NIS-2 Directive simply explained: Why cybersecurity is now a legal requirement
Published on 12.10.2026
The NIS-2 Directive provides a European framework for strengthening cybersecurity across businesses and public administration. It establishes binding requirements for risk management, incident reporting procedures and security measures. NIS-2 replaces the previous NIS Directive and is implemented in Germany through the NIS-2-Umsetzungsgesetz (Implementation Act), which affects around 30,000 companies and federal government institutions.
NIS-2 makes cybersecurity a core strategic and organisational responsibility. Requirements for governance, oversight and technical safeguards are becoming significantly more stringent. The Bundesdruckerei Group provides support through solutions for secure identities, certificates and digital signatures.
NIS-2 at a glance: What the Directive covers – and what it does not
The NIS-2 Directive builds on the previous NIS Directive. It is an EU cybersecurity directive that establishes minimum standards for protecting networks and information systems. NIS-2 applies to companies and organisations that are particularly important to the economy, society, essential services or digital infrastructure. These include operators of critical infrastructure that provide essential services to the public (e.g. energy supplies and hospitals) and providers of essential digital services (e.g. internet and, financial services).
The Directive is not a simply technical IT regulations, but a governance and security framework for organisations. Its main priorities are cyber resilience, risk management, reporting obligations and clearly defined responsibilities.
The NIS-2 Directive aims to raise the level of cybersecurity across the EU and make organisations more resilient to cyberattacks. In Germany, the NIS-2-Umsetzungsgesetz (NIS2UmsuCG) came into force in early December 2025 to implement the European NIS-2 Directive. The responsible authority for implementation, registration and incident reporting is the Bundesamt für Sicherheit in der Informationstechnik (BSI) (Federal Office for Information Security).
With the NIS-1 Directive (EU 2016/1148), the EU made its first attempt to establish consistent cybersecurity standards for critical infrastructure. The directive came into force in 2016 and covered seven key sectors, including energy, transport, healthcare, banking and digital infrastructure.
The requirements were deliberately broad: companies had to introduce appropriate security measures and report significant security incidents. Implementation was left to individual countries – in Germany, for example, through the BSI Act for operators of critical infrastructure (KRITIS). This resulted in inconsistent levels of security across Europe, as each Member State interpreted and implemented the requirements differently.
Why NIS-2 matters: cyber resilience as a strategic responsibility
The threat posed by cyberattacks in Europe and Germany continues to grow. Hacking, ransomware and supply chain attacks are increasingly affecting critical infrastructure. At the same time, businesses, government and society are becoming more dependent on digital technology. The more business processes and public services are delivered digitally, the greater the impact of such attacks. According to the Bundeslagebild Cybercrime 2025 of the Bundeskriminalamt (German Federal Criminal Police Office's 2025 Federal Cybercrime Situation Report 2025), the damage caused by cyberattacks across the German economy is estimated at €202.4 billion. Around 334,000 cases of cybercrime were recorded in 2025, although the actual figure is likely to be considerably higher due to unreported cases.
Cyber resilience is becoming essential to digital security and the ability to continue operating. This is precisely where the NIS-2 Directive comes in, establishing an expanded regulatory framework to strengthen resilience against cyber threats.
Security incidents such as ransomware attacks, data breaches and disruptions to essential services threaten not only business operations but also public safety and trust. For companies, cyber resilience is also becoming an important factor in business location decisions and competitiveness, as disruptions can cause financial losses and reputational damage. Public sector organisations need robust digital infrastructure to maintain reliable administrative services, essential services and crisis management.
Overall, cyber resilience ensures that interconnected systems continue to function, protects critical data and enables businesses, public administration and society to remain operational even in the face of threats. Cybersecurity is therefore no longer solely the responsibility of IT departments, but an integral part of organisational and corporate management.
NIS-2 implementation: Key milestones in introducing the NIS-2 Directive
With the entry into force of the NIS-2-Umsetzungsgesetz, new statutory IT security obligations apply in Germany. All companies and institutions covered by the Act must register with the BSI as NIS-2-regulated entities and report security incidents.
The BSI’s online registration portal has been available since 6 January 2026.As many affected organisations had still not registered by the end of May, the BSI extended the original deadline of the end of March 2026 to the end of July 2026. Companies and institutions that also missed this extended deadline may face fines and regulatory enforcement measures.
How NIS-2 works: Sectors, criteria and reporting obligations
The NIS-2 Directive distinguishes between sectors of high criticality and other critical sectors. It covers a total of 18 sectors, significantly more than the original NIS Directive, which covered seven.
Whether an organisation falls within the scope of NIS-2 depends on more than just its industry or size. The first consideration is whether its activities correspond to one of the entity types defined by law. The Act distinguishes between three categories:
- “Operators of critical facilities”
- “Essential entities” (bwE for short)
- “Important entities” (wE for short)
Depending on how an organisation is classified, different criteria apply regarding employee numbers, turnover and balance sheet totals. Certain entities – such as operators of critical facilities and specific trust service and infrastructure providers – are classified regardless of their size. The BSI provides a free decision tree to help organisations assess whether they are affected and offers initial guidance on their classification.
