Section 30 BSIG: 10 NIS2 Mandatory Measures for Companies Explained

Overview: what Section 30 BSIG requires

How this article is structured: it works through the ten measure areas of § 30(2) BSIG one by one — for each area, what the provision requires, what belongs to it in practice and how implementation can be evidenced. After the areas come Austria, evidence, management and sanctions; the ISO 27001 mapping then assigns each area the topics of ISO/IEC 27001:2022 Annex A together with a gap assessment, and the practical checklist lists the 22 templates typically produced along the way. First, the legal framework.

In-depth guide or overview? This article is the in-depth guide with ISO mapping and templates. If you first only need all ten obligations with the German and Austrian legal reference and a short status at a glance, you will find them in NIS2 Section 30 BSIG: All 10 Obligations in One Overview.

§ 30 BSIG (the BSI Act, official title: Act on the Federal Office for Information Security and on the Security of Information Technology of Entities; in force since 6 December 2025 through the NIS2UmsuCG) obliges particularly important entities and important entities — this being the official terminology of the BSIG for the entities that the NIS2 Directive calls "essential" and "important" — to take appropriate, proportionate and effective technical and organisational measures to manage cyber risks (§ 30(1) BSIG).

"Measures under subsection 1 should comply with the state of the art, take the relevant European and international standards into account and must be based on an all-hazards approach." — § 30(2) sentence 1 BSIG

The Act — the BSIG is a federal statute, not a regulation — lists ten measure areas in § 30(2) that every affected entity must address; the depth of implementation scales with the risk.

§ 30(1) BSIG states the protective objective itself: to avoid disruptions to the availability, integrity and confidentiality of information technology systems and to keep the impact of security incidents low. The same subsection contains the operationally most important ancillary duty — compliance must be documented. Practitioner reading of the three adjectives: "appropriate" means the fit between measure and risk, "proportionate" the relation between effort and risk, "effective" the evidence that the measure works — area 6 exists for that purpose.

The European basis is Art. 21 of Directive (EU) 2022/2555: appropriate and proportionate technical, operational and organisational measures (para. 1), an all-hazards approach and at least the ten areas of points (a) to (j) (para. 2). The BSIG adopts this catalogue and adds "effective" and the documentation duty.

Note on Austria: § 30 BSIG applies only in Germany. In Austria, the substantively parallel catalogue is found in § 32(4)(a) to (j) NISG 2026 (BGBl. I Nr. 94/2025) — likewise ten areas, in the same order ((d) = security of the supply chain, (g) = cyber hygiene and training). The competent authority there is not the BSI but the Cybersecurity Authority (Cybersicherheitsbehörde, Austria); reports go to the competent CSIRT. The NISG 2026 was promulgated on 23 December 2025 and will only be applied from 1 October 2026.

The 10 areas of § 30(2) BSIG at a glance

§ 30(2) BSIG names ten measure areas, and an affected entity must take measures in each of them — the numbering is the statutory order, not a prioritisation.

Who has to implement the 10 areas

The duty applies to particularly important entities and important entities under § 28 BSIG. Apart from the entities covered irrespective of size (including operators of critical installations, qualified trust service providers, TLD name registries, DNS service providers, certain telecoms providers, § 28(1) nos. 1 to 3 and (2) BSIG), classification does not start with the headcount but with the question of whether the company can be assigned to an entity type under Annex 1 or Annex 2 of the BSIG; only then does the size test follow.

Two pitfalls explain most misclassifications. First, turnover alone is never sufficient: § 28(1) no. 4(b) BSIG requires turnover above EUR 50 million and in addition a balance sheet total above EUR 43 million; only the headcount of 250 or more works on its own. Second, important entities have no upper employee limit — since § 28(1) no. 4 BSIG covers only Annex 1 types, a large company of an Annex 2 type (for example manufacturing, food, chemicals, waste management, research) remains an important entity and must implement all ten areas. For the size calculation, Recommendation 2003/361/EC applies, except for Art. 3(4) of its annex (§ 28(4) BSIG); the federal administration is covered separately under § 29 BSIG. Registration runs in parallel: at the latest three months after first classification, via the joint registration facility of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK), with changes within two weeks (§ 33(1) and (5) BSIG).

