NIS2 Implementation in Germany: All Obligations from 06 December 2025

1. Status of the NIS2UmsuCG in 2026

The German NIS2 implementation act (NIS2UmsuCG) has been in force since 6 December 2025 (BGBl. 2025 I Nr. 301). It has replaced the BSIG 2009 in full — not merely amended it — and put in its place the BSI Act of 2 December 2025, officially the 'Act on the Federal Office for Information Security and on Security in Information Technology of Entities (BSI Act – BSIG)' (Gesetz über das Bundesamt für Sicherheit in der Informationstechnik und über die Sicherheit in der Informationstechnik von Einrichtungen). This transposes the NIS2 Directive (Directive (EU) 2022/2555) into German law.

Three points matter for implementation work. The BSIG is a federal act, not an ordinance: the obligations of §§ 30, 32, 33(1) and 38 BSIG have applied since 6 December 2025 without any transition period; the registration deadline of § 33(1) BSIG runs, event-related, three months from the moment the entity status arises, and the BSI points out that it has already expired (section 6). The competent authority is the Federal Office for Information Security — a higher federal authority within the remit of the Federal Ministry of the Interior and the central body for information security at national level (§ 1 BSIG). And individual provisions are subject to the application proviso of § 66 BSIG; for operators of critical installations this has a concrete consequence for registration (section 6).

2. Who is affected? Scope analysis

In Germany, according to the BSI, around 29,500 entities in two categories are affected — particularly important and important entities (§ 28 BSIG). The classification in § 28 BSIG runs in two stages: assignment to a type of entity specified in Annex 1 or Annex 2 BSIG and meeting the size threshold — unless the entity belongs to the cases covered irrespective of size:

Two pitfalls in the classification: First, turnover alone is never enough — § 28(1) no. 4 (b) BSIG requires turnover above EUR 50 million and in addition a balance sheet total above EUR 43 million; only the headcount (from 250) works as an independent criterion. Second, for important entities there is no upper headcount limit: since § 28(1) no. 4 BSIG covers exclusively types of entity in Annex 1, a large enterprise with 5,000 employees that can only be assigned to a type of entity in Annex 2 (for example manufacturing, food, chemicals, postal and courier services, waste management, digital services, research) remains an important entity — so it does fall within the scope. For calculating headcount, annual turnover and balance sheet total, Recommendation 2003/361/EC applies, with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG).

Which annex applies therefore also determines the category that can be reached. Annex 1 BSIG (BGBl. 2025 I Nr. 301, pp. 43–46): energy, transport, finance (banking and financial market infrastructures), health, water (drinking water and waste water), digital infrastructure including ICT service management, space. Annex 2 BSIG (pp. 47–48): postal and courier services, waste management, chemicals, food, manufacturing, providers of digital services, research. Federal public administration entities are not covered via Annex 1 but separately under § 29 BSIG.

Practical recommendation: Check each company in this order and record every interim result with a date — type of entity, size (§ 28(1) and (2)), group structure (§ 28(4)), size-independent grounds. The classification does not stay internal: when registering under § 33(1) BSIG, the relevant sector under Annex 1 or 2 must be stated (section 6).

3. Section 30 BSIG: 10 mandatory measures

§ 30(2) BSIG lists 10 areas of measures. Every affected entity must take appropriate measures in each area. The benchmark is set by § 30(1) BSIG: suitable, proportionate and effective technical and organisational measures to prevent disruptions to the availability, integrity and confidentiality of IT systems and to keep the impact of security incidents low — and compliance must be documented.

'Measures under subsection 1 should comply with the state of the art, take into account the relevant European and international standards, and must be based on an all-hazards approach.' — § 30(2) sentence 1 BSIG. The 'state of the art' is not static; in practice, supervisory authorities take their bearings from BSI IT-Grundschutz modules, ISO 27002, the ENISA Technical Implementation Guidance v1.0 (26 June 2025) and sector-specific standards such as TISAX.

