The New IT Security Obligation for German Companies
If you searched for 'IT Sicherheitspflicht', you are looking for NIS2. Since December 2025, the revised BSIG makes cybersecurity a legal obligation for roughly 29,500 German companies.
NIS2 Is the IT Security Obligation You Have Been Hearing About
There is no standalone 'IT security obligation law' in Germany. What exists is the NIS2 Directive (EU 2022/2555), transposed into German law through the NIS2UmsuCG, which overhauled the BSI Act (BSIG). This is the law that creates binding IT security obligations for companies in the sectors listed in Annexes 1 and 2 of the BSIG.
The BSIG entered into force on 6 December 2025. It requires affected companies to implement 10 specific cybersecurity risk management measures (Section 30 BSIG), register with the BSI, report significant incidents within strict timelines, and secure their supply chains. Under Section 38 BSIG, management must implement and oversee the measures and is liable to the company for damage it causes through fault.
If your company has 50 or more employees, or exceeds 10 million euros in both annual turnover and balance sheet total, and operates in one of the sectors listed in Annexes 1 and 2 of the BSIG, these obligations apply to you right now. The registration deadline was 6 March 2026.
Sector
Your company offers goods or services for payment in one of the sectors listed in Annexes 1 and 2 of the BSIG: energy, transport, finance, health, water, digital infrastructure (including managed IT and security services), space, postal and courier, waste, chemicals, food, manufacturing, digital services, research.
Employee Count
You have 50 or more employees. This follows the EU SME definition and includes all employees across the group, not just the German entity. Exception: partner or linked companies are not added if your IT runs independently of theirs (§ 28 Abs. 4 BSIG). Part-time employees count proportionally.
Annual Revenue
Your annual turnover exceeds 10 million euros AND your balance sheet total exceeds 10 million euros. If you exceed either the employee OR the financial threshold, you are in scope.
Critical Services
Some are in scope whatever their size: operators of critical facilities (KRITIS), trust service providers, TLD name registries and DNS service providers (§ 28 BSIG).
Register with the BSI
Register in two steps: first create an account at Mein Unternehmenskonto (mein-unternehmenskonto.de, uses an ELSTER organisation certificate), then register in the BSI portal (portal.bsi.bund.de). This is a legal obligation under Section 33 BSIG with its own penalty of up to 500,000 euros. The portal has been live since January 2026, and the deadline was 6 March 2026. If you missed it, register immediately.
Conduct a Risk Assessment
Identify your critical IT assets, assess the risks to each, and document treatment decisions. Section 30 BSIG requires risk management measures that are proportionate to the risk exposure. You need an asset inventory and a structured risk assessment before you can implement measures.
Implement 10 Security Measures
Section 30(2) BSIG names 10 areas: 1 risk analysis and security policies; 2 handling incidents; 3 keeping the business running (backups, recovery, crisis management); 4 supply chain security; 5 security when buying, developing and maintaining IT, including handling vulnerabilities; 6 checking whether the measures work; 7 basic training and awareness; 8 cryptography; 9 staff security, access control and asset management; 10 multi-factor authentication and secured communication. Each area requires documented policies and evidence of implementation.
Set Up Incident Reporting
Significant cybersecurity incidents must be reported to the BSI within 24 hours (initial early warning), 72 hours (full notification), and 1 month (final report). Define what a significant incident means for your company and establish a clear reporting chain before something happens.
Maintain Ongoing Compliance
NIS2 is not a one-time project. Keep the risk assessment current when things change, train management regularly (Section 38 BSIG requires personal participation; the law's explanatory memorandum reads 'regularly' as at least every three years), review suppliers, and keep monitoring for incidents.
Essential entities face fines of up to 10 million euros or 2% of global annual turnover. Important entities face up to 7 million euros or 1.4%. Registration violations alone carry fines of up to 500,000 euros. The BSI can order compliance (§§ 61, 62 BSIG). For particularly important entities that ignore its orders, the competent sector authority can, as a last resort, temporarily suspend a licence and temporarily bar unreliable managers (§ 61 Abs. 9 BSIG).
Beyond fines, Section 38 BSIG creates personal liability for management. Executives must implement cybersecurity measures, oversee implementation, and attend training regularly. They are liable to their own company for damage caused through fault, under the company-law rules for its legal form.
Frequently Asked Questions
Is NIS2 the same as the IT security obligation I keep hearing about?
Yes. There is no separate 'IT Sicherheitspflicht' law. NIS2 is the EU directive that was transposed into German law as the revised BSIG via the NIS2UmsuCG. When people talk about new IT security obligations for German companies, they mean this law. It has been in force since 6 December 2025.
We are a 60-person manufacturing company. Does this really apply to us?
Very likely yes. Manufacturing is listed in NIS2 Annex II (covering medical devices, electronics, electrical equipment, machinery, motor vehicles, and other transport equipment manufacturing). With 60 employees, you exceed the 50-employee threshold. You would be classified as a 'important entity' under Section 28(2) BSIG, and all NIS2 obligations apply.
The registration deadline has passed. What should we do?
Register immediately. First create an account at Mein Unternehmenskonto (mein-unternehmenskonto.de), then register in the BSI portal (portal.bsi.bund.de), which is still accepting registrations. Late registration is better than no registration. The fine for not registering is up to 500,000 euros (§ 65 BSIG).
Can our external IT provider handle NIS2 compliance for us?
They can help implement the technical measures, but the legal obligation stays with your company, even if your IT is fully outsourced. The BSI says so in its NIS-2 FAQ: you must make sure your providers implement the measures, check them regularly and see that incidents are reported. Your management remains responsible under Section 38 BSIG for implementing and overseeing the measures. You need to document what your IT provider does, verify their security measures, and include them in your supplier management process.
How much does NIS2 compliance cost for a mid-market company?
It depends on what you already have. The law asks for measures that fit your size and risk, and the cost of implementing them is one of the things weighed (§ 30 Abs. 1 BSIG).
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Decide how you rate risks
We recommend a ready-made risk assessment method.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