Areas 1 + 2: risk analysis + incidents

Area 1 requires policies on risk analysis and on information system security, area 2 the handling of security incidents — both carry the remaining eight areas.

Area 1 — what to do: define a methodology, use it to assess assets, threats and risks, record the result in the risk register, derive a risk treatment plan. Why: § 30(1) BSIG requires proportionate measures — proportionate to what can only be justified on the basis of a documented risk analysis. It also demonstrates that an area was deliberately implemented in a lean way and not simply forgotten.

Area 2 — what to do: define detection, assessment, containment and follow-up as processes and anchor the reporting chain to the joint reporting office of the BSI and the BBK — following the three-stage scheme of § 32(1) BSIG:

If the incident is ongoing, a progress report initially takes the place of the final report; the final report follows once handling has been concluded (§ 32(2) BSIG). The reporting chain is triggered by the "significant security incident" under § 2 no. 11 BSIG: an incident that has caused or can cause severe operational disruption of the services or financial loss for the entity, or that has affected or can affect other natural or legal persons by causing considerable material or non-material damage. Quantitative thresholds are set out in EU Implementing Regulation 2024/2690 — but only for certain digital entity types such as DNS service providers, TLD name registries, cloud and data centre services, managed (security) service providers, online marketplaces and trust service providers (cf. § 30(3) BSIG). For all others, the definition in § 2 no. 11 BSIG applies until a statutory instrument under § 56(5) BSIG is issued.

Practitioner note: the 24-hour deadline for the early warning runs from becoming aware — not from the start of the incident. Organisational consequence: the reporting chain should also be reachable outside business hours so that the deadline can be met. Practical recommendation: set out in writing who within the company triggers "awareness", and store the reporting templates where the on-call service works at night — missed deadlines rarely fail because of technology, usually because of an unclear escalation threshold.

Area 3: business continuity

"Business continuity, such as backup management and disaster recovery, and crisis management" — § 30(2) no. 3 BSIG.

• Business continuity plan (BCP) with RTO/RPO per business process
• Backup strategy (3-2-1 principle or equivalent)
• Disaster recovery plan with a tested recovery routine
• Crisis management plan + internal/external communication

Why the three elements belong together: the wording names backup management, recovery and crisis management in one breath. In practice, a backup without tested recovery cannot be shown to be effective; nor can recovery without a crisis organisation. Anyone who wants to meet the 72-hour report with an initial assessment (§ 32(1) no. 2 BSIG) needs an operational crisis organisation within exactly that window — reporting and restart run in parallel.

Practical rhythm (not a statutory deadline): agree RTO and RPO values with the business units, do not set them in IT alone; test recovery in such a way that a record with date, scope and result is produced. That record directly evidences the effectiveness required by § 30(1) BSIG.

Areas 4 + 5: supply chain + secure development

In practice, area 4 is among the most frequent gaps (editorial assessment, not an official statistic). Typical content (practice standard, not an exhaustive statutory list):

• Supplier assessment with risk classification
• Cybersecurity clauses in standard contracts
• Right to audit for critical suppliers
• Incident notification by suppliers to you as the client (max. 24h)

Distinction from the 24-hour deadline: the 24-hour requirement towards suppliers is a contractual arrangement from practice, not a statutory supplier deadline. What is addressed by law is the early warning under § 32(1) no. 1 BSIG, and it applies to the reporting entity itself. The reason for mirroring it contractually: your own deadline runs from your awareness — if a service provider only reports days later, the incident has long since escalated.

Area 5: secure software development — typically OWASP-oriented plus vulnerability management following a CVD process (Coordinated Vulnerability Disclosure). The statutory scope is broader: § 30(2) no. 5 BSIG covers security in acquisition, development and maintenance, including vulnerability management. This means that the purchase of off-the-shelf software and the patching practice for bought-in systems also fall within this area — for companies without their own development, that is the genuinely relevant part.

