NIS2 requirements: what your company has to put in place
NIS2 asks for security measures in ten areas, reporting of significant incidents and registration with the BSI. Management implements the measures and oversees them. How far each measure goes depends on your company's size and risk.
Programmes and memberships
The requirements at a glance
NIS 2 is an EU directive. In Germany, the BSI Act (BSIG) puts it into law. Companies in scope are called "entities" there.
Security measures in ten areas
The minimum list is below, each area with an example.
Art. 21 NIS 2 · § 30 BSIG
More on thisReport significant incidents
In three stages to the BSI, the first within 24 hours.
Art. 23 NIS 2 · § 32 BSIG
More on thisRegister with the BSI
Once, through the BSI's portal. If something changes, you report it within two weeks.
Art. 3(4) NIS 2 · § 33 BSIG
More on thisManagement
It implements the measures, oversees them and takes part in training regularly. The directive also requires management to approve the measures.
Art. 20 NIS 2 · § 38 BSIG
More on thisThe ten measures in plain words
Art. 21(2) NIS 2 names ten areas, in Germany § 30(2) BSIG. This is the minimum list. For each area you need measures that fit your company.
Risk analysis and security policy
You write down which IT your business needs and what can go wrong with it. From that follows a security policy: how your company manages information security.
For example: A list of your systems with a rating per risk, and a policy of a few pages.
Art. 21(2)(a) · § 30(2) no. 1
Incident handling
You decide how you detect, contain and resolve an incident, and who decides.
For example: An incident plan with phone numbers and clear responsibilities.
Art. 21(2)(b) · § 30(2) no. 2
Keeping the business running
Backups, recovery after an emergency and crisis management.
For example: A backup whose restore you have tried out.
Art. 21(2)(c) · § 30(2) no. 3
Supply chain security
You take into account each direct supplier's vulnerabilities and the quality of its products and security practice (Art. 21(3) NIS 2). Contracts are the usual tool.
For example: Your contract with your IT service provider says it reports incidents to you.
Art. 21(2)(d) · § 30(2) no. 4
Security when buying, developing and maintaining IT
Security already applies when you buy IT, when you develop your own and during maintenance. That includes fixing vulnerabilities and dealing with them openly, for example with an address where others can report vulnerabilities they find.
For example: Security updates install automatically.
Art. 21(2)(e) · § 30(2) no. 5
Assessing effectiveness
You decide how you check whether the measures work. The law does not prescribe tests or audits for every entity.
For example: Once a year, management goes through what worked and what did not.
Art. 21(2)(f) · § 30(2) no. 6
Basic training and awareness
All employees learn the basics: spotting suspicious emails, choosing good passwords, reporting incidents.
For example: A short training when people join and a refresher once a year.
Art. 21(2)(g) · § 30(2) no. 7
Cryptography
You decide where and how you encrypt.
For example: Laptops with encrypted disks, and email only over encrypted connections.
Art. 21(2)(h) · § 30(2) no. 8
Staff, access and managing IT
Who may do what? How do new people get their access, and how do leavers lose it? This includes an overview of your IT.
For example: All access is blocked on the last working day.
Art. 21(2)(i) · § 30(2) no. 9
Second factor and secure communication
Signing in with a second factor besides the password, or with continuous checking that the same person is still working. Also secured voice, video and text and, where needed, a secured channel for emergencies.
For example: A code from an app when signing in to email and remote access.
Art. 21(2)(j) · § 30(2) no. 10
How much is enough?
The law asks for appropriate, proportionate and effective measures (§ 30(1) BSIG). What is proportionate depends on your risk exposure, your size, the cost, how likely and severe incidents would be, and their consequences for others.
You write down what you put in place (§ 30(1), third sentence, BSIG). The law does not require a certificate such as ISO 27001. It can support your evidence, though.
What "proportionate" means exactlyAn example
A made-up company: a bakery products manufacturer with 120 employees that supplies retailers. Industrial food production is listed in Annex 2 of the BSIG, so the company is an important entity. This is its answer to three of the ten areas:
Supply chain: the company keeps a list of its service providers, for example for merchandise management, cold-chain monitoring and IT. The IT contract says the provider reports incidents.
Second factor: for email and remote access, everyone needs a code from an app.
Keeping the business running: recipes and production plans are backed up daily. Once a year, IT tries out the restore.
How the walkthrough does this
In the walkthrough at nisd2.eu, each of the ten areas becomes at least one step that you fill in.
Next to each step is the law, explained in plain words.
Where a document is needed, it comes out of your answers: security policy, incident response plan, business continuity plan, cryptography policy, staff, access and asset policy, and rules for buying, maintenance and vulnerabilities.
Where a list is enough, you keep a list: your IT, your suppliers, your backups, your training.
If you decide not to implement an item, you write down why. Management signs that decision too.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
Early warning
Whether the incident is suspected to come from an attack or an unlawful act, and whether it could affect other countries.
Incident notification
A first assessment of severity and impact, with signs of the attackers (indicators of compromise) where available.
Final report
One month after the notification: what happened, the likely cause and what you did about it.
Who checks, and when?
They prove their measures to the BSI through audits, inspections or certifications. First at a date the BSI sets, at the earliest three years after they count as operators, then every three years (§ 39 BSIG). They must also run attack detection systems (§ 31(2) BSIG).
No fixed audit cycle. You write down what you put in place (§ 30(1) BSIG). The BSI can check and order audits by independent bodies (§ 61(1) and (5) BSIG). It can ask for evidence from 6 December 2028 at the earliest (§ 61(3) and (4) BSIG).
You write down what you put in place. The BSI checks only when facts suggest that you do not comply with § 30, § 32 or § 38(3) BSIG (§ 62 BSIG).
- Internal or external audit reports
- Certifications, such as ISO 27001 or BSI IT-Grundschutz
- Your documentation: risk assessment, measures put in place and the check of their effectiveness
A certificate under ISO 27001 or IT-Grundschutz helps, but does not automatically cover the BSIG. The law can go beyond the scope of a certification.
- You take into account each direct supplier's vulnerabilities and the quality of its products and security practice, including its development (Art. 21(3) NIS 2).
- You agree security requirements with suppliers where it fits, usually in the contract. The explanatory memorandum names contracts as an example.
- Only for the digital providers covered by Implementing Regulation (EU) 2024/2690: they monitor changes in their suppliers' security practice at planned intervals (point 5.1.6 of the Annex).
Sources
- Directive (EU) 2022/2555 (NIS 2), Art. 3, 20, 21 and 23 (eur-lex.europa.eu)
- BSI Act (BSIG), §§ 30, 31, 32, 33, 38, 39, 61 and 62 (gesetze-im-internet.de/bsig_2025)
- BSIG, Annex 2, no. 4 production, processing and distribution of food
- Implementing Regulation (EU) 2024/2690, Art. 3 and Annex point 5.1.6
- German government bill for the NIS2UmsuCG, Bundestag printed paper 21/1501, explanatory memorandum to § 30
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Incident Handling
Plan what happens in an incident
Who decides, whom you call, how you reach each other.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.