1. Policies on risk analysis + security of information systems — documented methodology (in practice: ISO 27005), risk register, risk treatment plan; it governs the depth of all other areas.
2. Incident handling — incident response policy, playbooks per incident type, prepared reporting templates for 24 h, 72 h and the final report.
3. Business continuity (backup, disaster recovery, crisis) — in the wording, 'business continuity, such as backup management and disaster recovery, and crisis management' (§ 30(2) no. 3 BSIG). In practice: business continuity plan with RTO and RPO per process, backup strategy (3-2-1 or equivalent), tested restoration, crisis communication.
4. Supply chain security — supplier assessment with risk classification, cybersecurity clauses in the standard contract, right-to-audit for critical suppliers, contractually agreed incident notification (a practice-based commitment, usually within 24 hours).
5. Security in acquisition, development and maintenance — for in-house development typically OWASP-oriented, plus vulnerability management through a CVD process.
6. Assessment of the effectiveness of the measures — policies and procedures to assess the effectiveness of the risk management measures are required (§ 30(2) no. 6 BSIG); in practice, metrics per area, such as patch compliance rate, phishing click rate, recovery time.
7. Cyber hygiene + training — the BSIG wording is 'basic training and awareness measures in the field of information technology security' (§ 30(2) no. 7 BSIG); the term 'cyber hygiene' comes from Art. 21(2)(g) of Directive (EU) 2022/2555.
8. Cryptography and encryption — TLS 1.3 in transit (BSI TR-02102), AES-256 at rest for storage media and backups, S/MIME or PGP for sensitive email, key management via HSM or an equivalent key management system, preparation for post-quantum (NIST standards 2024).
9. Personnel security + access control — authorisation concept on a need-to-know basis, regular review, onboarding and offboarding workflow, security screening where appropriate.
10. MFA, continuous authentication, secure communication — the wording requires 'multi-factor authentication or continuous authentication' (§ 30(2) no. 10 BSIG). Practical recommendation: all admin accounts and external access (VPN, cloud); pure office use can be justified on a risk basis. In addition, secured voice, video and text communication as well as emergency communication.

All ten areas must be addressed, but not to the same depth: § 30(1) BSIG requires appropriateness and proportionality, the depth scales with the risk — and the reasoning for it belongs in the documentation. Typical gaps in practice (empirical value, not supervisory statistics): area 4 (missing cybersecurity clauses), area 6 (no documented metrics), area 7 (no phishing simulation).

Practical cycles (empirical values, not statutory deadlines): annual training for all staff with a learning check, onboarding training within the first four weeks, quarterly phishing simulation, annual penetration test, internal and external audit every two years. What the law prescribes is that training and an effectiveness assessment take place (§ 30(2) no. 6 and 7 BSIG); the cycles mentioned are empirical values.

4. Section 38 BSIG: management obligations

Section 38 BSIG places three personal obligations on the management: implementing and monitoring the measures under Section 30 BSIG (subsection 1), internal liability for culpably caused damage (subsection 2) and regular participation in training themselves (subsection 3).

Subsection 1 has two limbs and can therefore be audited twice: as implementation (the package of measures under Section 30 BSIG has been put into force) and as monitoring (the state of implementation is tracked in a traceable way). Monitoring is designed to be ongoing: a one-off resolution documents the implementation, while continuous monitoring requires evidence of its own. Practical recommendation: record the approval as a dated management resolution and have the state of implementation reported at a fixed interval; quarterly is customary (empirical value).

The internal liability under subsection 2 is not a fine but a damages claim of the entity against its own management; it comes in addition to the fines under § 65 BSIG (section 7). Subsection 3 requires the management to attend training regularly — a separate, personal obligation that is not discharged by the staff training under § 30(2) no. 7 BSIG. The Austrian counterpart, § 31 NISG 2026, differs and applies only from 1 October 2026 (section 10).