Area 6: effectiveness assessment

A duty to have "policies and procedures to assess the effectiveness of risk management measures in the field of information technology security" — § 30(2) no. 6 BSIG. In practice:

• KPIs per area (e.g. patch compliance rate, phishing click rate, recovery time)
• Quarterly reporting to the management
• Annual penetration test (practical rhythm)
• Internal audit + external audit every 2 years

Why this area weighs more heavily than its position suggests: § 30(1) BSIG expressly also requires effective measures. Area 6 is the procedure by which you evidence that effectiveness; together with the documentation duty it forms the part of your implementation that a supervisory authority can examine without touching your technology.

Practical rhythm instead of a statutory deadline: quarterly reporting, an annual penetration test and the two-year audit cycle above are practical rhythms, not deadlines from § 30 BSIG. A legally fixed cycle is laid down in § 39(1) BSIG for operators of critical installations — details in the section on documentation and evidence.

Area 7: cyber hygiene

"Basic training and awareness-raising measures in the field of information technology security" — § 30(2) no. 7 BSIG. The common term "cyber hygiene" does not come from the BSIG but from the NIS2 Directive: "basic cyber hygiene practices and cybersecurity training" (Art. 21(2)(g) of Directive (EU) 2022/2555).

• Quarterly phishing simulation with click-rate monitoring
• Annual training for all staff (with a quiz)
• Onboarding training for new employees (practical rhythm: within the first 4 weeks)
• Sector-specific deep dives (e.g. SCADA training in industry)

The second training duty is regularly overlooked: area 7 addresses employees — § 38(3) BSIG additionally obliges the management bodies themselves to attend training regularly. At EU level, both are set out in Art. 20(2) of Directive (EU) 2022/2555; in Austria, the parallel provision § 31(2) NISG 2026 applies from 1 October 2026.

Practical rhythm (not a statutory deadline): quarterly simulations, annual basic training and the four-week onboarding rule are proven cadences, not requirements of § 30 BSIG. Keep proof of participation by person and date — the participation rate is one of the few KPIs for area 6 that can be measured without an additional tool.

Area 8: cryptography

Area 8 concerns cryptography and encryption (§ 30(2) no. 8 BSIG). Because § 30(1) BSIG requires compliance to be documented, the technology deployed is not enough on its own — you must record which method applies where and who manages the keys.

The table is practical guidance based on the state of the art, not a statutory list: which methods are to be used specifically follows from the risk analysis under area 1 and changes with the state of the art. Area 8 therefore includes a revision status — a cryptography policy without a review date cannot evidence ongoing alignment.

Areas 9 + 10: human resources security + authentication

Areas 9 and 10 govern who can reach the systems and how that person identifies themselves — the two areas with the most immediate bearing on everyday work.

On area 9: § 30(2) no. 9 BSIG combines human resources security and access control. The offboarding workflow is the interface between both topics and the simplest check point: comparing active accounts against the staff list shows within minutes whether the authorisation concept is lived or merely described.

On area 10: the Act names "multi-factor authentication or continuous authentication" — the alternative is part of the provision, so the choice must be justified on a risk basis and documented. The second part concerns secured communication including emergency communication: a crisis plan that communicates exclusively via the potentially compromised regular infrastructure does not hold up in practice.

Austria: § 32 NISG 2026 instead of Section 30 BSIG

For Austrian entities, § 30 BSIG does not apply; § 32 NISG 2026 does — with its own wording and only from 1 October 2026. Under § 32(1) NISG 2026, appropriate and proportionate risk management measures of a technical, operational and organisational nature must be implemented in order to reduce risks to network and information systems. The Austrian wording does not contain the element "effective" from § 30(1) BSIG — the provisions are related, but not identical in wording. Classification follows §§ 24 and 25 NISG 2026 (large undertaking from at least 250 employees, or where annual turnover exceeds EUR 50 million and the balance sheet total exceeds EUR 43 million; medium-sized undertaking from at least 50 employees, or where each exceeds EUR 10 million).

Group structures with German and Austrian companies register separately in both countries. Risk management, the ISMS, the incident response playbook and supplier assessment are transferable; the Austrian supervisory and reporting channels and the evidence and self-declaration duties of § 33 NISG 2026 are not.

