Implementing NIS2.

Germany's NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) transposes Directive (EU) 2022/2555 into German law. It entered into force on 6 December 2025, with no transition period for risk management measures. The obligations are set out in the revised BSI Act. § 28 BSIG defines particularly important and important entities based on sector, company size and certain special cases.

The core obligation is in § 30(1) BSIG: appropriate, proportionate and effective technical and organisational measures to prevent disruptions to the availability, integrity and confidentiality of systems used for services and to minimise the impact of security incidents. § 30(2) BSIG lists ten measures that must be included as a minimum. For digital service providers such as cloud, data centre and managed service providers, the technical requirements of Implementing Regulation (EU) 2024/2690 take precedence. Operators of critical facilities have additional obligations under § 31 and § 39 BSIG.

Under § 38(1) BSIG, management must implement the measures and oversee their implementation. If management breaches this duty, § 38(2) BSIG makes it liable to its own entity for culpably caused damage under the applicable company law rules (internal liability). § 38(3) BSIG also requires its members to attend training regularly. The registration obligation under § 33 BSIG and reporting obligations under § 32 BSIG also apply.

Breaches of § 30 and § 32 BSIG, including failure to document compliance under § 30(1), sentence 3 BSIG, are punishable by fines under § 65 BSIG. The maximum is €10 million for particularly important entities and €7 million for important entities. If a company's worldwide total turnover exceeds €500 million, the limit is instead based on turnover: up to 2% for particularly important entities and up to 1.4% for important entities. Above that turnover threshold, this is always the higher amount.

Companies subject to NIS2 in Germany are classified under § 28 BSIG: the specific type of entity, company size and special inclusion rules are decisive. Annexes 1 and 2 list the activities in scope. An industry label alone therefore cannot answer the question, nor can employee numbers without examining the activity.

The applicability assessment considers the individual legal entity and its services. Under § 28(4) BSIG, partner and linked enterprises must also be taken into account; the provision contains an exception for companies with independent IT systems. Sector-specific rules under § 28(5) and (6) BSIG also form part of the assessment. The BSI recommends recording the decision and its grounds even when an entity is outside scope.

The BSIG combines the documentation obligation with supervisory powers. § 61 BSIG concerns particularly important entities; § 62 BSIG allows examination of important entities where there are relevant indications. A voluntary certificate can support documentation, but in the BSI's assessment does not replace evidence of all statutory duties. What matters is which entity, services and measures the evidence actually covers.

ISO 27001 and IT-Grundschutz can support the organisation of information security; the BSI describes ISO certification as a useful foundation for implementing the BSIG. Registration, statutory reporting channels and management duties still require separate consideration. Financial entities subject to DORA should examine the exceptions under § 28(6) BSIG.

A measure that has been implemented but not documented cannot be substantiated to the BSI. § 30(1), sentence 3 BSIG therefore makes documentation a separate obligation. According to its information package on documentation obligations, the BSI expects decisions for and against measures to be recorded with reasons, to be traceable to the risk analysis, and to show how management oversaw implementation.

For particularly important entities, the BSI may order audits, examinations or certifications and request evidence under § 61 BSIG; under § 61(3) BSIG, no earlier than three years after entry into force. For important entities, it examines compliance under § 62 BSIG where facts indicate a breach. The details of how the BSI will examine evidence have not yet been determined. What is certain is that anything to be presented during an examination must have been created beforehand.

Implementation becomes demonstrable when three things are connected: the statutory requirement, the measure used to meet it and the evidence substantiating implementation, each with an owner and date.

ISO/IEC 27001 certification provides a sound foundation, but in the BSI's view is not evidence of NIS2 compliance. Scope, risk treatment, reporting obligations and management duties may differ and should be examined separately.

If you have not yet established whether your entity falls under § 28 BSIG, start with the free applicability check. Record the result and the reasons for it. In its information package on documentation obligations, the BSI recommends documenting the assessment even if the outcome is negative, and may request this documentation under § 33(4) BSIG.

If you are in scope and registered, start with measure 1. The ten measures are the minimum content; risk analysis determines how thoroughly each must be implemented. The implementation check shows you in a few minutes how far you have progressed on each of the ten measures and where gaps remain.