Skip to main content

NIS2 Compliance: A Comprehensive Guide for German Companies

· 7 min read
Jan Richter
Jan Richter

The NIS2 Directive (Directive (EU) 2022/2555) represents the most significant overhaul of European cybersecurity legislation in a decade. With the NIS2-Umsetzungsgesetz entering into force on March 6, 2026, German organizations face binding legal obligations and personal liability for executive management bodies.

Czech readers: the same qualification is available in Czech at czecure.eu/cs, aligned to the Czech transposition law (zákon č. 264/2025 Sb.).

As a former head of IT in a regulated company, I have resolved both external and internal cyber incidents and know from first hand that ISO 27001 and similar frameworks only provide a limited basis for real cybersecurity. NIS2 requires evidence of execution, not documentation of intent. Here is what you need to know.

Understanding NIS2 Scope: Are You Affected?​

The first critical question: does NIS2 apply to your organization?

Essential Entities (EU-weit verpflichtend)​

  • Energy (electricity, district heating/cooling, oil, gas, hydrogen)
  • Transport (air, rail, road, maritime, inland waterways)
  • Banking and financial market infrastructure
  • Healthcare (hospitals, medical device manufacturers, laboratories)
  • Drinking water and wastewater
  • Digital infrastructure (cloud providers, data centers, DNS)
  • Public administration (central and regional governments)

Important Entities (Mitgliedstaaten entscheiden über Anwendung)​

  • Postal and courier services
  • Waste management
  • Chemical production
  • Food production, processing, and distribution
  • Manufacturing (computers, electronics, machinery, motor vehicles)
  • Research institutions

The SME Exemption Trap​

Organizations with fewer than 50 employees AND annual turnover below €10 million may qualify for exemption. However, this is not automatic:

  • Count all employees across parent and subsidiary companies
  • Calculate turnover based on EU-wide consolidated figures
  • The exemption applies to the entire corporate group, not individual entities

If your organization provides services to critical infrastructure operators, you may still be subject to supply chain security requirements regardless of size.

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

The 10 NIS2 Security Categories​

Article 21 of NIS2 mandates specific security measures across these domains:

1. Risk Analysis and Security Policy​

  • Documented risk assessments covering all critical functions
  • Security policies reviewed annually and after significant changes
  • Business continuity and disaster recovery plans

2. Incident Handling​

  • Documented incident response procedures
  • 24-hour notification to national authority for significant incidents
  • 72-hour submission of incident report with initial assessment

3. Business Continuity​

  • Backup and recovery procedures tested quarterly
  • Crisis communication plans
  • Redundancy for critical systems

4. Supply Chain Security​

  • Security requirements in vendor contracts
  • Third-party security assessments
  • Dependency mapping for critical suppliers

5. Security in Network Acquisition​

  • Security-by-design requirements
  • Vulnerability management for all acquired systems
  • Patch management procedures

6. Cyber Hygiene and Training​

  • Annual security awareness training
  • Phishing simulation exercises
  • Role-specific training for security personnel

7. Asset Management​

  • Comprehensive inventory of IT assets
  • Configuration management database (CMDB)
  • Asset classification based on criticality

8. Access Control​

  • Zero-trust architecture principles
  • Multi-factor authentication enforced
  • Privileged access management (PAM)

9. Cryptography​

  • Encryption standards meeting current best practices
  • Key management procedures
  • Cryptographic agility for algorithm transitions

10. Physical Security​

  • Access controls for server facilities
  • Environmental controls
  • Visitor management

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

Personal Liability: What Executives Need to Understand​

This is critical: Under NIS2 Article 20, management bodies can face personal liability for compliance failures.

What This Means Practically​

  1. Fines: Up to €10 million or 2% of global annual turnover (whichever is higher) for essential entities
  2. Reputational damage: Public disclosure of non-compliance
  3. Operational restrictions: Competent authorities can mandate temporary restrictions on business activities
  4. Personal liability: Individual executives can be held accountable

Your Fiduciary Duty​

As a management body member, you are personally responsible for:

  • Approving and overseeing implementation of security measures
  • Ensuring adequate budget allocation for cybersecurity
  • Receiving regular briefings on security posture
  • Including cybersecurity in risk management oversight

The "I didn't know" defense is not acceptable. Regulators expect executives to demonstrate active engagement with cybersecurity governance.

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

The 72-Hour Timeline: Incident Response Reality​

When a significant security incident occurs, NIS2 mandates strict timelines:

PhaseDeadlineAction
Initial notificationWithin 24 hoursEarly warning to BSI-CERT
Incident reportWithin 72 hoursInitial assessment, severity classification
Final reportWithin 1 monthDetailed report with root cause analysis
Interim updatesOngoingAny significant developments

What Constitutes a "Significant Incident"?​

An incident is significant if it:

  • Causes severe operational disruption or financial loss
  • Affects other natural or legal persons (e.g., supply chain impact)
  • Has resulted or may result in substantial harm (data breaches affecting personal data)

Document everything from the first moment of suspicion. Your incident response documentation will be scrutinized.

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

Supply Chain Security: The Often-Ignored Requirement​

Organizations often focus on internal security while neglecting the supply chain, a critical vulnerability.

Practical Steps​

  1. Map your critical dependencies

    • Identify all vendors with access to your systems
    • Classify vendors by criticality
    • Document data flows with external parties

  2. Contractual security requirements

    • Include security SLAs in all vendor agreements
    • Require vulnerability disclosure procedures
    • Mandate incident notification within defined timeframes

  3. Ongoing monitoring

    • Annual security questionnaires
    • Penetration test results sharing requirements
    • Right to audit clauses

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

From Paper Compliance to Execution Evidence​

Many organizations achieve "paper compliance": they have the documentation but cannot demonstrate actual security effectiveness.

The Problem​

NIS2 requires proof of execution, not just existence of policies. When regulators audit, they look for:

  • Evidence that controls were tested
  • Metrics demonstrating security effectiveness
  • Documented remediation of findings
  • Continuous improvement over time

The Three-Stage Qualification Approach​

Adopted from regulated pharmaceutical manufacturing and applied to security measures that classic CSV programs do not cover, I qualify your measures in three stages:

  1. Installation qualification: Is each measure correctly implemented and configured?
  2. Operation qualification: Does it run continuously and can this be proven with logs and evidence?
  3. Performance qualification: Does it hold up under load, the way a real incident or an audit demands?

This isn't about creating mountains of documentation, it's about creating execution evidence that proves your security measures work.

Need to prove this to an enterprise buyer or regulator? CZECURE qualifies your measures across all NIS2 domains and delivers a Qualification Report - expert-authored, mapped to the directive, ready for procurement.

How I Can Help​

Three tiers, no lock-in:

  1. Free NIS2 self-check: 20 questions, 10 areas, 3 minutes, runs in your browser.
  2. NIS2 Qualification: EUR 4,900 fixed, written Qualification Report in 5 working days, no system access needed. You run the versioned qualification protocols in your own environment, I qualify the raw evidence, individual performance tests run live on screenshare.
  3. Implementation support: EUR 2,400 per month, cancelable monthly.

Curious what a finished report looks like? View the sample report (PDF).

Questions about your specific situation? Connect with me on LinkedIn or visit CZECURE.eu.