Greater Cybersecurity for Businesses
NIS2
Are you looking for experienced experts who can translate regulatory requirements into practical security processes?
With technical expertise, regulatory know-how, and a pragmatic approach, we provide comprehensive support for your implementation of the NIS2 Directive.
Whether it’s a GAP analysis, action planning, or operational implementation: We bring structure to complex requirements—in a practical, sustainable way that’s tailored to your business model.
Are you affected by NIS2?
NIS2 Quick Check of Impact
Are you prepared for the NIS2 Implementation and Cybersecurity Enhancement Act?
Or are you perhaps not even aware that your company might be affected?
An Overview of Our Expertise
To give you an insight into our successfully completed projects and our expertise, we have compiled a selection of anonymized client testimonials for you.
Would you like to learn more about how we successfully support companies in the areas of cybersecurity, DORA, ISO 27001, BCM, and other topics?
Discover more selected reference projects from various industries here:
NIS2 Reference Projects
Industry:
Small and Medium-Sized Enterprises
Position:
, Project Manager
Areas of Responsibility:
- Cybersecurity maturity analysis in accordance with NIST and the NIS2 draft
- Regular reporting and presentation of maturity levels to senior management
- Coordination of maturity levels with senior management
- Development of roadmaps and recommendations in the form of project packages to increase the maturity level
- Support with operational implementation / resolution of identified gaps
Industry:
Banking / Finance
Position:
Project Manager
Areas of Responsibility:
- Cybersecurity Maturity Assessment:
Conducting a comprehensive maturity assessment in accordance with DORA and the NIS2 draft. - Stakeholder Communication & Reporting:
Regular presentation of analysis results to executive boards, supervisory boards, regulators, government agencies, and works councils. - Coordination with Control Bodies:
Close collaboration and maturity level alignment with the first and second lines of defense. - Management Recommendations & Action Planning:
Development of concrete recommendations for action, management action plans, and defined project packages to increase the maturity level. - Operational Support & Resolution of Identified Gaps:
Upgrading vulnerability scans to authenticated scans; reviewing and refining (threat-based) playbooks in the SIEM environment; evaluating frameworks and processes for risk assessment; Strategic analysis and evaluation of additional technologies to improve network security (IDS/IPS), EDR configuration and deployment; concepts for data at rest and data in transit.
Network and Information Security
What is NIS2?
NIS2 is a landmark cybersecurity directive of the European Union that aims to establish a uniformly high level of cybersecurity throughout the EU, make security incidents more transparent, and significantly increase the resilience of the European economy against digital risks. Since its entry into force on January 16, 2023, NIS2 has represented a further development of the original “Network and Information Security” Directive (NIS).
The scope has been expanded and imposes significantly stricter requirements on companies in key sectors—medium-sized enterprises in critical economic and utility sectors are now also affected. The directive sets forth binding requirements for risk management, incident reporting, business continuity, and the handling of third-party providers.
Die drei Hauptsäulen von NIS2
NIS2 basiert auf drei strategischen Säulen, die zusammen ein robustes Fundament für ein hohes Cybersicherheitsniveau in Europa bilden:
Verantwortlichkeiten der Mitgliedstaaten
Staatliche Rahmenbedingungen für effektive Cybersicherheit:
- Aufbau nationaler Strategien und Behörden
- Krisenmanagement-Rahmen & CVD-Prozesse
- Koordination auf EU-Ebene
Risikomanagement & Unternehmenspflichten
Verbindliche Vorgaben für Unternehmen:
- Technische & organisatorische Sicherheitsmaßnahmen
- Verantwortung der Führungsebene
- Pflicht zur Vorfallmeldung innerhalb definierter Fristen
Zusammenarbeit & Informationsaustausch
EU-weite Kooperation zur Stärkung der Resilienz:
- CSIRTs-Netzwerk & CyCLONe
- Europäisches Schwachstellenregister & Peer Reviews
- ENISA-Cybersicherheitsberichte
The Key Objectives of NIS2
Why NIS2 Is Relevant to You
The NIS2 Directive strengthens cybersecurity in the EU by establishing uniform standards, enabling faster responses to incidents, and fostering closer cooperation among member states. For your company, this means clear obligations that offer both protection and competitive advantages.
