NIS2 Mandatory Measures Audit
Are the ten areas of mandatory measures under § 30(2) BSIG audit-ready? Eight questions, instant score, individual action plan. About three minutes — as of 17 August 2026.
8 questions · reading time ~3 min · instant scoring · no sign-up · cookieless · no data transfer, evaluated locally in your browser
Practitioner note: This self-assessment is an orientation tool, not legal advice. We are compliance specialists, not a law firm. NIS2 obligations under § 30 BSIG and the management duties under § 38 BSIG require an individual legal review. The German NIS2UmsuCG is in force since 6 December 2025; the reporting duty under § 32 BSIG applies at the earliest once the reporting channel has been set up (§ 32(1) last sentence), and reports are filed via the BSI portal.
Sources
- Directive (EU) 2022/2555 — NIS2 (as of 14 December 2022, transposition deadline 17 October 2024)
- BSIG 2025 (BSI Act, consolidated post-NIS2UmsuCG) (in force since 6 December 2025, last amended 23 July 2026) — § 30 mandatory measures, § 32 incident reporting (24 h / 72 h / final report at the latest one month), § 38 management duties, § 65 fines
- NIS2UmsuCG — Federal Law Gazette I 2025 No. 301 (Regulation Text PDF) (promulgated 5 December 2025)
- European Commission — Digital Omnibus on data, incl. a single-reporting mechanism for cyber incidents (proposal of 19 November 2025; still a proposal as of 17 August 2026 — unlike the Digital Omnibus on AI, Regulation (EU) 2026/1744, which is in force since 27 July 2026)
- Regulation (EU) 2022/2554 — DORA (applicable since 17 January 2025) — lex specialis to NIS2 for the financial sector