Germany
GermanyNIS2 in Germany: what the new BSI Act asks of your IT
Since 6 December 2025, the German NIS2 implementation act has brought around 29,500 companies under the supervision of the Federal Office for Information Security (BSI). Behind the legal text sit very concrete IT obligations: registration, incident reporting within 24 hours, and ten minimum security measures that management must implement and oversee.
Where things stand in 2026
The EU's NIS2 Directive had to be transposed by the Member States in 2024. Germany did so late, with the NIS-2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), which entered into force on 6 December 2025. At its heart is a rewritten BSI Act (BSIG). According to the BSI, the number of regulated organisations rose from around 4,500 to around 29,500.
Registration opened through the BSI portal on 6 January 2026, using an ELSTER organisation certificate obtained through Mein Unternehmenskonto. The statutory three-month registration period has now expired: the BSI states that entities which are covered and have not yet registered must do so without delay. The reporting and risk management obligations have applied since the act came into force.
This page explains those obligations from the point of view of the information system. It is not legal advice: whether your company is covered, and in which category, is a legal question for your adviser, helped by the BSI's online applicability check.
Who is covered
Section 28 BSIG creates two categories, depending on the sector listed in the annexes of the act and on company size:
Particularly important entities (besonders wichtige Einrichtungen): operators of critical facilities, and companies in the listed sectors with at least 250 employees, or with an annual turnover above 50 million euros and a balance sheet total above 43 million euros.
Important entities (wichtige Einrichtungen): companies in the listed sectors with at least 50 employees, or with an annual turnover and a balance sheet total each above 10 million euros.
The sectors range from energy, transport, health and digital infrastructure to manufacturing, food, waste management and digital providers. Even if your company is below the thresholds, NIS2 may reach you indirectly: covered entities must manage the security of their supply chain, including their relationships with suppliers and service providers, and they will pass requirements down to you.
Registration and incident reporting
Under section 33 BSIG, a covered entity registers within three months of first falling within scope, through the joint registration service of the BSI and the Federal Office of Civil Protection and Disaster Assistance. It provides its name, legal form and register number, address and contact details, public IP address ranges, sector, the Member States where it provides services and its competent authorities, and reports any change within two weeks.
Section 32 BSIG sets three reporting steps for a significant security incident:
An early warning without delay and at the latest within 24 hours of becoming aware of it, saying whether unlawful action or cross-border effects are suspected.
An incident notification at the latest within 72 hours, with an initial assessment of severity and impact and indicators of compromise.
A final report at the latest one month after the notification, or a progress report if the incident is still ongoing.
Twenty-four hours is very short if nobody notices the incident. Meeting that deadline starts with centralised logging, alerting and a written procedure that says who decides and who reports.
The ten minimum measures
Section 30 BSIG requires appropriate, proportionate and effective technical and organisational measures, taking into account risk exposure, company size, implementation costs and the likelihood and severity of incidents. They must include at least:
Risk analysis and information security policies.
Incident handling.
Business continuity: backup management, disaster recovery and crisis management.
Supply chain security, including relationships with suppliers and service providers.
Security in the acquisition, development and maintenance of IT systems, including vulnerability handling.
Policies to assess the effectiveness of these measures.
Basic training and information security awareness.
Policies on cryptography and encryption.
Personnel security, access control policies and asset management.
Multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications.
Under section 38 BSIG, management must implement these measures, oversee their implementation and take part in regular training on information security risks. Management that culpably breaches these duties is liable to its company for the resulting damage, under the company law rules that apply to it.
What it means in a Windows and Microsoft 365 environment
For the small and medium-sized companies we work with, most of the ten measures translate into familiar technical work:
Access control and asset management: knowing who holds administrative rights in Active Directory and Entra ID, removing dormant accounts and separating admin accounts from everyday ones. An Active Directory audit gives you this picture with a prioritised plan.
Authentication and encryption: device compliance, conditional access and BitLocker encryption set up through Microsoft 365 and Intune.
Vulnerability handling: no unsupported systems left, which today means completing the Windows 11 migration, and patching that is automated and verified.
Business continuity: backups that are protected from the accounts they back up, and restore tests that are actually carried out.
Risk analysis and effectiveness: an IT audit that documents where you stand and what to fix first, repeated to measure progress.
Training: cybersecurity awareness training for staff, which also helps management meet its own training duty.
We do this work remotely from France, in English and in your time zone, with on-site visits on quotation. We do not certify compliance, we do not handle your registration or reports to the BSI, and we do not provide continuous monitoring: we implement and document the measures so that your management can show what exists and how it works.
Fines
Section 65 BSIG provides for fines of up to 10 million euros for particularly important entities and up to 7 million euros for important entities, for breaches such as failing to implement the risk management measures. For companies with a worldwide turnover above 500 million euros, the ceiling can reach 2% of that turnover for particularly important entities and 1.4% for important entities. Failing to register can itself be fined.
Frequently asked questions
Is the German NIS2 law already in force?
Yes. The NIS2 implementation act entered into force on 6 December 2025. Registration, incident reporting and risk management obligations apply since then, and the statutory registration period has expired.
How quickly must an incident be reported?
A significant security incident requires an early warning to the BSI within 24 hours, a notification within 72 hours and a final report one month later.
We are below the thresholds. Does NIS2 concern us?
Possibly indirectly. Covered entities must manage the security of their supply chain and will ask their suppliers and service providers for evidence of good practice.
Can you handle our BSI registration or reports?
No. Registration and reporting remain your company's responsibility. We implement and document the technical measures, and the logging that lets you detect and describe an incident in time.
Sources
Cybersicherheitsrecht: NIS-2-Umsetzungsgesetz ab morgen in Kraft, BSI press release, 5 December 2025
Section 28 BSIG, section 30, section 32, section 33, section 38 and section 65, gesetze-im-internet.de