5. Reporting obligations: 24 hours / 72 hours / 1 month

In the case of a significant security incident, a three-stage reporting chain applies; the 24-hour and the 72-hour deadlines run from becoming aware of the incident, not from its start — the final report is tied to the 72-hour report (§ 32(1) no. 4 BSIG). At every stage the addressee is the joint reporting point of the BSI and the BBK.

In addition, the BSI may at any time request an intermediate report on relevant status updates (§ 32(1) no. 3 BSIG). If the incident is still ongoing after one month, a progress report takes the place of the final report for the time being; the final report then follows once the incident has been fully handled (§ 32(2) BSIG).

What counts as a reportable incident? The decisive concept is the 'significant security incident' under § 2 no. 11 BSIG: a security incident that has caused or can cause severe operational disruption of services or financial loss for the entity, or that has affected or can affect other natural or legal persons by causing considerable material or non-material damage. Implementing Regulation (EU) 2024/2690 specifies this threshold with quantitative criteria (including the number of users affected, financial impact, duration) — but only for certain digital types of entity such as DNS service providers, TLD name registries, cloud and data centre services, CDN, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers (cf. § 30(3) BSIG). For all other entities, the definition in § 2 no. 11 BSIG applies until a statutory ordinance under § 56(5) BSIG is issued.

Practical recommendation: Define in the playbook who assesses significance, who approves and who submits the report; the time of becoming aware and the assessment decision belong in the incident log with a timestamp.

6. BSI registration

Registration takes place under § 33(1) BSIG via a registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — in practice via the 'Mein Unternehmenskonto' portal — and at the latest three months after an entity first or again qualifies as a particularly important or important entity. Mandatory details: name including legal form and, where applicable, commercial register number, address and current contact details (including email, public IP address ranges, telephone numbers), the relevant sector under Annex 1 or 2, a list of the EU Member States in which services are provided, and the competent federal and state supervisory authorities. Changes to these details must be transmitted without undue delay, at the latest two weeks after becoming aware of them (§ 33(5) BSIG). Operators of critical installations register by way of derogation under § 8 of the German KRITIS Umbrella Act (KRITIS-Dachgesetz) (§ 33(2) BSIG); if an entity fails to meet its registration obligation, the BSI may carry out the registration itself (§ 33(3) BSIG).

On the separate route for operators of critical installations: § 33(2) BSIG is subject to the application proviso of § 66 BSIG. That provision — like § 2 no. 22 and 24 BSIG — is to be applied only once a statutory ordinance issued on the basis of § 4(3) and § 5(1) of the KRITIS-Dachgesetz applies; until then, § 2 no. 22 and 24 BSIG in the version in force up to and including 16 March 2026 continue to apply. As long as the proviso applies, operators of critical installations use the general route of § 33(1) BSIG, which covers particularly important and important entities; the KRITIS registration route is therefore no reason to omit the general registration.

According to the BSI, the statutory registration deadline has already expired. Anyone not yet registered should catch up on the registration; the obligation continues to apply. Practical recommendation: Treat the registration data as master data with a change service — the two-week deadline applies to every change of address, contact details, IP ranges or responsibilities; use a functional address rather than a personal one.

7. Fines + personal liability

The BSIG grades fines by category of entity: up to EUR 10 million for particularly important entities, up to EUR 7 million for important entities (§ 65(5) BSIG). The turnover variant of 2% or 1.4% of worldwide total turnover applies only from a total turnover above EUR 500 million and only for the infringements designated there (§ 65(6) and (7) BSIG). Alongside this — not instead of it — stands the personal internal liability of the management under § 38(2) BSIG.

Unlike the Directive itself, the BSIG has no blanket 'whichever is higher' rule. For the turnover variant, total turnover is the sum of all worldwide turnover of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). Where a data protection supervisory authority has already imposed a GDPR fine for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG).

