What is NIS2? The EU cybersecurity directive in plain words
NIS2 is Directive (EU) 2022/2555. It requires companies in 18 sectors, as a rule from 50 employees or with more than EUR 10 million each in turnover and balance sheet total, to register, take security measures in ten areas and report significant incidents. Management is responsible for this. Each EU country transposes the directive into its own law; in Germany it has applied since 6 December 2025 through the BSI Act (BSIG).
An EU directive
NIS2 stands for the second directive on the security of network and information systems. It was published in the EU Official Journal on 27 December 2022 and entered into force on 16 January 2023.
Its aim is a high common level of cybersecurity across the EU. It replaces the first NIS Directive (EU) 2016/1148, which was repealed on 18 October 2024.
A directive does not apply to companies directly. Each EU country transposes it into its own law. The deadline for that was 17 October 2024. Duties for your company only arise with that national law.
Art. 1, 41, 44 and 45 NIS 2
Who is in scope
A company is in scope if it works in one of the 18 sectors in Annexes I and II and is at least medium-sized: from 50 employees, or with an annual turnover and a balance sheet total of more than EUR 10 million each.
Some providers are in scope regardless of size, such as providers of telecommunications, trust services, top-level domains and DNS. The member states can identify further entities.
Art. 2 and 3 NIS 2 · Recommendation 2003/361/EC
Annex I: sectors of high criticality
- 01Energy
- 02Transport
- 03Banking
- 04Financial market infrastructures
- 05Health
- 06Drinking water
- 07Waste water
- 08Digital infrastructure, such as cloud, data centres and telecommunications
- 09ICT service management for businesses, such as managed services
- 10Public administration
- 11Space
Annex II: other critical sectors
- 01Postal and courier services
- 02Waste management
- 03Manufacture, production and distribution of chemicals
- 04Food: wholesale, industrial production and processing
- 05Manufacturing, such as machinery, electronics, medical devices and vehicles
- 06Digital providers: online marketplaces, search engines, social networks
- 07Research
Essential and important entities
The directive puts companies in scope into two groups. Size is counted under Recommendation 2003/361/EC; linked and partner enterprises can count too.
| Size | When | Result |
|---|---|---|
| Small | Fewer than 50 employees, and turnover or balance sheet total of EUR 10m or less | As a rule not in scope |
| Medium | From 50 employees, or turnover and balance sheet total above EUR 10m each | Important entity |
| Large | From 250 employees, or turnover above EUR 50m and balance sheet total above EUR 43m | Annex I: essential entity. Annex II: important entity |
The duties are the same for both groups. Supervision differs: the authority can inspect essential entities without a specific reason, important entities after the fact when there are indications of a breach (Art. 32 and 33 NIS 2).
The four duties
Register
You notify your company to the competent authority: name, address, contact details, IP ranges, sector and the countries you operate in. You report changes within two weeks.
Art. 3(4) NIS 2
Take security measures
Measures in ten areas, from handling incidents through backups and the supply chain to a second factor at sign-in. How thorough depends on risk, size and cost.
Art. 21 NIS 2
Report significant incidents
An early warning within 24 hours, an incident notification within 72 hours and a final report one month after the notification.
Art. 23 NIS 2
Management
Management approves the measures, oversees their implementation and attends training. It can be held responsible for breaches.
Art. 20 NIS 2
What applies to breaches
The directive requires each country to provide for fines with a maximum of at least EUR 10 million or 2 percent of worldwide turnover (essential entities), and EUR 7 million or 1.4 percent for important entities, whichever is higher.
German law sets the upper limits at EUR 10 and 7 million. A percentage of turnover only comes into play there above EUR 500 million turnover (§ 65 BSIG).
For essential entities, a person in management can, as a last resort, be temporarily prohibited from carrying out management duties. The directive does not provide for this for important entities.
As of our last check in August 2026, the BSI had not published any fine under the new BSIG.
Art. 32(5) and Art. 34 NIS 2 · § 65 BSIG
The fines in Germany in detailWhat changed from NIS 1
Under the first NIS Directive, the member states largely decided themselves which operators were covered. Under NIS2, sector and size decide, and companies check for themselves whether they are in scope.
New, among other things, are further sectors, fixed reporting deadlines in three stages, the duties of management and a minimum list of ten areas that includes the supply chain.
Art. 2, 20, 21, 23 and 44 NIS 2
In Germany and the other EU countries
In Germany, NIS2 applies through the NIS2UmsuCG, which rewrote the BSI Act. It entered into force on 6 December 2025. The competent authority is the BSI. There the essential entity is called “besonders wichtige Einrichtung” (particularly important entity).
In the other EU countries the national law applies, in the Netherlands for example the Cyberbeveiligingswet. The responsible country is the one where your company is established.
Art. 26 NIS 2 · BGBl. 2025 I no. 301
What this means for a company with 50 to 150 employees
In one of the 18 sectors, such a company is usually an important entity. At this size it is essential only in exceptions: in an Annex I sector with more than EUR 50 million turnover and more than EUR 43 million balance sheet total, as a telecommunications provider, or if the country identifies it as such.
It has the same four duties as a large company. But the measures only have to be as thorough as risk, size and cost require.
The authority only inspects an important entity when there are indications of a breach.
Art. 3, 21(1) and 33 NIS 2
An example
A made-up company: a packaging machine manufacturer with 110 employees in Germany.
Machinery manufacturing belongs to manufacturing in Annex II. With 110 employees, the company is an important entity.
It registers with the BSI, the competent authority in Germany.
It writes down what it works with, decides on measures in the ten areas and records in an incident response plan who reports an incident.
The managing director attends training, reads the documents and approves them.
How the walkthrough does this
The walkthrough at nisd2.eu takes you step by step through the duties.
20 steps. Operators of critical facilities have one more.
Next to each step is the law, explained in plain words.
Registration, measures, reporting and management training are steps of their own.
The registration step shows the competent authority for your country and its portal.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
Common questions
What is NIS2 in simple terms?
An EU directive on cybersecurity. It requires companies in important sectors to register, protect their IT appropriately and report significant incidents quickly. Management is responsible for this.
Is NIS2 a law?
NIS2 is a directive. It is addressed to the EU countries, which transpose it into their own law. In Germany that is the BSI Act (BSIG) as amended by the NIS2UmsuCG.
Who does NIS2 apply to?
To companies in the 18 sectors of Annexes I and II that are at least medium-sized: from 50 employees or with more than EUR 10 million each in turnover and balance sheet total. Some providers, such as DNS or trust service providers, are in scope regardless of size.
Since when has NIS2 applied?
The directive has been in force since 16 January 2023. For companies it applies through their country's law, in Germany since 6 December 2025.
What does NIS stand for?
Network and information systems. NIS2 is the second directive on their security.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 1 to 3, 20, 21, 23, 26, 32 to 34, 41, 44, 45 and Annexes I and II, EUR-Lex
- Commission Recommendation 2003/361/EC, EUR-Lex
- BSI Act (BSIG) § 65, gesetze-im-internet.de/bsig_2025
- NIS2UmsuCG, BGBl. 2025 I no. 301
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Incident Handling
Know how to report an incident
Three reports to your authority, with fixed deadlines.
Governance & Liability
Get management trained
Every member of management, regularly.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
