NIS2 Obligations
of Management
What Companies Need to Do Now
Annika Geisler
Business & IT Consultant
The NIS2 Directive imposes new obligations on companies and clearly makes information security the responsibility of senior management. What matters is not only who is affected by NIS2, but also how companies approach implementation in a structured manner. In this article, you’ll learn which companies are affected by the directive, what NIS2 obligations management has, and how to prioritize measures.
The Most Important Points in 30 Seconds
- NIS2 affects many medium-sized and large companies Not only operators of critical infrastructure, but also numerous companies in relevant industries must determine whether they are subject to the new requirements.
- Senior management has clear governance and oversight responsibilities NIS2 is not purely an IT issue. Responsibility also lies at the executive level. Senior management must ensure that the requirements are implemented in a structured manner within the company and monitored in a transparent way.
What is NIS2?
As of December 6, 2025, new network and information security requirements apply to approximately 30,000 companies in Germany. This stems from the EU’s NIS2 Directive, which was adopted to strengthen the protection of critical infrastructure in the EU. The German NIS2 Implementation Act significantly expands the requirements for information security, registration, incident reporting, and risk management. It is particularly important to note that responsibility lies not only with the IT department but also explicitly with senior management.
NIS stands for Network and Information Security and aims to strengthen the resilience of critical infrastructure against IT disruptions and cyberattacks. More specifically, it is intended to ensure that facilities classified as critical can reliably supply the EU population with essential goods and services on a long-term basis. Due to digitalization and the increasing interconnectedness of our society, network and information systems have become indispensable to everyday life and cross-border exchange. If disruptions occur, they can impair economic activities in the European single market and cause financial losses.
To ensure uninterrupted service, many companies in Germany have also been required since the end of 2025 to improve their IT security capabilities and to implement risk management measures and reporting requirements. Failure to comply with these obligations may result in fines. The responsible regulatory authority is the Federal Office for Information Security (BSI).
For companies, this means specifically:
- Check whether you are affected
- Register with the reporting office
- Implement security measures and
- report significant incidents in a timely manner
Consulting & Business Development
Taking a Structured Approach to NIS2 Implementation
Digitalization, new market demands, changing customer expectations, and regulatory requirements are forcing companies to continually rethink their business models, processes, and structures. We support you in this process with strategic foresight, methodological clarity, and the ability to put ideas into practice.
Who is affected by NIS2?
Two factors are decisive: The company operates in an affected sector and exceeds the thresholds for the number of employees, revenue, and total annual balance sheet assets. Companies must independently determine whether they are affected by NIS2 and thus fall under the category of entities subject to the new obligations. The BSI provides a scoping assessment and a decision tree for this purpose. Affected entities are those classified in the BSI Act as“important”and“particularly important entities.”
The following are considered particularly important entities:
- Operators of critical infrastructure (KRITIS operators)
- Providers of qualified trust services, top-level domain name registries, or DNS service providers
- Providers of publicly accessible telecommunications services or operators of public telecommunications networks that employ at least 50 employees or have an annual revenue and total annual assets of more than 10 million euros each
- Providers of goods or services that fall within one of the sectors of high criticality and employ at least 250 employees or have an annual revenue exceeding 50 million euros and an annual balance sheet total exceeding 43 million euros
The following are considered important entities:
- Non-qualified providers of trust services
- Providers of publicly available telecommunications services or operators of public telecommunications networks that employ fewer than 50 employees and have an annual revenue or annual balance sheet total of 10 million euros or less
- Providers of goods or services that fall under one of the high-criticality sectors or other critical sectors and employ at least 50 employees or have an annual revenue and total assets of more than 10 million euros each
Affected entities are divided into two categories: high-criticality sectors and other critical sectors:
- High-Criticality Sectors: Energy, Transportation & Traffic, Finance, Healthcare, Water, Digital Infrastructure, Space
- Other critical sectors: Transportation & Traffic, Waste Management, Production, Manufacturing, and Trade in Chemical Substances, Production, Processing, and Distribution of Food, Manufacturing/Production of Goods, Digital Service Providers, Research
Assess the Impact and Determine Next Steps
Digital Strategy Checkup
Through this check-up, we assess your current situation, identify risks, and develop specific measures to enhance security, resilience, and compliance.
What should be done?