Companies and organisations within the scope of the Directive must implement comprehensive risk management measures to prevent security incidents, assess risks and continuously improve their processes.
They are also subject to clear reporting obligations: security incidents must be reported and documented within specified deadlines.
In Germany, NIS-2 requires an estimated 30,000 companies and organisations that meet the specified criteria to comply with strict IT security measures and reporting obligations.
Overview: 18 industries and sectors covered by NIS-2
NIS-2 in practice: From assessing applicability to implementation
Implementing NIS-2 begins with an an assessment of whether the requirements apply to the organisation. This can be done using the BSI’s online assessment tool. Organisations must check
- ... whether they fall within the scope of the legislation,
- ... which obligations apply to them; and
- ... which security measures are already in place.
Companies that register through the BSI portal are also required to keep their registration details up to date.
Based on this assessment, affected organisations should systematically establish responsibilities, reporting procedures, risk management processes, documentation and training programmes. Companies in critical, important and essential sectors must analyse their cyber risks and demonstrate that appropriate technical and organisational measures are in place. They are also required to report security incidents within strict deadlines.
Governance and NIS-2: Why cybersecurity is a board-level responsibility
Under NIS-2, responsibility for cybersecurity rests with senior management. Senior managers must not only attend training themselves but also ensure that employees receive regular training and develop an awareness of security risks. Breaches may result in personal accountability or liability, making clear roles, responsibilities and reporting structures essential. The consequences of failing to comply with these obligations should not be underestimated: fines can go up to millions of euros or amount to two per cent of annual turnover.
Supply chains and service providers must also be taken into account, as security risks often originate outside an organisation. Reporting obligations also require robust procedures: Who identifies incidents, who assesses them, who reports them and who documents the measures taken? An information security officer can for example be appointed to coordinate these activities.
NIS-2: Key obligations for affected companies
- Risk management: Affected organisations must establish a documented security management system covering IT systems, networks and business processes. This includes risk assessments, emergency and crisis management, vulnerability management, access controls and encryption.
- Supply chain security: Risks arising from service providers, suppliers and their products must be incorporated into the organisation’s risk assessments. Contracts and supplier selection procedures must therefore include appropriate information security requirements.
- Reporting obligations: Significant security incidents must be reported to the BSI through an early warning within 24 hours. A more detailed incident notification must follow within 72 hours, with a final incident report submitted no later than 30 days afterwards.
- Documentation obligations: Security measures, risk assessments and responsibilities must be documented in a clear and verifiable manner. The BSI can request this evidence at any time as part of its supervisory activities.
- Senior management responsibility: Senior management must not only approve risk management measures but also continuously monitor their implementation. Failure to do so results in personal liability, and there is no exemption from this liability.
- Training obligations: Senior managers are personally required to attend regular cybersecurity training. Employees must also receive regular training and awareness-raising activities to identify risks in their everyday work and act in accordance with the requirements.
- Clearly defined responsibilities: Although appointing an information security officer is not mandatory, the law requires documented responsibilities and oversight measures. In practice, appointing someone to this role is therefore advisable.
- Recognised standards as a basis for implementation: The BSI recommends using established frameworks such as ISO 27001 or the IT-Grundschutz (IT basic protection) as a foundation. However, certification does not automatically mean compliance with NIS-2. Additional measures may be needed to meet reporting obligations and senior management responsibilities.
Although NIS-2 does not make insurance compulsory, companies may find it useful to take out cyber insurance to mitigate the financial consequences of security incidents. Many insurers require evidence of an appropriate level of security, and compliance with NIS-2 requirements can provide a useful basis for assessment.
Stakeholders involved in NIS-2
The role of companies
Companies and organisations must determine whether they fall within the scope of the NIS-2 Directive, based on the criteria described above. If NIS-2 applies, they must establish appropriate security measures, reporting procedures, responsibilities and documentation to demonstrate compliance.
The role of government authorities
The government establishes the legal and organisational framework for implementing NIS-2 in Germany. This includes the NIS-2-Umsetzungsgesetz, which has been in force since December 2025, national supervisory structures led by the BSI, mandatory procedures for reporting security incidents, and specific requirements for risk management, documentation and the ability to respond effectively to incidents.