With our expertise, you can implement these requirements in a pragmatic and sustainable way—while minimizing risks and penalties.
Objectives of NIS2:
- Enhancing cybersecurity: Uniform standards protect critical infrastructure and services from digital threats.
- Transparency through CSIRTs: The establishment of EU-wide networks of Computer Security Incident Response Teams (CSIRTs) enables monitoring, rapid response, and coordination in the event of cyber incidents, as well as the provision of alerts and information to stakeholders.
- Enhanced resilience: Robust risk management and emergency plans make companies more resilient to attacks.
- Harmonization within the EU: Uniform requirements promote cooperation and the exchange of information among member states.
Anwendungs- und Geltungsbereich
Die NIS2-Richtlinie betrifft eine breite Gruppe von Unternehmen, die kritische oder wichtige Dienste innerhalb der EU bereitstellen – unabhängig von ihrem Geschäftsmodell. Die folgende Übersicht zeigt, welche Unternehmen unter den vollen NIS2-Rahmen fallen und wer aufgrund seiner Kritikalität oder Größe besondere Bedingungen erfüllen muss.
| Wesentliche Einrichtungen (Essential Entities) | Wichtige Einrichtungen (Important Entities) |
|---|---|
|
Gilt für Sektoren gemäß Anhang I:
– Energie (Strom, Öl, Gas) – Verkehr (Luft, Schiene, Straße, Wasser) – Bankwesen & Finanzmarktinfrastruktur – Gesundheitswesen & Trinkwasser – Digitale Infrastruktur (z. B. Cloud, DNS) – Öffentliche Verwaltung – Weltraum Voraussetzungen: – > 50 Mitarbeitende oder – Jahresumsatz oder Bilanzsumme > 10 Mio. € |
Gilt für Sektoren gemäß Anhang II:
– Post- & Kurierdienste – Abfallwirtschaft – Lebensmittel, Chemie, Medizinprodukte – Hersteller von IKT-Geräten – Forschungseinrichtungen Voraussetzungen: – > 50 Mitarbeitende oder – Jahresumsatz oder Bilanzsumme > 10 Mio. € |
Sonderregelungen:
Auch kleinere Organisationen können unter die NIS2-Richtlinie fallen, wenn sie:
- der einzige Anbieter eines essenziellen Dienstes im Land sind,
- eine wichtige Rolle für öffentliche Sicherheit oder Gesundheit spielen,
- eine besondere systemische Bedeutung haben.
Report Security Incidents
Incident Reporting
The NIS2 Directive significantly tightens the requirements for reporting security incidents. Affected companies must follow a (four-) three-tiered reporting procedure.
What must be reported?
All incidents that have a significant impact on the provision of services. In particular, those caused by suspected malicious acts or that could have cross-border consequences.
Where should incidents be reported?
To the national CSIRT (Computer Security Incident Response Team) or the competent supervisory authority in the respective Member State.
Ensure NIS2 Compliance
NIS2 Analysis
We conduct a detailed assessment to determine whether and to what extent your company is affected by the NIS2 Directive. In doing so, we specifically identify areas where you can already make significant progress toward NIS2 compliance with minimal effort and simple measures.
Our NIS2 analysis provides a structured, high-level overview of your current NIS2 compliance—including a gap analysis with specific recommendations for improvement. A presentation of the results, featuring an overview of your compliance status, is, of course, included.
Depending on the size and complexity of your organization, the effort required ranges from 5 to 15 person-days (PD).
Comprehensive Analysis & Targeted Roadmap
NIS2 Deep Check
A NIS2 Deep Check is an in-depth review of NIS2 gaps, including coordination and the development of a mitigation plan or roadmap to prioritize and address the identified gaps.
All non-conformities with NIS2 are subject to a risk assessment and an estimate of the effort required to resolve them.
