NIS2 in Water and Waste Management: Municipal Utilities

Main article: NIS2 implementation in Germany — covering scope, measures under Section 30 BSIG, management liability under Section 38 BSIG, reporting obligations and fines in detail.

1. Who is covered?

The following are covered: every entity in the drinking water, wastewater and waste field that employs at least 50 people or has an annual turnover and an annual balance sheet total each exceeding EUR 10 million — and, irrespective of size, every operator of a critical installation (§ 28(1) and (2) BSIG). Water (drinking water and wastewater) belongs to the sectors of Annex 1, waste management to the sectors of Annex 2 of the BSIG 2025; the table below shows which of the two categories follows from this. KRITIS threshold for water: from 22 million m³ of drinking water per year onwards (water sector, Annex 2 of the BSI-KritisV) — this corresponds to the standard threshold value of around 500,000 people supplied (the threshold refers to the volume of drinking water, not to the number of citizens supplied). Wastewater and waste installations have their own installation categories and threshold values; they are set out in the annexes to the BSI-KritisV for the water sector and for municipal waste disposal respectively and are not quantified here. Who counts as the operator of a critical installation is determined by § 2 no. 22 BSIG in conjunction with the German KRITIS Umbrella Act (KRITIS-Dachgesetz) — until the statutory instrument issued under that act takes effect, § 66 BSIG keeps the version applicable until 16 March 2026 (BSI-KritisV) authoritative.

The annex allocation decides the category, not merely whether an entity is covered: § 28(1) no. 4 BSIG covers exclusively types of entity listed in Annex 1. A type of entity listed in Annex 2 — waste management, for instance — therefore never becomes a particularly important entity on the basis of its size alone, unless it is at the same time the operator of a critical installation; there is no upper employee limit for important entities (worked example in the FAQ). Conversely, turnover alone is never sufficient: § 28(1) no. 4(b) BSIG requires an annual turnover of more than EUR 50 million and in addition an annual balance sheet total of more than EUR 43 million; only the employee figure of 250 or more operates as an independent criterion. For calculating the number of employees, the annual turnover and the balance sheet total, Recommendation 2003/361/EC applies, with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG). On terminology: the BSIG speaks of particularly important and important entities, the NIS2 Directive of essential and important entities.

Under § 28(2) BSIG, classification as an important entity applies only to the extent that the entity is not already a particularly important entity.

Practical recommendation for the order of implementation: document the classification for each legally independent unit (section 1) → check the registration and catch up where needed (section 6) → record the role authorised to report and the reporting channel (section 5) → significance playbook (section 4) → remote maintenance access and network separation (section 2) → supplier register and clauses (section 3) → document management training (section 6).

2. How do you secure control technology and SCADA?

You secure control technology and SCADA through three levers: separation of the process network from the office IT, controlled remote maintenance access, and a business continuity plan with RTO and RPO for each supply-critical process — the legal framework is set by Section 30 BSIG. That provision requires appropriate, proportionate and effective technical and organisational measures to avoid disruptions to the availability, integrity and confidentiality of the IT systems and to keep the impact of security incidents low; compliance must be documented (§ 30(1) BSIG). Pump control, chlorine dosing and pipe network monitoring are the supply-critical processes; they belong in the business continuity plan (§ 30(2) no. 3 BSIG); practical recommendation: set separate RTO and RPO values for each process and record for each process whether, and for how long, manual operation is possible as a fallback level. At the OT/SCADA level, ISA/IEC 62443 is the standard for industrial control systems; in legal terms it takes effect via § 30(2) sentence 1 BSIG — the measures should comply with the state of the art and take the relevant European and international standards into account. Three areas from the catalogue in § 30(2) BSIG concern control technology directly:

• Maintaining operations § 30(2) no. 3 BSIG — business continuity plan, backup concept, tested disaster recovery plan, crisis management plan including internal and external communication. Practical recommendation: set separate RTO and RPO values for each process. Practical recommendation for the backups: the 3-2-1 principle or equivalent.
• Personnel security, access control and authentication § 30(2) no. 9 BSIG § 30(2) no. 10 BSIG — an authorisation concept based on need-to-know, an onboarding and offboarding workflow, multi-factor or continuous authentication and secured communication. Practical recommendation: MFA first on all administration and external access, in particular for the remote maintenance of control technology; apply the offboarding workflow to the accounts of external maintenance firms and integrators as well, not only to your own staff.
• Cyber hygiene and training § 30(2) no. 7 BSIG — basic training and awareness measures. The following intervals are practical recommendations and values drawn from experience, not deadlines set by the BSIG: annual training for all staff, onboarding training within the first four weeks, quarterly phishing simulation and a sector-specific SCADA training for control room staff and maintenance.