The role of the Bundesdruckerei Group
The Bundesdruckerei Group supports the German federal government as a technology and trust services partner. The Group companies’ solutions for secure identities and protected communications help organisations integrate trust, traceability and security into digital processes. Information security, encompassing all measures to protect data and systems, is an essential prerequisite for effective operational cybersecurity. As part of the Bundesdruckerei Group, genua GmbH therefore provides certified security solutions designed to meet NIS-2 standards and protect critical infrastructure as well as offering advice on implementation. In its white paper, genua explains the obligations arising from NIS-2 and the support available to help companies improve their cybersecurity. The group company D-Trust GmbH provides the cryptographic foundation for good cyber hygiene and secure communications through digital signatures, electronic seals and certificates. In this way, Bundesdruckerei supports the objectives of NIS-2: securing interconnected processes and making digital systems more resilient.
Conclusion: NIS-2 and cyber resilience: An ongoing responsibility
The NIS-2 Directive establishes cybersecurity as a permanent and fundamental part of how organisations operate. Companies and public sector operations will be required to implement and maintain more stringent requirements for security architectures, platform operations, digital services and supply chains.
For organisations, this represents an ongoing responsibility: cybersecurity must be continuously improved, reviewed and adapted to emerging threats. Senior management is ultimately responsible for ensuring this happens. Cyber resilience is therefore becoming a key indicator of the quality of digital services, platforms and modern administrative processes.
FAQ: Frequently asked questions about the NIS-2 Directive
Companies that fail to fulfil their NIS-2 obligations face serious consequences. Essential entities may be fined up to €10 million or two per cent of their total worldwide annual turnover, whichever is higher.
For important entities, the maximum fine is €7 million or 1.4 per cent of annual turnover. The BSI can also issue binding orders, request evidence of compliance or conduct inspections of essential entities without a specific incident triggering it. In addition, senior managers are personally liable for breaches of obligations, and claims arising from this liability cannot be waived.
The NIS-2 Directive places obligations on the entire supply chain. This means that suppliers that are not directly covered by the Directive may nevertheless be contractually required to comply with its security standards. Service providers will need to actively demonstrate their IT security standards through certificates or questionnaires and prepare for stricter contractual provisions concerning encryption and audit rights. They are required to report security incidents within their own organisations to customers immediately, enabling those customers to meet their statutory reporting deadlines.
ISO 27001 certification alone is not legally sufficient, but it provides an excellent foundation and already covers around 80 per cent of the requirements. Companies must take targeted action to address the remaining gaps, as certification does not cover the strict statutory NIS-2 requirements for reporting incidents to the BSI within 24 hours or the formal registration obligation. Unlike ISO 27001, NIS-2 also requires mandatory cybersecurity training for senior management and makes senior managers personally liable for breaches.
If the registration deadline is missed, the organisation must register through the BSI’s MUK portal using an ELSTER organisation certificate without delay to bring the ongoing breach to an end. Although late registration may result in a fine of up to €500,000, prompt voluntary registration can substantially reduce the penalty imposed by the authority. Keeping clear internal records of the objective reasons for the delay also ensures that affected organisations can explain their circumstances if the authority requests further information.
Under the BSI Act, managing directors are legally required to maintain complete records of their participation in specific cybersecurity training courses. Senior management must also formally approve the implementation of all risk management measures and regularly monitor compliance in a demonstratable manner. Only by maintaining complete, written documentation showing that they have fulfilled their due diligence obligations can senior managers avoid unlimited personal liability in the event of an incident.
Companies must prioritise suppliers and IT service providers according to risk and gradually incorporate specific NIS-2 provisions into existing contracts. This includes requesting recognised evidence of security compliance such as ISO 27001 certificates, agreeing contractual audit rights and requiring service providers to report security incidents within their infrastructure without delay. This approach helps protect the organisation’s supply chain without disrupting day-to-day operations through excessive bureaucracy.
Rather than establishing separate systems, organisations are advised to consolidate all requirements into a single, central Information Security Management System (ISMS). While NIS-2 governs cybersecurity, DORA introduces stricter requirements for the financial sector, and the KRITIS-Dachgesetz requires physical protection for buildings and facilities. As the core requirements for risk assessment, emergency management and reporting procedures overlap considerably, organisations only need to establish robust processes once and then align them with the various regulatory requirements. This saves time and significantly reduces compliance costs.
When reviewing security measures, the BSI no longer waits for an incident to occur, but proactively requests evidence and documentation. Its supervisory activities include regular on-site security audits, remote assessments of IT infrastructure, and requests to submit recognised certificates or detailed evidence of cybersecurity measures. In cases of repeated refusal to cooperate or serious deficiencies, the BSI has the legal authority to impose temporary management bans on managing directors.
Companies operating in several EU Member States must take account of country-specific requirements and differences in supervisory structures. As the EU Directive has been implemented at different times across Member States, sometimes with different thresholds or reporting portals, a single, standardised compliance approach is often insufficient. Multinational organisations must assess the applicability of the requirements and registration obligations separately for each country and incorporate the local communication channels of the relevant national cybersecurity authorities into their incident response plans.
Implementing NIS-2 – with the right security solutions
Find out more about the range of solutions offered by Bundesdruckerei Group companies genua and D-Trust:
