NIS2 roadmap: seven steps to implement NIS2, for management
Seven steps, in the order they come up: check whether NIS2 applies, register with the BSI, train management, list what you have, bring in your suppliers, put the measures in place, and finally approve and oversee. Each step says who does it and which provision requires it.
Check whether NIS2 applies to you
Whether your company counts as an essential or important entity depends on sector, headcount and turnover. In Germany, the BSI's scope check takes you through the questions. The BSI states that its result is not legally binding. Where in doubt, a legal review of the individual case settles it.
- Legal basis
- Art. 2, 3 NIS 2 · § 28 BSIG (DE)
- Who
- Management or someone it appoints
Register with your authority
At the latest three months after your company comes into scope, you register it with the BSI, through the BSI portal with your company account. An existing ELSTER organisation certificate, for example from tax filings, can be reused. A new one is activated by letter; according to Mein Unternehmenskonto that takes at least five working days. If you have establishments in other EU countries, you register there too.
- Legal basis
- Art. 3(4) NIS 2 · § 33 BSIG (DE)
- Who
- Whoever holds the company account (ELSTER)
Train management
Every member of management attends training regularly, to identify and assess risks and risk management practices in information security. The law sets no interval. The explanatory memorandum reads “regularly” as training offered at least every three years. The law requires neither a minimum length nor an approval of the provider.
- Legal basis
- Art. 20(2) NIS 2 · § 38(3) BSIG (DE)
- Who
- Management, personally
List what you have and assess the risks
First the list: the software, devices, services and processes your operations depend on. Then, for each entry, what can happen and how serious it would be. How thorough you need to be depends on your company's size and risk (§ 30(1), second sentence, BSIG). What you decide, you record (third sentence).
- Legal basis
- Art. 21(2)(a), (i) NIS 2 · § 30(2) nos. 1, 9 BSIG (DE)
- Who
- IT lead, with the business departments
Bring in your suppliers
This means all direct suppliers and service providers, not only IT. Record who works for you, how much your operations depend on whom and what you have agreed with them on security.
- Legal basis
- Art. 21(2)(d) NIS 2 · § 30(2) no. 4 BSIG (DE)
- Who
- Procurement or IT lead
Put the measures in place and record them
§ 30(2) BSIG names ten areas, from handling security incidents through backups and the supply chain to a second factor at sign-in. How thorough each measure has to be depends on size and risk. You report significant incidents to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance: an early warning within 24 hours, an incident notification within 72 hours and a final report one month after the notification (§ 32(1) BSIG).
- Legal basis
- Art. 21, 23 NIS 2 · §§ 30, 32 BSIG (DE)
- Who
- IT lead or information security officer
Approve and oversee the implementation
Management is required to implement the measures and to oversee their implementation (§ 38(1) BSIG). The EU directive also requires it to approve the measures (Art. 20(1) NIS 2). The law does not set how often management reviews the status.
- Legal basis
- Art. 20(1) NIS 2 · § 38(1) BSIG (DE)
- Who
- Management, personally
What this means for a company with 50 to 150 employees
The seven steps apply to every company in scope. How much work each one takes depends on size and risk.
Two steps stay with management personally: the training, and the approval with the oversight. The others are usually done by the IT lead, procurement or an IT service provider.
The registration is the step with a fixed deadline: at the latest three months after your company comes into scope. The other duties apply from the same day.
§ 30(1), second sentence · § 33(1) · § 38 BSIG
An example
A made-up company: a packaging machinery manufacturer with 110 employees and one managing director.
Check: machinery manufacturing is listed in Annex 2 of the BSIG. With 110 employees, the company is an important entity.
Register: it already has an ELSTER organisation certificate for tax. It uses it to register in the BSI portal.
Train: the managing director attends a training course for management and records the date and content.
List: the IT manager writes down what the business depends on: ERP, design software, production control, email. For each entry he assesses what can happen.
Suppliers: procurement starts with the list from accounts payable. The IT service provider and the ERP vendor are at the top.
Measures: the security policy and the incident response plan come out of this. The plan also says who reports an incident.
Approve: the managing director reads the documents and approves them. Once a year he reviews the status with the IT manager; the company chose that interval itself.
How the walkthrough does this
The walkthrough at nisd2.eu takes you through implementation in this order, one step at a time.
20 steps. Operators of critical facilities have one more.
Next to each step is the law, explained in plain words.
What you cannot do yet, you set aside and carry on.
If you decide not to implement an item, you write down why. Management signs that decision too.
At the end, management approves the documents in the app, signed in with its own account. Name and date then appear on every document.
Common questions
What goes into a NIS2 roadmap?
Seven steps: check whether NIS2 applies, register with the BSI, train management, list what you have and assess the risks, bring in your suppliers, put the measures in place and record them, approve and oversee.
Which steps does management have to do itself?
The training and the oversight of implementation (§ 38(1) and (3) BSIG). It can hand over the rest of the work, but not the duty to make sure it happens.
What deadlines are there?
Registration is due at the latest three months after your company comes into scope (§ 33(1) BSIG). Significant incidents are reported within 24 hours, 72 hours and one month (§ 32(1) BSIG). The measures apply from the day your company comes into scope.
Do we need a certification such as ISO 27001?
The law does not require one. You put in writing what you implement (§ 30(1), third sentence, BSIG). A certificate can support your evidence.
Sources
- BSI Act (BSIG) §§ 28, 30, 32, 33, 38, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 2, 3, 20, 21, 23, EUR-Lex
- Explanatory memorandum to the NIS2UmsuCG, Bundestag printed paper 21/1501, p. 154 (on § 38(3))
- BSI: NIS 2 scope check, betroffenheitspruefung-nis-2.bsi.de
- Mein Unternehmenskonto: help on the ELSTER organisation certificate, info.mein-unternehmenskonto.de
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