IT/OT separation: process network, remote maintenance, patches

The following three points are practical recommendations for implementation in water and waste operations: the law names the areas of measures, the technical design remains risk-based and proportionate (§ 30(1) and (2) BSIG).

• Separate the process network from the office IT. Place the control room, telecontrol technology and outstations in their own network segments, limit the transition to the office IT to defined connections and log them. The authorisation concept (§ 30(2) no. 9 BSIG) should maintain separate roles for the process network — an office account is not a control room account.
• Remote maintenance by SCADA suppliers via a central, logged access point. Activation limited in time and on request, multi-factor authentication mandatory (§ 30(2) no. 10 BSIG), sessions recorded. That access also belongs in the supplier assessment under section 3 — it is the sharpest criterion for a supplier's risk class.
• Tie patch windows to maintenance shutdowns. For control technology that cannot be patched during ongoing operation, plan the point in time in advance and document a compensating measure until then (segmentation, access lock, intensified monitoring). This forms part of vulnerability management in acquisition, development and maintenance (§ 30(2) no. 5 BSIG).

3. What does supply chain due diligence under § 30(2) no. 4 BSIG require?

§ 30(2) no. 4 BSIG makes supply chain security a separate area of obligation; in Austria the parallel provision is § 32(4)(d) NISG 2026. In water and waste operations this concerns above all SCADA manufacturers (Siemens Water, Schneider Electric, Endress+Hauser), IT service providers and maintenance firms. Practical recommendation for getting started: first record all suppliers with access to the control technology or with remote maintenance capability — this group is brought into line contractually first, all others at the next contract renewal. Four building blocks structure the area:

• Supplier assessment with risk classification. Practical recommendation for the criteria: access to the control technology, remote maintenance capability and replaceability of the supplier. Practical recommendation for allocation into three classes: class A = write or remote maintenance access to the control technology, class B = access to the office IT involving data, class C = no IT access. One consequence per class — A: clause, audit right and MFA access; B: clause; C: register entry.
• Cybersecurity clauses in the standard contracts. Practical recommendation for the minimum content: reporting deadline for the supplier's own incidents, passing the obligations on to subcontractors, evidence and audit rights, patch and vulnerability obligations, and an exit arrangement. Practical recommendation for the supplier's reporting obligation in the case of its own incidents: within 24 hours by contract. That is contract drafting, not a statutory deadline applying to the supplier.
• Right to audit for critical suppliers. Practical recommendation: set the cycle and lead time by contract and allow the submission of a valid certificate as an alternative to an on-site audit — for class A annually, with a lead time of 4 weeks.
• Contract register. Practical recommendation for the fields: supplier, risk class, clause status, and contract end and renegotiation date.

In practical experience, supply chain security under § 30(2) no. 4 BSIG is a frequent weak point — typically, cybersecurity clauses are missing from contracts. Practical recommendation for legacy contracts that cannot be touched before renewal: document a compensating technical measure until renegotiation, as a rule the controlled remote maintenance access described in section 2. The simplest way to record the current status is in the contract register. Directly alongside this stands security in the acquisition, development and maintenance of IT systems (§ 30(2) no. 5 BSIG) — in practice a documented vulnerability management with a defined process for coordinated vulnerability disclosure (CVD).

4. When is an incident reportable? The significance threshold

An incident only becomes reportable once it reaches the significance threshold — what matters here are the impacts named in § 2 no. 11 BSIG. Under § 2 no. 11 BSIG, a significant security incident exists where it has caused or is capable of causing severe operational disruption of the services or financial losses for the entity — or where it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage. Implementing Regulation (EU) 2024/2690 gives this threshold concrete form with quantitative criteria, but concerns only certain digital types of entity such as DNS service providers, cloud and data centre services or online marketplaces. For water and waste operations, the definition in § 2 no. 11 BSIG remains authoritative until a statutory instrument under § 56(5) BSIG is issued. In Austria the corresponding threshold is set out in § 35(1) NISG 2026; there the financial losses must expressly be severe. Practical recommendation: set the significance assessment out in advance in the incident response playbook — the 24-hour deadline runs from becoming aware of the incident, not from its beginning (§ 32(1) no. 1 BSIG).