Documentation and evidence

Evidence is provided first of all through your own documentation: § 30(1) BSIG makes documenting compliance a duty — for all affected entities, not only for operators of critical installations. Each of the ten areas requires a named document, a responsible owner and a status date. Beyond that, the evidence regimes of the two countries differ:

• Germany: operators of critical installations evidence implementation at a point in time set by the BSI — at the earliest three years after first classification, and every three years thereafter, by means of security audits, reviews or certifications; the results, including any security deficiencies identified, must be transmitted (§ 39(1) BSIG).
• Austria (from 1 October 2026): all essential and important entities transmit structured information on the measures implemented to the Cybersecurity Authority within twelve months of the registration duty arising — a self-declaration (§ 33(1) NISG 2026). Upon request, implementation must be evidenced within two years by an independent body; essential entities must evidence operational and organisational implementation within as little as two months of the request (§ 33(2) NISG 2026). The first request may be made at the earliest two years after entry into force, that is from 1 October 2028.

Practical recommendation: record the assignment of document to area in writing and maintain it with every release. When a request comes in, this list is the fastest answer and at the same time a building block of the documentation of compliance required by § 30(1) BSIG.

Management: approval, monitoring, training

Responsibility for the ten areas lies with the management: § 38(1) BSIG obliges the management bodies of particularly important entities and important entities to implement the risk management measures to be taken under § 30 and to monitor their implementation. If they breach these duties, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form (§ 38(2) BSIG); under the BSIG itself, the management is liable only on a subsidiary basis, namely where the relevant company law contains no such liability rule (§ 38(2) sentence 2 BSIG). In addition, there is the duty to attend training regularly (§ 38(3) BSIG). At European level, this corresponds to Art. 20(1) of Directive (EU) 2022/2555. In Austria, from 1 October 2026 management bodies must ensure and supervise compliance with the measures under § 32 (§ 31(1) NISG 2026) — the NISG 2026 does not contain an express internal liability rule such as § 38(2) BSIG.

Sanctions for breaches

Breaches of the risk management and reporting duties carry fines; the level depends on the entity class, not on which of the ten areas is affected.

Unlike the Directive, the BSIG knows no blanket "the higher figure applies": the turnover variant only applies where total turnover exceeds EUR 500 million and only for the breaches designated in § 65(6) and (7) BSIG. Total turnover is the sum of all worldwide turnover of the undertaking to which the entity belongs, in the financial year preceding the authority's decision (§ 65(8) BSIG). Where a data protection supervisory authority has already imposed a GDPR fine for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG). In Austria, from 1 October 2026 administrative penalties are imposed by the district administrative authority (§ 44(1) NISG 2026); other infringements there carry penalties of up to EUR 50,000, and up to EUR 100,000 in the event of repetition (§ 45(4) NISG 2026).

ISO 27001 mapping

An existing ISO 27001 certification carries a large part of the ten areas but does not close them — the gaps lie where NIS2 adds supervisory duties that a management system standard does not know. The "gap likelihood" column is a practical assessment, not a normative statement.

The largest gaps can be explained in substance: the reporting deadlines of § 32(1) BSIG have no counterpart in Annex A, and the reporting addressed to the management follows from § 38(1) BSIG, not from certification logic.

Practical checklist: 22 templates for the 10 Section 30 BSIG areas

The list assigns to the ten areas the documents that typically arise during implementation — a practical checklist, not a statutorily prescribed list of documents: § 30 BSIG prescribes areas, not file names.

1. ISMS policy
2. Risk analysis methodology
3. Risk register
4. Risk treatment plan
5. Incident response policy
6. Incident playbook
7. 24h/72h/30d reporting templates (3 items)
8. Business continuity plan
9. Backup & recovery concept
10. Disaster recovery plan
11. Crisis management plan
12. Supplier questionnaire
13. Cybersecurity contract clauses
14. Vulnerability management process
15. Vulnerability disclosure policy
16. Cyber hygiene training
17. Phishing simulation concept
18. Cryptography policy
19. Authorisation concept
20. MFA policy
21. Asset inventory
22. Audit checklist + effectiveness measurement