Implementation
What do I actually need to do?
NIS 2 in six steps
The practical roadmap for management and IT leadership.
NIS2 requirements: what your company has to put in place
The ten measures under Art. 21 NIS 2 and § 30 BSIG in plain words, each with an example.
NIS2 reporting obligation: when and how to report incidents to the BSI
Early warning within 24 hours, notification within 72 hours, final report after one month (§ 32 BSIG).
Implementing NIS2: how a mid-sized company goes about it
The four duties, the order to do them in and who does what, with an example.
NIS 2 gap assessment
How to find your gaps between current state and required state.
NIS 2 documents and templates
Which evidence and policies you actually need.
NIS 2 registration portals across the EU
National registration authorities across all member states.
Cost of NIS 2 implementation
What does NIS 2 actually cost — consulting vs self-implementation.
NIS 2 supply chain security
Art. 21(2)(d) NIS 2 / CIR §5 — supplier assessment in practice.
NIS 2 risk management under Art. 21(2)(a)
What Article 21(2)(a) NIS 2 requires, what CIR §2 operationalises and what that means day to day.
Management body training under Art. 20(2) NIS 2
Art. 20(2) NIS 2 requires every member of the management body to complete cybersecurity training. What that means, what you must be able to prove, and how §38(3) BSIG implements it in Germany.
MFA requirement under Art. 21(2)(j) NIS 2 and CIR §11.7
Multi-factor authentication is its own obligation under Art. 21(2)(j). CIR §11.7 says where and how. What it means for privileged accounts and for all users.
Cryptography policy under Art. 21(2)(h) NIS 2 and CIR §9
Art. 21(2)(h) requires a cryptography policy. CIR §9 sets out what has to be in it: algorithms, key management, twelve points on the key lifecycle.
NIS 2 incident handling under Art. 21(2)(b) and CIR §3
What internal incident handling means (detect, contain, recover) and how it differs from the duty to report to the BSI.
NIS 2 business continuity under Art. 21(2)(c) and CIR §4
Business continuity plan, backup management, crisis management: what the directive asks for to keep operations running.
NIS 2 secure development under Art. 21(2)(e) and CIR §6
Security in procurement, development and maintenance of network and information systems. Eight CIR sub-sections.
NIS 2 vulnerability management under Art. 21(2)(e) and CIR §6.10
Identify, assess, treat and coordinate disclosure of vulnerabilities. What CIR §6.10 asks of the digital providers it covers.
NIS 2 effectiveness evaluation under Art. 21(2)(f) and CIR §7
How to measure whether risk management measures are working. KPIs, methodology, reporting to the management body.
NIS 2 cyber hygiene and training under Art. 21(2)(g) and CIR §8
Basic cyber hygiene practices plus awareness and role-specific training. What CIR §8 means in practice.
NIS 2 personnel security under Art. 21(2)(i) and CIR §10
Background checks, responsibilities, end of employment, disciplinary procedures.
NIS 2 asset management under Art. 21(2)(i) and CIR §12
Classification, handling, removable media, and the complete asset and value inventory.
NIS 2 access control under Art. 21(2)(i)+(j) and CIR §11
Access control policy, rights management, privileged accounts, identification, authentication. MFA as its own duty.
NIS 2 backup strategy under CIR §4.2
Backup and redundancy management: recovery times, storage locations, tests, retention periods.
NIS 2 network security under CIR §6.7 and §6.8
Network documentation, internal domains, secure communications, network segmentation and DMZ concepts.
NIS 2 logging and monitoring under CIR §3.2
Which twelve event types the CIR wants its digital providers to log, from network traffic to privileged access.
How do I conduct a NIS 2 risk assessment?
Step by step: asset scope, threat model, likelihood-impact, treatment plan, sign-off. What CIR §2 requires in practice.
How do I build a NIS 2 asset inventory?
Art. 21(2)(i) NIS 2 and § 30(2) No. 9 BSIG in practice: processes plus systems, Grundschutz grouping, CIA classification, and what CIR point 12.4 asks of the digital providers it covers.
How do I prepare for a BSI audit?
Which evidence the BSI asks for, in what order, with what documentation depth. What has to be ready before the audit.
How do I report an incident to the BSI within 24 hours?
Article 23 NIS 2 and §32 BSIG: early warning 24h, notification 72h, final report 1 month. What goes in, what stays out, who decides.
RACI for NIS 2 in a 60-person organisation
Five core roles, ten NIS 2 obligations. Art. 20 NIS 2 puts Accountable on the management body by law. The matrix names who actually does the work and who signs which approval.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