Two clarifications for risk assessment: the range of fines is tied to infringements of the obligations designated there, in particular the risk management obligations under Section 30 BSIG and the reporting obligations under § 32 BSIG — the category of entity determines only the upper limit, not the trigger. And the bar in § 65(11) BSIG applies only in relation to the GDPR and only for the same conduct.

8. 12-step roadmap

The roadmap leads in twelve steps from the scope analysis under § 28 BSIG to management approval with ongoing reporting under § 38(1) BSIG. The order is a practical recommendation for building the programme, not a statutory chain of deadlines — statutory deadlines are in section 9. Each step provides the basis for the next:

1. Scope analysis (particularly important/important?) — result: a dated classification per company under § 28 BSIG.
2. Catch up on BSI registration (if not yet done) — § 33(1) BSIG (section 6).
3. Management briefing on Section 38 BSIG — obligations + internal liability, including subsidiarity (subs. 2 sentence 2) and the personal training obligation (subs. 3).
4. Set up the ISMS policy, have management approve it — the resolution documents the implementation decision under § 38(1) BSIG.
5. Implement a risk analysis methodology (ISO 27005) — risk register and risk treatment plan justify the appropriateness under § 30(1) BSIG.
6. Cover the 10 areas of Section 30 measures systematically — per area: responsible owner, measure, evidence (section 3).
7. Incident response playbook + reporting templates for 24 h, 72 h and the final report — with assessment logic for § 2 no. 11 BSIG and a defined on-call arrangement.
8. Supplier risk assessment + contract clauses — risk classification, cybersecurity clauses, right-to-audit (§ 30(2) no. 4 BSIG).
9. Cyber hygiene training for all staff — § 30(2) no. 7 BSIG (section 3).
10. Effectiveness review (KPIs, pentest, audit preparation) — § 30(2) no. 6 BSIG; metrics per area instead of a single overall score.
11. Documentation review + version control — § 30(1) BSIG requires compliance to be documented.
12. Management approval + reporting at fixed intervals — § 38(1) BSIG (section 4).

9. Evidence, supervision and the BSIG deadlines at a glance

The periodic obligation to provide evidence under the BSIG is directed primarily at operators of critical installations: they demonstrate the implementation of the measures under § 30(1) in conjunction with § 31 BSIG through security audits, reviews or certifications and transmit the results including any security deficiencies identified (§ 39(1) BSIG); the deadlines for this are in the table. Independently of that, the documentation obligation of § 30(1) BSIG applies to all affected entities.

The intensity of supervision also depends on the category: the NIS2 scheme subjects essential entities — in Germany: particularly important entities — to ex ante supervision, and important entities to ex post supervision. The classification from section 2 therefore determines not only the upper limit for fines but also whether inspections without a specific trigger are to be expected; the Austrian deadlines are in section 10.

10. Germany and Austria: what applies to groups

For groups with German and Austrian companies: separate registration in both countries and separate reporting channels — in Germany since 6 December 2025, in Austria from 1 October 2026; only the substantive building blocks are transferable. In Austria it is not the BSIG that applies but the NISG 2026 (BGBl. I Nr. 94/2025) — promulgated on 23 December 2025, but applicable only nine months later on the first day of the following month, that is from 1 October 2026 (§ 51(1) and (2) NISG 2026). As at the date of this article, no effective obligations arise from it yet; all the Austrian details below apply from that date.

The transferable parts are the substantive building blocks: risk management, ISMS policy, incident response playbook, supplier assessment. What cannot be transferred are the Austrian supervisory and reporting interfaces, the self-declaration under § 33 NISG 2026 and the penalty provisions. Also relevant for the scope analysis: in Austria, public administration at federal and state level is covered (§ 24(4) and (5) NISG 2026), while municipalities and municipal associations are excluded (§ 24(3) last sentence); for entities within the scope of DORA, its provisions take precedence (§ 4(2), § 24(7) NISG 2026). The full Austrian scheme is set out in the article on the NISG 2026.