What is NIS2?
The NIS2 Directive (Network and Information Security Directive 2) is an EU directive designed to strengthen cybersecurity. It replaces the original NIS Directive from 2016 and aims to establish a consistently high level of security for network and information systems across the European Union.
In Germany, the NIS2 Directive has been implemented through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). The Act entered into force on 6 December 2025 and introduced extensive amendments to the German Federal Office for Information Security Act (BSIG). As a result, many businesses are now subject to binding legal requirements for cyber risk management for the first time, as well as registration and reporting obligations depending on how they are classified.
Who does NIS2 apply to?
Compared with the previous NIS Directive, NIS2 significantly expands the range of businesses and organisations within its scope.
Depending on their activities, size and other legal criteria, businesses and organisations may be classified as either essential entities or important entities.
These include organisations operating in areas such as:
- Energy
- Healthcare
- Transport and logistics
- Digital infrastructure
- Financial services
- Public administration
- Food production
- Waste and water management
- Manufacturing of certain products
- IT and managed service providers
Certain businesses in the financial sector are subject to sector-specific requirements under the Digital Operational Resilience Act (DORA), which may take precedence over corresponding NIS2 requirements.
In addition to an organisation’s sector or activities, its size and specific legal provisions may also determine whether NIS2 applies. Each organisation should therefore assess its individual circumstances carefully.
Does NIS2 apply to my business?
A NIS2 applicability assessment can provide clarity on whether your business is classified as an essential or important entity and what obligations this entails. The assessment considers factors including your business activities, company size and any specific legal provisions that may apply.
What are the requirements of the NIS2 Directive?
NIS2 takes a risk-based approach. Its key requirements include:
- Information security risk management
- Measures to prevent and respond to security incidents
- Business continuity and emergency management
- Supply chain security
- Access and authorisation controls
- Multi-factor authentication and secure communications
- Assessing the effectiveness of security measures
- Documenting the measure implemented
Alongside technical measures, people also play an important role. Businesses should ensure that employees are aware of cyber risks and receive training appropriate to their responsibilities. Information security roles and responsibilities should also be clearly defined.
Senior management has a particularly important role to play. Management must support and oversee the implementation of the required security measures and is subject to specific training and accountability requirements.
What registration and reporting obligations apply?
Entities within the scope of NIS2 are subject to statutory registration and reporting obligations. Registration is completed via the designated BSI portal.
Significant security incidents must be reported to the BSI in accordance with the applicable legal requirements. Businesses should therefore establish clear processes for identifying, assessing and escalating incidents, as well as ensuring that they are reported within the required timeframes.
How can businesses implement NIS2?
Successful NIS2 implementation requires businesses to systematically assess the requirements, introduce appropriate measures, and regularly review and document their effectiveness.
A practical approach includes the following steps:
- Determine whether the business falls within the scope of NIS2 and how it should be classified under the regulation.
- Assess existing security measures and processes.
- Identify and evaluate cyber risks.
- Implement any missing technical, operational and organisational measures.
- Define clear responsibilities within the business.
- Provide employees and senior management with training appropriate to their roles.
- Establish processes for registration and reporting security incidents.
- Document the measures implemented and regularly assess their effectiveness.
Standards and frameworks such as ISO/IEC 27001 or the BSI IT-Grundschutz framework can help businesses structure their information security management and systematically address NIS2 requirements.
Frequently asked questions about NIS2
NIS2 is the revised EU cybersecurity directive. It significantly expands the range of regulated businesses and requires organisations within its scope to systematically manage cyber risks, implement appropriate security measures and report significant security incidents.
NIS2 may apply to businesses and organisations operating across a wide range of essential and important sectors. Whether a particular business falls within its scope depends primarily on its activities, size and any specific legal provisions that apply.
Many medium-sized businesses are subject to NIS2 requirements for the first time. However, there is no one-size-fits-all answer. Key factors include the organisation’s business activities, number of employees, turnover or balance sheet total, as well as any specific legal provisions that may apply.
A NIS2 applicability assessment considers factors such as the organisation’s business activities or relevant sector, its size and any specific legal provisions that may apply. This can be used to determine whether the organisation should be classified as an essential or important entity.
Germany’s NIS2 Implementation and Cybersecurity Strengthening Act entered into force on 6 December 2025. Businesses within its scope must therefore already take into account the applicable cyber risk management requirements as well as their registration and reporting obligations.
Registration under NIS2 is completed via the designated BSI portal. The specific registration and reporting obligations that apply depend on how the business is classified.
Existing ISO/IEC 27001 certification can provide a strong foundation for NIS2 implementation, as many of the structures and processes required for systematic information security management will already be in place.
However, ISO/IEC 27001 certification does not automatically mean that all NIS2 requirements have been met. Businesses should therefore carry out an additional gap analysis to identify and address any outstanding requirements.
Businesses that fail to comply with the legal requirements may face regulatory enforcement measures and fines. In addition, security incidents and compliance failures can have significant financial and reputational consequences.
Senior management also has explicit responsibilities under NIS2 for implementing and overseeing the required cybersecurity measures.
Questions about Pre-Employment Screening in the context of NIS2?
Would you like to learn how pre-employment screening can support risk minimisation within your organisation? We would be happy to advise you on risk-based screening processes and their implementation.