration | § 33 BSIG | no later than three months after entering the category; changes within two weeks (§ 33(5)) |
| Risk management measures | § 30(2) sentence 2 BSIG | ten items, including the supply chain, cryptography and multi-factor authentication; the act says "at least", so the catalogue is a minimum |
| Reporting significant security incidents | § 32 BSIG | staged procedure, see below |
| Management duties | § 38 BSIG | implement the measures, oversee their implementation, attend training regularly |
A training duty for staff is in § 30(2) sentence 2 no. 7, not in § 38. Under § 28(5) BSIG, §§ 30, 32 and 38, among others, generally do not apply to operators of public telecommunications networks and services and of certain energy installations. § 28(6) exempts financial entities under DORA from §§ 30, 32 and 38, among others; the rules for a financial entity under DORA apply to them instead.
Which reporting deadlines apply?
§ 32 BSIG governs, and its terms differ from the directive's: anyone writing "early warning" is quoting Article 23 of the directive, not the BSIG.
| Stage under § 32(1) BSIG | Deadline | Content |
|---|---|---|
| early initial report (no. 1) | 24 hours from becoming aware | suspected unlawful or malicious act, cross-border impact |
| report (no. 2) | 72 hours from becoming aware | initial assessment with severity and impact, indicators of compromise where available |
| intermediate report (no. 3) | only at the BSI's request | status updates |
| final report (no. 4) | one month after the report under no. 2 | detailed description, cause, remedial measures |
The 72 hours run from becoming aware, the month from the report under no. 2. Reports go to a joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance. If the incident is still ongoing when the final report is due, a progress report takes its place under § 32(2).
How does supervision differ?
The BSI can have besonders wichtige Einrichtungen audited without specific cause (§ 61 BSIG). For wichtige Einrichtungen, under § 62 BSIG it may examine compliance only when facts justify the assumption that duties are not being properly implemented. These are § 30(1) sentence 1, § 32(1) to (3) and § 38(3). The duties under §§ 30, 32, 33 and 38 apply to both groups.
NIS2 in Rizzqo
NIS2 is supported in Rizzqo. Its requirements are attached to the systems they apply to, such as VPN access or the email service. The right person answers each one and uploads evidence, and you see which requirements are met and which are still open.