Key points at a glance
- NIS2 is an EU cybersecurity directive, implemented in Germany and in force since 6 December 2025.
- Mainly mid-sized and large companies in certain sectors are covered, some regardless of size.
- Management must approve measures, oversee their implementation and can be personally liable.
- Companies that are not covered also feel NIS2, because covered customers demand security from their suppliers.
What is NIS2?
NIS2 is an EU directive intended to create a high common level of cybersecurity. Germany transposed it into national law with the NIS2 Implementation Act, which came into force on 6 December 2025. Compared with earlier rules, NIS2 covers considerably more companies.
Which companies are affected?
Mainly companies in defined sectors are affected, such as energy, transport, health, digital infrastructure, managed IT services for businesses, manufacturing of certain goods, food, waste and postal services. As a rule, the obligations apply from medium size, meaning roughly 50 employees or more than 10 million euros in turnover and balance sheet total. For some areas the rules apply regardless of size.
Whether your company is covered depends on sector, activity and size. The German Federal Office for Information Security (BSI) offers an applicability check. If in doubt, have the classification legally reviewed.
Which duties do covered companies face?
- Risk management: technical and organisational measures to secure systems.
- Reporting obligations: significant security incidents must be reported within short deadlines.
- Registration with the Federal Office for Information Security.
- Supply chain security: including suppliers and service providers.
- Training, including for management.
What does this mean for management?
Management of covered companies must approve the risk management measures and oversee their implementation. It cannot fully delegate this responsibility and can be personally liable for breaches of duty. Violations can lead to high fines, for essential entities up to 10 million euros or 2 % of worldwide annual turnover.
And if my company is not covered?
The topic is still worthwhile. Covered companies must consider the security of their supply chain and are therefore increasingly asking their service providers and suppliers. Those who can present evidence such as a recent pentest report have an advantage.
Five steps to take now
- Check applicability: clarify sector, activity and size.
- Take stock: which systems are critical and where are the risks?
- Make vulnerabilities visible, for example with a pentest.
- Plan and document measures, approved by management.
- Define reporting channels and responsibilities for security incidents.
This overview does not replace legal advice.
Conclusion
NIS2 makes cybersecurity a task for management. Companies that check early whether they are covered, know their vulnerabilities and document measures are much better prepared for audits, customer requests and incidents.
Frequently asked questions
AIErdinc Dincdemir
Sales, business development and project management at Optivanta
This article is for general information only and does not constitute legal, tax or investment advice. It does not replace advice on your individual case. Despite careful research, we accept no liability for accuracy, completeness or timeliness; use is at your own risk. Articles bearing an author's name reflect that author's opinion. The provider of and party responsible for all content is Optivanta Solutions LLC. More in the imprint
Evidence for NIS2 and GDPR?
Start with our free basic pentest or request the comprehensive pentest.