In short: Germany's NIS 2 implementation act (NIS2UmsuCG) has been in force since 6 December 2025. For energy providers it brings a mandatory catalog of duties, a registration obligation with the BSI and clear responsibility for management. Who is affected, what needs to be done concretely, and what a robust implementation plan looks like.

Who is affected

NIS 2 (Directive EU 2022/2555) and the German implementation act (NIS2UmsuCG), which anchors the duties in the revised BSI Act (BSIG), classify the energy sector as a highly critical sector (Annex I). This includes:

  • Electricity undertakings, producers, transmission and distribution system operators
  • Gas and oil providers, pipeline operators
  • District heating operators
  • Hydrogen producers and providers (newly in scope)
  • Operators of charging points for electric vehicles

Beyond activity, company size matters (§ 28 BSIG, size classes under EU Commission Recommendation 2003/361/EC). In Germany, particularly important entities (directive: essential entities) in the energy sector are companies with at least 250 employees or with more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total. Operators of critical facilities are particularly important entities regardless of size. Important entities are companies with at least 50 employees or with more than EUR 10 million annual turnover and more than EUR 10 million balance sheet total. Affected companies must register with the BSI no later than three months after first qualifying as an entity (§ 33 BSIG). Suppliers can be indirectly affected if they deliver security-relevant services to NIS 2 entities.

What changes compared to NIS 1

NIS 1 in the energy sector primarily covered transmission network operators and large power plants. NIS 2 substantially broadens the scope:

  • More companies through lower size thresholds
  • Supply chain explicitly part of risk assessment
  • Management responsibility and liability (Article 20, § 38 BSIG) for implementing security measures
  • Fines up to EUR 10 million or 2 percent of global annual turnover for particularly important entities, up to EUR 7 million or 1.4 percent for important entities, whichever is higher (§ 65 BSIG)
  • Reporting duties with strict deadlines, no more “as soon as possible”

Energy providers that were only marginally affected under NIS 1 find themselves with a substantially expanded catalog of duties under NIS 2.

The core catalog of obligations

Article 21 of the directive defines ten technical and organizational measures every affected company must implement:

  1. Risk analysis and security policy concepts
  2. Security incident handling (incident response)
  3. Business continuity, backup management, crisis management
  4. Supply chain security, including relationships with service providers
  5. Security in acquisition, development and maintenance of network and information systems
  6. Concepts for assessing the effectiveness of these measures
  7. Cyber hygiene and training
  8. Cryptography and encryption
  9. Personnel security, access control, asset management
  10. Multi-factor authentication, secured communication, emergency communication

These ten points are not optional. They are not a non-binding recommendation. They are legally required.

Reporting duties: strict deadlines

For a significant security incident (Article 23 NIS 2, § 32 BSIG):

  • 24 hours: Initial early warning to the competent authority (in Germany: the BSI)
  • 72 hours: Incident notification with an initial assessment
  • 1 month: Final report with root cause analysis and measures taken

Missing these deadlines risks fines and questions from the authority to management. In a sector that has historically been reluctant to communicate, this is a cultural shift.

Management responsibility

Article 20 of the directive and § 38 BSIG (revised by the NIS2UmsuCG) require management to approve the risk management measures, monitor their implementation and take part in regular training. If management breaches these duties, it is personally liable to the entity for the damage under company law.

The directive also provides that, for essential entities, authorities may as a last resort temporarily prohibit individuals from exercising managerial functions (Article 32 (5) NIS 2). Cyber security is finally no longer an IT matter, it is a board matter.

Checklist: ten steps to NIS 2 compliance

We recommend the following implementation plan, building on ISO/IEC 27001:2022 as a foundation with NIS 2-specific additions:

  1. Check applicability and register. Particularly important or important entity? Which subsidiaries are affected? Which suppliers? Registered with the BSI (§ 33 BSIG)?
  2. Establish risk management. Protection-need analysis, asset inventory, risk assessment with clear owners.
  3. Map measures catalog against Article 21. Gap analysis between current state and legal duty.
  4. Board resolution on cyber security strategy. Written, with responsibilities and budget.
  5. Secure the supply chain. Contract clauses, audit rights, security requirements for service providers.
  6. Build detection and response. SOC in-house or as managed service, with 24/7 coverage.
  7. Define reporting channels. Who informs the BSI within 24 hours? Deputy? Escalation?
  8. Deliver training. Board, key personnel, technical teams, each tailored to audience.
  9. Build documentation. Audit-ready, version-controlled, regularly updated.
  10. Test effectiveness. Penetration tests, tabletop exercises, annual management review.

These ten steps do not produce a “NIS 2 certificate” (no such thing exists). They produce evidence that the legally required measures are implemented.

What many energy providers underestimate

Three points that are regularly addressed too late in our advisory practice:

  • Supply chain. Anyone without contractual security requirements for IT service providers, remote-maintenance providers and cloud platforms has an open flank. Supervisory authorities will target this.
  • OT security. Control technology in substations, pumping stations and generation plants is often outdated, long patch cycles, weak authentication. NIS 2 makes no exception for OT.
  • Board competence. The duty to train the board is not symbolic. In an incident, the authority will ask what the board knew when, and what they decided.

How GermanAI Defense supports

We build NIS 2 programs on ISO/IEC 27001:2022 as the foundation, add the NIS 2-specific duties, and deliver audit-ready documentation. Our scope covers gap analysis, measures plan, technical implementation (SOC, penetration testing, training) and ongoing board support.

ISO/IEC 27001:2022 certified ourselves, documented and verifiable. From Frankfurt, for energy infrastructure in Germany.

→ Applicability, obligations and our approach: NIS 2 consulting

→ More on our GRC and compliance services: germanaidefense.com/grc