1. Determine Whether You Are Affected
The first step is to assess whether your organization falls under the NIS2 Directive. The Federal Office for Information Security ( BSI) offers aNIS2 compliance assessment that allows you to determine whether your organization is subject to the directive: BSI Compliance Assessment. All further obligations stem from this step.
2. Register on the BSI Portal
Affected companies must sign up for the BSI’s “My Company Account” (MUK) digital service. In the second step, organizations should register on the BSI portal using their MUK user account. Detailed instructions from the BSI can be found here.
3. Involve Management & Clearly Define Responsibilities
The BSI explicitly states that responsibility for implementation and monitoring lies with senior management. Senior management does not have to implement the measures operationally itself, but it must ensure that responsibilities, decisions, priorities, and controls within the company are clearly defined. Since senior management bears legal responsibility for implementing the new requirements, it should ensure that IT security is an integral part of the company. Senior management should appoint information security officers, define decision-making processes, and visibly integrate the issue into corporate governance. It is important that IT security not remain isolated within the IT department but rather be established as a management responsibility. To ensure this, the law mandates training for senior management. This means that senior management must regularly participate in training on risk assessment and risk management practices.
4. Implement Risk Management
Affected companies are required to implement appropriate risk management measures. The NIS2 Directive requires appropriate, proportionate, and effective technical and organizational measures. In practice, measures should be prioritized based on risk, criticality, and feasibility. Risk management measures may include, for example, risk analysis, incident response, supply chain security, multi-factor authentication on devices, access controls in buildings, and employee training. Numerous service providers are also indirectly affected, as securing the supply chain is an integral part of risk management measures, and affected companies may pass on these requirements to their service providers.
Ensuring Security
Integrated Management Systems and Information Security
Increasing cyber threats, stricter regulations, higher customer expectations, and global competition make an integrated, standards-compliant management system indispensable. Siloed structures increase risks, complicate decision-making, and can lead to fines and reputational damage. We help companies transform complex management requirements into a streamlined, digital, and future-proof integrated system.
5. Reporting Security Incidents
Critically important and important organizations are required to report significant security incidents to the BSI. Significant security incidents include those that result in serious operational disruptions to services or financial losses for the organization. Security incidents should be reported immediately upon becoming aware of them. The specific deadlines are 24 hours after becoming aware of the incident for the initial report, 72 hours after becoming aware of the incident for the follow-up report, and 30 days after becoming aware of the incident for the final report. Reports are submitted via the BSI portal. Affected companies should therefore establish reporting procedures for emergencies. Step-by-step instructions for reporting an incident via the BSI portal can be found here.
6. Regularly Review Implementation
NIS2 is not a one-time project. Once you have implemented the necessary measures, you should regularly review and document them and continuously adapt them to new requirements.
Fines
Violations of the obligations under the new legal framework can be costly. Fines are based on the institution’s classification and its total revenue. Fines of up to 10 million euros or two percent of global annual revenue may be imposed.
Common Mistakes in NIS2 Implementation
In many companies, NIS2 implementation fails not because of individual measures, but due to a lack of clarity and oversight
- Full Handover to IT
However, NIS2 is also a responsibility of senior management. It must steer and monitor implementation and embed it within the company. - Failure to Assess Impact
Those who do not determine whether and to what extent their own company is affected fail to establish a solid foundation for further steps. - Measures Without Clear Prioritization
This leads to knee-jerk reactions, unclear responsibilities, and delayed implementation. It is crucial to establish a sensible sequence of measures based on risk and relevance. - Lack of reporting channels
If, in an emergency, it is not clear who is responsible for informing, assessing, and reporting internally, dangerous delays will result. - Service providers not sufficiently taken into account
Yet external partners and the supply chain are an important part of risk management. - Incomplete documentation
If decisions, measures, and responsibilities are not documented in a traceable manner, it will be difficult to substantiate their implementation later on
How Companies Affected by NIS2 Should Properly Prioritize Measures
Companies must implement numerous technical and organizational measures—but not all of them are equally urgent. A structured prioritization process helps reduce risks, meet legal deadlines, and allocate resources effectively.
1. Assess Risks and Prioritize Them by Impact
NIS2 explicitly requires a risk-based approach. Companies should therefore first analyze which systems, processes, and vulnerabilities pose the greatest risk. Priority should be given to measures that:
- quickly reduce major risks,
- affect critical business processes, or
- have a significant impact on availability, integrity, or confidentiality.