Because a sector-specific specification for water and waste is so far lacking, the operation has to carry out the legal subsumption itself. Practical recommendation for the playbook: determine in advance which events in your operation you will measure against the two alternative sets of criteria in § 2 no. 11 BSIG. Candidates from water and waste operations:

• First alternative — severe operational disruption of the services or financial losses for the entity: failure or manipulation of the pump control or the chlorine dosing, loss of the control room's view of the pipe network, forced manual operation beyond the duration set in the business continuity plan, failure of weighing and route planning systems in waste disposal.
• Second alternative — effect on third parties through considerable material or non-material damage: interruption of supply to connected households and businesses, an order to boil drinking water, uncontrolled discharge of wastewater, failure to collect waste from third parties.

For each event, determine in advance from what extent and from what duration onwards you regard the threshold as reached, and document the assessment in the incident — including where it comes out against making a report.

Practical recommendation for three frequent events — the proposed thresholds are internal operational determinations, not legally prescribed thresholds:

For sites in Austria, keep this list separately: § 35(1) NISG 2026 expressly requires severe losses in the case of financial losses, and there the report goes not to the BSI and the BBK but to the competent CSIRT (§ 34(1) NISG 2026).

5. Reporting chain: 24 hours, 72 hours, one month

You report significant security incidents in up to four stages to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — § 32(1) nos. 1 to 4 BSIG; if the incident is still ongoing after one month, the progress report under § 32(2) BSIG is added. The reporting chain under Section 32 BSIG:

Practical recommendation on the reporting channel: clarify access to the joint reporting office of the BSI and the BBK before the emergency arises and record it together with the access credentials in the incident response playbook — within the 24-hour deadline there is no time to start looking for the reporting channel. Name a role authorised to report, together with a deputy, and keep an alternative channel available in case your own infrastructure is itself affected at the time of reporting (contact details and reporting templates outside the affected systems, for example on paper in the control room).

In addition to the BSI, the competent water authority may be involved; reporting and notification obligations under water law arising from Land legislation may be added and are not set out here. Practical recommendation: clarify the competent water authority and its reporting channel once in advance and record both in the incident response playbook.

6. Registration, evidence and management: what municipal utilities in Germany must do

Two obligations apply to every covered entity in Germany — registration and the responsibility of the management; for operators of critical installations the evidence requirement under § 39(1) BSIG is added. Registration takes place under § 33(1) BSIG via a registration facility set up jointly by the BSI and the BBK — in practice via the Mein Unternehmenskonto portal — at the latest three months after an entity qualifies for the first time or once again as a particularly important or important entity; the same obligation applies to domain name registry service providers (§ 33(1) BSIG). What must be transmitted is the name including the legal form and, where applicable, the commercial register number, the address and current contact details including email address, public IP address ranges and telephone numbers, the relevant sector under Annex 1 or 2, the EU Member States in which services are provided, and the competent federal and Land supervisory authorities; changes to this information must be notified subsequently (§ 33(5) BSIG, deadline in the table below). The central supervisory authority here is the BSI; which Land authority is to be entered is not set out here. Operators of critical installations register by way of derogation under § 8 KRITIS-Dachgesetz (§ 33(2) BSIG); if registration is not carried out, the BSI can carry it out itself (§ 33(3) BSIG).

The evidence requirement under § 39(1) BSIG applies to operators of critical installations: they demonstrate the implementation of the measures under § 30(1) in conjunction with § 31 BSIG at a point in time set by the BSI — at the earliest three years after they first qualify as the operator of a critical installation — and thereafter every three years by means of security audits, inspections or certifications, and transmit the results including any security deficiencies uncovered. The management must implement the risk management measures under Section 30 and monitor their implementation (§ 38(1) BSIG); if it breaches this obligation, it is liable to its entity for culpably caused damage under the company law rules applicable to the legal form (§ 38(2) BSIG). Added to this is the obligation to take part in training regularly (§ 38(3) BSIG). For breaches of risk management and reporting obligations, the fine range extends to EUR 10 million for particularly important entities and to EUR 7 million for important entities (§ 65(5) sentence 1 no. 1 BSIG); only from a total turnover exceeding EUR 500 million, and only for the breaches designated in § 65(6) and (7) BSIG, do 2 % or 1.4 % of worldwide total turnover take their place. Total turnover is the sum of all worldwide revenue of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). Where a data protection supervisory authority has already imposed a fine under the GDPR for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG).

