Implementing NIS2: how a mid-sized company goes about it
You register your company with the BSI, put security measures in place in ten areas and report significant incidents. Management oversees this. How thorough each measure must be depends on your company's size and risk.
Programmes and memberships
The four duties
NIS 2 is an EU directive. In Germany, the BSI Act (BSIG) puts it into law. A company it applies to is called an "entity" there. Every entity has four duties.
Register
You register your company once with the BSI, through its portal.
- Law
- Art. 3(4) NIS 2 · § 33 BSIG
- Who
- Whoever manages the company's ELSTER account
Put measures in place and write them down
You protect your IT in ten areas, from the incident plan to signing in with a second factor. You write down what you decide.
- Law
- Art. 21 NIS 2 · § 30 BSIG
- Who
- Whoever is responsible for IT, in house or a service provider
Report significant incidents
You report a significant security incident to the BSI, the first report within 24 hours. An incident is significant, for example, when it seriously disrupts your operations.
- Law
- Art. 23 NIS 2 · § 32 BSIG
- Who
- Whoever decides in an emergency
Management leads
Management implements the measures and oversees them. It also takes part in training regularly. These duties fall on management itself.
- Law
- Art. 20 NIS 2 · § 38 BSIG
- Who
- Management, in person
What this means for 50 to 150 employees
You do not need your own security team. The law does not require one.
You do not need a certificate such as ISO 27001. The law does not require one, though it can help as evidence.
The measures must fit your company. The yardstick is your risk exposure, your size, the cost, and how likely and severe incidents would be (§ 30(1), second sentence, BSIG).
You write down what you put in place (§ 30(1), third sentence, BSIG). The measures must also be effective.
The work is done by people you already have: management, whoever is responsible for IT, and the departments that know what the business needs.
In what order
Each step builds on the one before.
- 1Check whether NIS2 applies to you. That depends on your sector, your headcount and your turnover (§ 28 BSIG).
- 2Register with the BSI.
- 3Get management trained.
- 4Write down which IT your business uses and who works for you. Then rate the risks.
- 5Decide the measures and record them as documents: a security policy, emergency plans and rules for access, updates and encryption.
- 6Management reads the documents and approves them.
- 7After that, check regularly that everything still fits.
An example
A made-up company: a maker of conveyor systems with 90 employees. One employee looks after IT, together with an outside service provider.
The check shows: machinery manufacturing is listed in Annex 2 of the BSIG. With 90 employees, the company counts as an important entity.
The managing director applies for an organisation certificate from ELSTER. Once the letter with the activation code arrives, he registers the company in the BSI's portal.
He takes a training course for management.
The IT employee writes down what the business depends on: ERP, email, design software, production control, backups. Then the suppliers, such as the IT service provider and the ERP vendor.
Together they rate, for each entry, what could happen. An outage of production control weighs most.
The documents come out of that: the security policy, an incident response plan, a business continuity plan, and rules for access, updates and encryption.
The managing director reads them and approves them. The incident response plan says who decides during an incident.
How the walkthrough does this
The walkthrough at nisd2.eu takes you through the implementation in this order, one step at a time.
20 steps. Operators of critical facilities have one more.
Next to each step is the law, explained in plain words.
Your answers produce six documents, among them the security policy and the two emergency plans.
What you cannot do yet, you set aside and carry on.
If you decide not to implement an item, you write down why. Management signs that decision too.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
Common mistakes
Waiting for final guidance
The BSIG has applied since 6 December 2025. The duty to take measures under § 30 BSIG has applied since then too.
Planning too big
The law asks for proportionate measures, not the largest possible ones. Attack detection systems, for example, are mandatory only for operators of critical facilities (§ 31(2) BSIG).
Leaving NIS2 to IT alone
Management must implement the measures and oversee them (§ 38(1) BSIG). Involve it from the start.
Forgetting suppliers
Supply chain security is one of the ten areas (§ 30(2) no. 4 BSIG). It covers all direct suppliers and service providers, not only IT.
Paper only
The law asks for effective measures (§ 30(1) BSIG). A document nobody knows about protects nothing.
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 3, 20, 21 and 23 (eur-lex.europa.eu)
- BSI Act (BSIG) of 2 December 2025, §§ 28, 30, 31, 32, 33 and 38, in force since 6 December 2025 (gesetze-im-internet.de/bsig_2025)
- BSIG, Annex 2, no. 5.4 machinery manufacturing (gesetze-im-internet.de/bsig_2025/anlage_2.html)
- BSI, Mein Unternehmenskonto and registration in the BSI portal (bsi.bund.de/dok/muk)
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.