2. Meet the statutory minimum requirements first
Some obligations are non-negotiable and must be prioritized regardless of individual risk. These include, among others:
- Registration with the BSI
- Handling security incidents
- Use of multi-factor authentication
- Verify the effectiveness of security measures
- Vulnerability management
- Setting Up Access Control
- Training for Management
- Raising employee awareness of risk identification and prevention.
These measures form the legal foundation and should be implemented first.
3. Protecting Critical Business Processes
Companies should focus on securing the processes that are particularly important for operations or supply. It should be ensured that critical systems continue to run even in the event of disruptions. These include, for example, production systems, energy supply, logistics, and central administrative processes.
4. Take Advantage of Quick Wins
Many security improvements can be implemented quickly and deliver immediate, tangible results:
- Enable multi-factor authentication
- Limit administrator privileges
- Remove default passwords
- Define emergency communication channels
These quick wins immediately reduce risk—with minimal effort.
5. Consider dependencies and supply chains
Since NIS2 requires supply chain risk management, companies should also review service providers and update contractual security requirements early on. Providers with high-level access to critical systems should be addressed first.
Conclusion: NIS2 is an issue for senior management
NIS2 is not purely an IT issue. The directive requires companies to organize information security in a structured manner, report incidents, and manage risks in a transparent way. For senior management, this means, above all , assessing the impact, defining responsibilities, prioritizing measures, and actively monitoring implementation.
You can find additional helpful information on the website of the Federal Office for Information Security.
Frequently Asked Questions and Answers
What must management do under NIS2?
- Determine whether your company is affected by NIS2
- Designate responsible parties
- Register on the BSI portal
- Report security incidents
- Get training
- Implement risk management
What NIS2 obligations must affected companies fulfill?
Facilities classified as “particularly important” and “important” must fulfill various obligations, which are tiered according to the type of facility, such as
- registering,
- reporting significant security incidents (related to cybersecurity and information security),
- implement risk management measures,
- participate in information sharing,
- and implementing approval, monitoring, and training requirements for management.
Who is affected by NIS2?
Companies are subject to the NIS2 Implementation Act if they fall under one or more of the definitions of “entities” in Annexes 1 and 2 and also meet or exceed the size thresholds for the number of employees or revenue (see Section 28(1) and (2) of the BSIG). Regardless of their size, the NIS2 Implementation Act also covers certain entities, such as when services are provided by:
- providers of public electronic communications networks
- Providers of publicly available electronic communications services
- Trust service providers
- Top-level domain name registries and domain name system service providers
You can use the NIS2 Scope Assessment to determine whether your company falls within the scope of the NIS2 Implementation Act.
How do companies properly prioritize NIS2 measures?
NIS2 explicitly calls for a risk-based approach. Companies should therefore first analyze which systems, processes, and vulnerabilities pose the greatest risk.
Priority is given to measures that:
- quickly reduce major risks,
- affect critical business processes, or
- have a significant impact on availability, integrity, or confidentiality.
Minimum legal requirements should be met first. Companies should focus on securing the processes that are particularly important for operations or supply. It should be ensured that critical systems continue to operate even in the event of disruptions.
Since NIS2 requires supply chain risk management, companies should also assess service providers and update contractual security requirements early on. Providers with high-level access to critical systems should be addressed first.
Does management need to undergo training on NIS2?
Yes, the law requires management of affected companies to undergo training.
What are the deadlines for reporting security incidents?
Significant security incidents must be reported to the BSI by organizations subject to NIS2. The BSI specifies the following deadlines: 24 hours for the initial report, 72 hours for the follow-up report, and 30 days for the final report.
By when must affected companies register?
Organizations must register no later than three months after they are first or again subject to NIS2.
What role does the BSI play in NIS2 implementation?
The Federal Office for Information Security (BSI) is the national supervisory and reporting authority for the implementation of the NIS2 Directive in Germany. It monitors compliance with cybersecurity measures at affected organizations, receives reports of security incidents, offers advice, and can impose sanctions.
Do you have any other questions?
Schedule a free initial consultation
Sandra von König answers your personal questions, provides orientation and gives you a clear overview of the possibilities and added value.
Sandra von König
Your contact person
Do you have any other questions?
Schedule a free initial consultation
Sandra von König will answer your personal questions, provide guidance, and give you a clear overview of the options and added value.