Municipal legal forms and multi-utility groups

Coverage and registration attach to the individual entity, not to the municipal group. Practical recommendation: examine the thresholds in Section 28 BSIG separately for each legally independent unit — a municipal own-operation (Eigenbetrieb), an institution under public law (Anstalt des öffentlichen Rechts), a special-purpose association (Zweckverband) and a municipal utility GmbH are set up differently; for determining size, Recommendation 2003/361/EC applies under § 28(4) BSIG, with the exception of Art. 3(4) of its Annex; group membership may bring linked undertakings into the calculation.

In multi-division operations — a municipal utility with energy and water, in some cases with waste in addition — § 33(1) BSIG requires the relevant sector under Annex 1 or 2 to be stated. Practical recommendation: state all relevant sectors; internally, the highest relevant classification applies (section 1).

For the management, § 38(2) BSIG refers to the company law rules applicable to the legal form; where the relevant company law contains no such liability rule, the management is liable on a subsidiary basis under the BSIG itself pursuant to § 38(2) sentence 2 BSIG. Which rules these are for a municipal own-operation, an institution under public law or a special-purpose association is not set out here. Because the subsidiary liability under § 38(2) sentence 2 BSIG applies precisely where the relevant organisational law contains no liability rule, the written allocation of the obligations under Section 38 BSIG is in practice the decisive safeguard for a municipal own-operation, an institution under public law and a special-purpose association. Practical recommendation: record in writing who performs the obligations under Section 38 BSIG — the works management, the executive board or the managing directors — and document participation in training (§ 38(3) BSIG).

7. Austria: NISG 2026 instead of the BSIG

In Austria, water (Annex 1) and waste management (Annex 2) fall from 1 October 2026 under the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025), not under the BSIG: supervision by the Cybersecurity Authority (Cybersicherheitsbehörde), risk management under § 32, reporting of significant incidents to the competent CSIRT under § 34 (24 hours / 72 hours / 1 month) and registration under § 29 (dates in the table below). The BSI-KritisV and registration with the BSI and the BBK, by contrast, are purely German law. The fine ranges correspond to the Directive at up to EUR 10 million / 2 % (essential entities) and EUR 7 million / 1.4 % (important entities) respectively (§ 45(2) and (3) NISG 2026; the administrative penalties are imposed by the district administrative authority). The route to demonstrating compliance also differs: the three-year evidence requirement under § 39(1) BSIG concerns only German operators of critical installations; in Austria § 33 NISG 2026 applies instead — self-declaration of the risk management measures implemented (deadline in the table below) and, on request, evidence from an independent body within two years. Essential entities must demonstrate operational and organisational implementation within two months of the request.

In terms of timing, Austria lags behind Germany. The NISG 2026 has been promulgated (BGBl. I Nr. 94/2025, issued on 23 December 2025) and becomes applicable under § 51(1) and (2) on the first day of the following month after nine months have elapsed since promulgation. Size thresholds: a large undertaking from at least 250 employees onwards, or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total; a medium-sized undertaking from at least 50 employees onwards, or more than EUR 10 million annual turnover and more than EUR 10 million balance sheet total (§ 25(2) and (3) NISG 2026). Large undertakings among the Annex 1 types are essential entities; Annex 1 and Annex 2 types that are large or medium-sized undertakings are important entities, to the extent that they are not already essential entities (§ 24(1) and (2) NISG 2026). Two differences from Germany are material for implementation: incident reports go to the competent sector-specific CSIRT and, in the absence of one, to the national CSIRT (§ 34(1)) — forwarding to the Cybersecurity Authority takes place from there; and for the management bodies § 31 NISG 2026 applies, with duties to ensure implementation, to supervise and to take part in training, but without an explicit internal liability rule analogous to § 38(2) BSIG. In the public administration sector, the NISG 2026 covers the federal government and the Länder (§ 24(4) and (5)); municipalities and municipal associations are excluded there (§ 24(3) last sentence NISG 2026).