Fundamentals
What does it all actually mean?
What is NIS 2?
EU Directive 2022/2555 explained in five minutes.
Section 30 BSIG: the ten cybersecurity measures
The ten risk management measures under Section 30(2) BSIG, their relationship to Article 21 NIS 2 and CIR (EU) 2024/2690, proportionality, and penalties.
§ 32 BSIG: the duty to report significant security incidents
Early warning within 24 hours, incident notification within 72 hours, final report one month later. What counts as significant, where you report, and the GDPR.
§ 38 BSIG: management's duties, subsection by subsection
Subsection 1 implement and oversee, subsection 2 liability under company law, subsection 3 regular training for management, with the wording.
CIR 2024/2690 — the technical regulation
The EU implementing regulation that operationalises NIS 2 for certain digital providers.
IT-Grundschutz and NIS 2
How the BSI standard relates to German NIS 2 implementation.
IT security duty explained
What directors legally owe — beyond NIS 2, also in corporate law.
Glossary
Terms around NIS 2, BSIG, CIR and cybersecurity.
Frequently asked questions
The questions we hear most often about NIS 2.
ENISA Technical Implementation Guidance and NIS 2
What the EU Cybersecurity Agency ENISA does under NIS 2, what the Technical Implementation Guidance (TIG) is and how it relates to Commission Implementing Regulation 2024/2690.
Significant incident under NIS 2 and CIR 2024/2690
Article 23(3) NIS 2 names two triggers. CIR 2024/2690 quantifies thresholds for certain digital providers. For other sectors the threshold remains unquantified.
The Cooperation Group under Article 14 NIS 2
What the NIS 2 Cooperation Group does: Member States, Commission, ENISA. Strategic cooperation, guidelines, peer reviews.
CSIRT Network and EU-CyCLONe under Articles 15 and 16 NIS 2
How national CSIRTs cooperate operationally and how EU-CyCLONe coordinates large-scale cyber crises.
Coordinated risk assessments of critical supply chains under Article 22 NIS 2
What Article 22 requires: joint EU assessment of cybersecurity risks for specific critical ICT supply chains by Cooperation Group, Commission and ENISA.
NIS 2 for the management body in five minutes
The shortest defensible summary of NIS 2 for the management body. What Article 20 requires, what auditors look for, what cannot be delegated.
What changed from NIS 1 to NIS 2
Broader scope, new governance duties, tougher reporting, higher fines. The key shifts between Directive 2016/1148 and 2022/2555.
What is the BSI?
Federal Office for Information Security, established under §1 BSIG. Under NIS 2 the competent authority, single notification point and operator of the national CSIRT.
The BSI reporting portal
One platform, two NIS 2 obligations: first-time registration under §33 BSIG and incident notification under §32 BSIG. Access via ELSTER organisation certificate.
What 'proportionate' really means in Art. 21(1) NIS 2
Six factors decide what proportionate means in your case: risk exposure, size, likelihood and severity of incidents, societal impact, state of the art, cost of implementation.
What 'without undue delay' really means on the NIS 2 24-hour clock
Art. 23(4)(a) NIS 2 has two clocks, not one. Without undue delay AND within 24 hours, both starting at awareness. §121(1) BGB defines 'unverzüglich' as 'ohne schuldhaftes Zögern'.
What is an asset under NIS 2?
An asset under NIS 2 is anything that processes, stores or transmits information your operations depend on. Art. 21(2) and CIR 2024/2690 require an inventory; BSI 200-2 §8.1 allows grouping identical objects.
What is an ISMS and do I need one for NIS 2?
An ISMS is the way an organisation manages information security. NIS 2 never uses the word but Art. 21(2) requires exactly what an ISMS does. ISO 27001 certification is not mandatory.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
