We clarify whether your company falls under NIS 2, implement the obligations of the German BSI Act with you and organize the evidence the BSI can request by order.
NIS 2 is the EU directive on cybersecurity. In Germany it has been part of the BSI Act (BSIG) since 6 December 2025. BSI is the German Federal Office for Information Security. Sector and size decide whether a company is affected (Section 28 BSIG).
Companies in the sectors of Annex 1 with at least 250 employees, or with annual turnover above EUR 50 million and in addition a balance sheet total above EUR 43 million. Operators of critical facilities count regardless of size.
Companies in the sectors of Annexes 1 and 2 with at least 50 employees, or with annual turnover and balance sheet total each above EUR 10 million.
Annex 1 lists energy, transport, finance, health, water, digital infrastructure and space. Annex 2 lists, among others, waste management, chemicals, food, manufacturing, digital services and research.
Exceptions and special rules apply to individual industries, for example financial entities under DORA (Section 28(5) and (6) BSIG). The applicability check clarifies this for your company.
Four obligations every affected entity needs to know.
Appropriate, proportionate and effective measures, documented. The law names ten minimum areas, including risk analysis, incident handling, business continuity, supply chain, training and multi-factor authentication.
Significant security incidents go to the joint reporting office of the BSI and the Federal Office of Civil Protection: early warning within 24 hours, notification within 72 hours, final report no later than one month after that notification.
No later than three months after a company counts as an affected entity, it registers with the BSI, including contact details, sector and public IP address ranges.
Management implements the measures, monitors them and takes part in training regularly. For damage caused culpably it is liable to its entity under the rules of company law.
Six building blocks, individually or as a program. You end up with documents your team can maintain itself.
Sector, size and special rules checked against Section 28 BSIG, with a written result.
We compile the required information and support the registration.
Your status against the ten minimum areas of Section 30 BSIG, gaps sorted by urgency.
Tasks with owners and dates, plus policies for approval by management.
Who reports what to whom and when. Templates for the three reporting stages and an exercise before a real incident.
Training under Section 38(3) BSIG through the GAD Academy, with a GAD certificate of attendance.
Five steps, each with a tangible result.
Check sector and size, record the result in writing
Compare the current state with Section 30 BSIG
Order gaps by risk, set owners and dates
Introduce measures, approve policies, file evidence
Rehearse the reporting chain, train management
For assessing effectiveness (Section 30(2) no. 6 BSIG) we offer penetration testing, and for detecting incidents round-the-clock SOC monitoring.
See cybersecurity →According to the BSI, certification to ISO/IEC 27001 does not automatically mean that a company meets all requirements of Section 30 BSIG. The scope of an ISMS can be chosen freely, and reporting, registration and management duties are not part of the standard. There is no official NIS 2 certificate.
An existing ISMS (information security management system) is a good foundation according to the BSI. We check it against the catalog of measures in the law and add what is missing.
Legal status: German BSI Act as in force on 13 October 2026. This page does not replace legal advice in individual cases.
Since 6 December 2025. On that day the new BSI Act entered into force (Federal Law Gazette 2025 I no. 301). According to the BSI there is no general transition period.
That depends on sector and size (Section 28 BSIG). As a rule, a company counts as an important entity if it operates in a sector of Annex 1 or 2 and has at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million. Special rules apply to individual industries. An applicability check clarifies this in writing for your case.
Three stages under Section 32 BSIG: early warning within 24 hours of becoming aware, notification within 72 hours, final report no later than one month after that notification. Significant security incidents must be reported. Section 2 no. 11 BSIG defines what counts as significant.
No. According to the BSI, certification to ISO/IEC 27001 is not evidence of NIS 2 compliance, but a good foundation. The scope of an ISMS can be chosen freely, and reporting, registration and management duties are not part of the standard.
According to the BSI, companies only have to prove implementation when ordered to. Operators of critical facilities provide evidence every three years (Section 39 BSIG). For important entities the BSI checks when facts suggest a violation (Section 62 BSIG). Documenting the measures is mandatory for everyone (Section 30(1) BSIG).