NIS-2 in Germany: Law coming soon – with a plan to achieve the goal.
Around 30,000 companies in Germany will fall under the NIS 2 regulation. The legal obligations will apply from the date the implementing law comes into force – expected to be early 2026. We can help you identify risks at an early stage, close security gaps, and ensure your management is legally compliant.
The NIS-2 impact assessment serves as an automated guidance tool based on self-reported information, and its result is not legally binding. The NIS-2 impact assessment does not replace the self-identification review and has no evidential value for any proceedings.
Interactive Guide to the 5 Core Requirements in Germany
1
Management Responsibility
Management is personally liable. They must approve cybersecurity measures, monitor their implementation, and undergo training themselves.
💼
"NIS-2 clearly establishes for the first time: cybersecurity is a C-level responsibility. Failures no longer fall on the IT manager – but on management personally."
Personal Liability
Management bears legal responsibility for cybersecurity
Approval Requirement
All security measures must be approved by management
Training Obligation
Regular continuing education of leadership required
2
Governance & Integration
Cybersecurity must become an integral part of corporate governance and operational processes.
🏗️
"NIS-2 requires not just technology – but organization: roles, responsibilities, decision-making processes, and controls must be bindingly integrated into business processes."
Organizational Structure
Define clear roles and responsibilities
Decision-Making Processes
Establish processes for security decisions
Integration
Embed cybersecurity into all business processes
3
Control System (ISMS)
An ISMS according to ISO 27001 (or equivalent) is the central bridge between strategy and implementation.
🛡️
"Without a system, no proof; without proof, no compliance. An ISMS documents, audits, improves – and legally protects management."
ISO 27001
Implementation of a standards-compliant ISMS
Documentation
Complete evidence of all measures
Continuous Improvement
Regular review and adjustment of the system
4
Technical Measures
Standard measures such as access control, logging, authentication, monitoring, and encryption are mandatory.
⚙️
"Technically, the setup must meet state-of-the-art standards – meaning: IAM, logging, MFA, recovery processes, vulnerability scanning. Without this: no standing in audit or incident."
Identity & Access Management
Central management of user access
Multi-Factor Authentication
Implement multi-stage authentication
Security Monitoring
Continuous monitoring and logging
5
Reporting Obligation & Registration
Security incidents must be reported within 24 hours, including a complete report after 72 hours at the latest. Companies must register with BSI – deadline: 3 months after entry into force.
⚡
"Rapid response is mandatory: 24h for initial notification, 72h for complete report. Plus: registration with BSI within 3 months after entry into force."
24-Hour Notification
Immediate initial notification for security incidents
72-Hour Report
Detailed analysis and full report
BSI Registration
Registration with Federal Office for Security
What happens if you do nothing?
The legal and financial consequences of non-compliance with the new regulations
⚡
No Transition Period
Obligations apply immediately upon entry into force of the law
👁
Dual Supervision
Ex-ante and ex-post supervision by competent authorities
⚖
Significant Penalties
Up to €10 million or 2% of annual revenue for essential entities
🎯
Personal Liability
Management is personally liable for compliance
Our 5-Step Roadmap
1
Assess Impact & Register with BSI
Systematically determine whether and to what extent your company falls under the new regulation. Complete the necessary registration with the competent authority.
2
Structure Governance & Establish Accountability
Establish clear responsibilities and robust governance structures for cybersecurity at all organizational levels.
3
Implement or Expand ISMS according to ISO 27001
Implement a certified Information Security Management System or expand your existing system according to requirements.
4
Adapt Technology & Processes – Including Supply Chain
Adapt technical systems and business processes to new requirements and integrate supply chain security into your strategy.
5
Prepare Incident Response & Audits
Develop effective incident response procedures and systematically prepare for regular audits and regulatory inspections.
Our Services
📊
Status and gap analysis including BSI-compliant report
🏗️
Implementation or adaptation of ISMS (ISO 27001, C5)
Justus Franke is a managing partner at ADVANTA. As an auditor and consultant, he helps companies establish, further develop, and audit management and control systems, with a focus on information security, digital resilience, and effective processes and controls.
Lena Franke
Managing Director, Auditor
Lena Franke is a managing partner at ADVANTA. As a certified public accountant and consultant, she assists companies with the implementation and audit of management and control systems, with a focus on information security, compliance, risk management, and the optimization of processes and controls.
Nils Lingthaler
Manager, ISO 27001 Auditor
Nils Lingthaler is a manager at ADVANTA. As an industrial engineer and ISO 27001 auditor, he helps companies establish, further develop, and audit management and control systems with a focus on information security, IT compliance, and the practical implementation of regulatory requirements.