In addition, best-practice measures are recommended based on your organization’s risk appetite.
Depending on the size and complexity of your organization, the effort ranges from 15 to 80 person-days (PD).
FAQs
EU member states are required to transpose the NIS2 Directive into national law by the end of 2024 at the latest. Germany met this deadline and transposed the NIS2 Directive into German law at the turn of the year 2024/2025. As of today, the NIS2 implementation is largely in effect, which is why affected companies and organizations must now fully comply with the new requirements to remain in compliance with the law.
The NIS2 Directive (Directive (EU) 2022/2555) was published on December 27, 2022, in the Official Journal of the European Union (L333). It is available on the EU’s official EUR-Lex portal.
National implementation in Germany is carried out through the so-called NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). Due to early elections in 2024, the parliamentary process has not yet been fully completed. As of today, a final implementing law has not yet been adopted. Until a national implementing law is in place, the BSI Act (Act on the Federal Office for Information Security) continues to serve as the legal framework for cybersecurity requirements in Germany.
Current information on the legislative process and the implementation of the NIS2 Directive in Germany can be found on the website of the Federal Ministry of the Interior and Homeland (BMI).
The NIS2 Directive applies to so-called essential facilities and critical facilities (see Scope and Application). These include companies in the following sectors:
- energy, transportation, water, healthcare, aerospace, digital infrastructure, finance and insurance
- postal and courier services, waste management, chemicals, and food production
- Digital services: data centers, cloud services, content delivery networks, DNS providers, domain registrars, online marketplaces
Certain public administrations are also subject to the NIS2 Directive. Key factors include, among others, company size, market role, and the criticality of the services.
Compared to the original NIS Directive of 2016, NIS2 introduces significant changes:
- Expanded scope: Significantly more industries and companies are subject to the regulation.
- Stricter security requirements: Introduction of mandatory risk management, including measures for IT security, business continuity, and supply chain control.
- Revised reporting requirements: Security incidents must now be reported in several stages—initial notification within 24 hours, a detailed report within 72 hours, and a final report no later than one month.
- Duty to Inform Third Parties: Depending on the incident, affected customers, business partners, or authorities must also be notified.
- Liability & Governance: Management is explicitly held accountable—including personal liability risks in the event of breaches of duty.
Since the NIS2 Directive is deliberately worded in general terms in some respects, the specific details of the implementation requirements are left to the discretion of the individual EU member states. At this time, the corresponding German implementing law and the published Official Journal are not yet available in their final form.
Affected organizations must establish a comprehensive information security management system that addresses the following points:
- State-of-the-art risk management
- Preventive measures to defend against cyber threats
- Regular security audits and vulnerability management
- Incident management, including escalation and reporting processes
- Emergency and recovery plans
- Training and Awareness Initiatives
- Documentation and evidence management for regulatory authorities
Implementation can build on existing standards such as ISO/IEC 27001 or the BSI IT-Grundschutz, but must be specifically adapted to the requirements of NIS2.
Certifications such as ISO/IEC 27001 or the BSI IT-Grundschutz can serve as a basis for meeting the requirements of the NIS2 Directive. However, companies must ensure that all specific requirements of the directive are met, as certification alone does not automatically guarantee full compliance.
Compliance is demonstrated through the documentation and implementation of the required security measures. This includes, among other things, risk assessments, security policies, emergency plans, and training records. A comprehensive ISMS can help provide the necessary evidence.
Violations of NIS2 obligations can result in substantial fines. The directive provides for fines of up to €10 million or 2% of global annual revenue for critical infrastructure operators (whichever amount is higher). For important entities, the maximum is €7 million or 1.4% of revenue. In addition, entities may face regulatory orders, reputational damage, and restrictions on business operations.
The responsibility for complying with the NIS2 requirements lies with the company itself. What is new, however, is the explicit obligation of management to ensure the effective implementation of security measures. In the event of breaches of duty, executives may be held personally liable. This includes both civil and, where applicable, criminal consequences—particularly in cases of provable negligence or failure to comply.