What is the NIS2 Directive?

NIS2: definition and background

NIS2 (Network and Information Security Directive 2) is the second EU directive on network and information security and replaces the NIS Directive of 2016. It aims to create a uniformly high level of security across the EU and covers considerably more companies than before. As a directive, it had to be transposed into national law by the member states.

In Germany, it is implemented through the NIS-2 Implementation and Cybersecurity Strengthening Act, which mainly extends the BSI Act. The competent authority is the Federal Office for Information Security (BSI). The current legal text is always decisive for your specific obligations.

Who is affected?

The directive covers “essential” and “important” entities in certain sectors, including energy, transport, health, water, digital infrastructure and IT services, but also postal services, waste management, chemicals, food, digital services and manufacturing, such as mechanical engineering or electronics production. As a rule of thumb, companies of at least medium size come into question, meaning roughly 50 or more employees or more than €10 million in annual turnover and balance sheet total.

What matters are sector, activity and size, not legal form. Companies not directly covered also often feel the rules indirectly, because affected customers pass security requirements on to their suppliers and service providers. The BSI and industry associations offer guidance on your own status; when in doubt, an early review is worthwhile because implementation takes time.

Obligations at a glance

Affected entities must implement suitable technical and organizational measures. Management must approve and oversee them and undergo training, and is liable for breaches of duty. Significant security incidents must be reported to the BSI in stages: an early warning within 24 hours, a notification within 72 hours and a final report after one month at most. In addition, registration with the BSI is required.

Violations can lead to fines. For essential entities, the directive requires maximum fines of at least €10 million or 2% of worldwide annual turnover, with lower limits for important entities. Besides fines, further supervisory measures are provided for, such as inspections, evidence requirements and orders from the authority that can noticeably burden operations.

• Risk analysis and security policies for information systems
• Incident handling and business continuity, including backups
• Supply chain and service provider security
• Vulnerability management and security in procurement and development
• Cryptography, access control and multi-factor authentication
• Training and basic cyber hygiene

Real-world example: a machine builder with 120 employees

A machine builder with 120 employees and roughly €25 million in turnover checks its status and finds that, as a manufacturer of machinery, it may belong to the covered sectors. So far it has antivirus, a backup and a firewall, but no emergency plan, no supplier management and no clear responsibility for information security.

The company appoints those responsible, carries out a risk analysis, adds multi-factor sign-in and tested backups, defines reporting paths for incidents and involves management. Key service providers are contractually bound to security requirements, such as the data center, maintenance partners and IT providers. Documenting all steps later serves as evidence for authorities and customers.

Preparation and imple­menta­tion

The starting point is an applicability check, followed by a gap analysis against the required measures. Typical mistakes are waiting, delegating everything to IT alone and missing documentation. Technically, multi-factor sign-in, patch management, backups and contingency planning are the first levers; standards such as ISO 27001 provide structure. Nano Concepts supports hardening, updates, backup, access protection and monitoring.

The legal review of applicability and obligations belongs in the hands of specialist lawyers or advisers who know the current legal text and your industry. They also determine conclusively which obligations actually apply to your company in your individual case. This article does not replace legal advice.