NIS2 in plain English
NIS2 is short for the second EU directive on network and information security, officially Directive (EU) 2022/2555. It replaces the first NIS Directive from 2016. An EU directive does not apply directly; each member state must transpose it into national law. In Germany, this was done through the NIS2 Implementation Act (NIS-2-Umsetzungsgesetz), which entered into force on December 6, 2025. It fundamentally overhauled the BSI Act (BSIG), the law that governs Germany’s Federal Office for Information Security.
Previously, strict requirements applied mainly to operators of critical infrastructure (KRITIS, critical infrastructure under German law), such as large energy suppliers. NIS2 significantly expands the group of companies covered: according to the Federal Office for Information Security (BSI), the authority now supervises around 29,500 entities. Among them are many mid-sized companies that previously had little to do with IT security law.
Think of NIS2 as a fire safety code for the digital world. If your company reaches a certain size and operates in a key sector, you must take preventive measures, keep emergency plans ready, and report incidents. And management must make sure that this actually happens.
What NIS2 regulates
Who is affected: NIS2 covers companies from 18 sectors – from energy, transport, health, and water to digital services and manufacturing, all the way to food, chemicals, and waste management. As a rule of thumb, companies in these sectors are affected if they have 50 or more employees, or if their annual revenue and annual balance sheet total each exceed €10 million. Depending on size and sector, the law distinguishes between “important” and “essential” entities. Some entities, such as operators of critical facilities, are covered regardless of their size.
What obligations apply:
- Registration: Affected companies must register with the BSI no later than three months after they first fall under the rules.
- Risk management: They must implement and document appropriate, proportionate, and effective technical and organizational measures. The law names ten minimum areas, including risk analysis, incident handling, backups and business continuity management, supply chain security, vulnerability handling, training, encryption, access control, and multi-factor authentication – as well as procedures for assessing the effectiveness of these measures.
- Reporting obligations: Significant security incidents must be reported in stages to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) under § 32 BSIG – starting with an early warning no later than 24 hours after the company becomes aware of the incident, followed by a more detailed incident notification within 72 hours at the latest and a final report no later than one month after that notification.
- Management accountability: Senior management must implement the risk management measures and oversee their implementation. Its members must regularly attend training and are liable to their own company for damage they cause through culpable breaches of duty.
Certain violations – such as missing risk management measures or failure to report – can result in fines of up to €10 million for essential entities and up to €7 million for important entities. For companies with total revenue of more than €500 million, the upper limit is based on revenue (up to 2% or 1.4%, respectively) and can be correspondingly higher.
A practical example
A mid-sized manufacturer of industrial pumps with around 150 employees uses the BSI’s online self-assessment to check whether it is affected. The result: as a machinery manufacturer of this size, it is likely to fall under NIS2 as an “important entity.”
The CEO registers the company with the BSI and appoints a person in charge. Together, they launch a project: an inventory of all systems, a risk analysis, an emergency plan, and a reporting process that also works on weekends. The CEO herself attends training, as the law requires.
To check whether the measures are working, the company has a penetration test carried out – an authorized, simulated attack. It uncovers a permanently open remote maintenance connection to the production floor – a gap that might otherwise have gone unnoticed until an attacker found it. The company also uses the report as evidence for a major customer that imposes security requirements on its supply chain.
Why does this matter for businesses?
For companies that are directly affected, NIS2 is not a recommendation but an obligation – with supervision by the BSI, fines, and personal accountability for senior management.
But companies that aren’t covered by NIS2 themselves often feel its effects too. That’s because affected entities must secure their supply chain. They therefore pass requirements on to suppliers and service providers – through contracts, questionnaires, or audits. Companies that can provide this evidence have a clear advantage.
And regardless of any obligation: the measures NIS2 requires are a sensible minimum standard. They protect against typical attacks such as ransomware – malware that encrypts data and demands a ransom – and help you respond quickly and decisively in an emergency.
What businesses should do now
- Check whether you’re affected: Use your sector, headcount, revenue, and balance sheet total to determine whether your company is covered. The BSI’s anonymous self-assessment provides an initial, legally non-binding evaluation.
- Complete registration: If your company is affected, register it with the BSI on time.
- Establish accountability: Senior management implements the measures, oversees them, and regularly attends training.
- Analyze risks: Identify your most important systems and data and determine the measures you need. An information security management system (ISMS) based on ISO/IEC 27001 or the BSI’s IT-Grundschutz (baseline protection) methodology provides a proven framework for this.
- Set up a reporting process: Define who detects and assesses an incident and reports it on time to the joint reporting office of the BSI and the BBK.
- Include the supply chain: Review service providers and suppliers that have access to your systems.
- Demonstrate effectiveness: Use penetration tests and vulnerability assessments to check whether your measures actually work.
This article provides a general overview and does not constitute legal advice. Whether and how your company is affected should be assessed on a case-by-case basis.
How Rootsektor can help
NIS2 requires affected companies to have procedures for assessing the effectiveness of their security measures. With penetration testing and security assessments, we provide solid evidence for this – from your internet perimeter to your internal network and production environment. Our Energy & Critical Infrastructure page explains what this means for utilities. You can get a fixed-price quote after scoping via our Pentest Quote page; on completion, a test certificate documents the test for customers, partners, and auditors. If a significant security incident occurs, our Incident Response & Forensics team also supports you with your reporting obligations.