Legal obligation · Cybersecurity
Sightadel breaks the ten measures under section 30 of the German BSI Act (BSIG) down into 40 controls, prepares the reporting chain before anything happens, and records what management has resolved – with industry templates, AI as drafting help and real consultants for the difficult parts.
What it is about
NIS2 is an EU directive for stronger cybersecurity in key sectors of the economy. In Germany, it applies through the German NIS2 Implementation Act (NIS2UmsuCG), which has been in force since December 2025 and has recast the German BSI Act (BSIG). Since then, considerably more companies are covered than previously under the KRITIS rules.
At its core, the law requires four things: appropriate risk management measures in ten areas under section 30 BSIG, a reporting chain for significant security incidents under section 32, registration with the Federal Office for Information Security (BSI) under section 33, and management that implements the measures, oversees their implementation and undergoes training itself (section 38).
There is no certificate. NIS2 is an obligation subject to supervision. What counts is your documentation: who implemented, checked and resolved what, and when. Most organisations have long been doing much of this – they just cannot show it.
More on the matching software: NIS2 software, with features, rollout and prices.
From now on, it is about evidence. The measures must be implemented and documented; management is responsible for implementation and must oversee it.
Registration with the BSI is still outstanding or implementation has not started. An orderly implementation with dates and owners is what reduces the backlog.
You are not covered by the law yourself, but the requirements reach you through the supply chain. Your customer must assess you and will ask for evidence.
Technology and evidence from one source
For entities within the scope of the German BSI Act, we offer a coordinated package together with Valar and veyrisk: evidence management under section 30 BSIG in Sightadel, a hardware firewall for network segmentation and secured communication, and ongoing vulnerability management. The results feed into Sightadel as evidence.
Important and essential entities under the German BSI Act
To prove that the measures are effective (§ 30(2) nos. 5–6)
We put the package together to match the size and sites of your entity. You will receive the offer after a short conversation.
Request packageRequirements
Summarised in our own words. The original text in its current version is always authoritative.
A documented scope, a repeatable risk analysis, a treatment plan and a policy adopted by management.
In SightadelRisk register with method, assessment and follow-up. The industry template suggests typical risks; you decide on the assessment and the accepted residual risk.
A process for security incidents, backup management with tested restoration and an emergency and crisis plan.
In SightadelControls on incident process, incident register, backup concept and restore tests. Test logs carry a date and expire when the next test is due.
Know critical service providers, agree security requirements contractually and assess vendors regularly.
In SightadelIn the Vendors module, you record service providers with criticality, questionnaires and evidence including validity dates. Expired certificates are flagged before anyone asks.
Security in acquisition, development and maintenance, vulnerability handling and a regular assessment of whether the measures are effective.
In SightadelFindings from scans and tests become issues with a deadline. Sightadel schedules internal review and management review as a recurring cycle.
Basic cyber hygiene practices, training for all employees and a concept for cryptography and encryption.
In SightadelTraining as recurring cycles with proof of attendance. The template provides a draft cryptography concept; you decide which methods are permitted.
Human resources security, access control, an asset inventory, multi-factor authentication and secured communication, including in emergencies.
In SightadelGuided questions on access rights, recertification, leaver process and multi-factor authentication coverage. Exceptions are recorded with a justification and expiry date.
Early warning to the BSI within 24 hours and incident notification within 72 hours of becoming aware, final report no later than one month after the notification was submitted.
In SightadelReporting channels, responsible persons and deputies are set up in advance. You enter the time of becoming aware, and the three deadlines are calculated from it. The templates are ready.
Entities in scope register with the BSI and keep their details up to date.
In SightadelThe classification as an important or essential entity is documented with a justification, and the registration including its date is filed as evidence.
Management implements the measures, oversees their implementation and regularly attends training. Responsibility remains with management, even if others take on tasks.
In SightadelA resolution sheet to print, sign and file. Management's training records are kept with an expiry date like all others.
Process
Three to nine months to a robust state of evidence, depending on how much is already practised but just not documented. If you run an ISMS based on ISO 27001, you are more likely to be at the lower end.
Check sector, headcount and turnover, record the classification, complete registration with the BSI. Then define the boundaries of sites, systems and service providers.
Work through the 40 controls with guidance. Upload and assign existing documents. At the end, you know what is documented and what is missing.
Define responsible persons, deputies and contact details, file reporting templates. This comes before everything else, because an incident does not wait.
Action plans with owners and due dates. Typical big items are restore tests, vendor assessment and multi-factor coverage.
Management undergoes training, resolves to implement the measures with a date and defines how it oversees implementation.
Internal review, management review, incident process exercise. These steps then recur as a cycle.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
What matters is the activity, not the entry in the commercial register. Check all business areas against the types of entity and document the result.
Registration with the BSI is a separate obligation with a deadline. Complete it early and keep your details up to date.
Acknowledgement by email is not enough. Management must implement measures, oversee implementation and undergo training itself, documented with dates.
A reporting chain that has never been practised will fail the 24-hour deadline. Practise at least annually and keep deputies up to date.
Many incidents start with service providers. Record critical vendors, agree security requirements and assess them regularly.
A “NIS2 certificate” on offer has no legal effect. What matters is your documented state of evidence for the BSI.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
The measures under § 30 BSIG largely match Annex A. NIS2 adds the reporting chain, registration and the management resolution.
DORAFor financial entities, DORA takes precedence. Risk management, incident handling and vendor management can be proven with the same evidence; the reporting deadlines differ in their starting point.
BSI C5Cloud providers with a C5 attestation already have audited documentation of access control, cryptography and operations. This evidence carries over into several NIS2 measures.
NIST CSF 2.0The Identify, Protect, Detect, Respond and Recover functions organise the same topics. Useful for presenting maturity to management and US customers.
GDPRTechnical and organisational measures under Art. 32 and personal data breach notification rely on the same processes. One incident can trigger both reporting obligations.
Audit and evidence
Supervision lies with the BSI. It can request evidence, order audits and impose fines for violations. In addition, there are customers who assess you as a supplier, and internal audit or external auditors whom you commission yourself. Sightadel does not certify and does not provide legal advice.
Whoever audits receives their own access in Sightadel and can never delete anything. The activity log shows in full who did what and when, and in the Trust Center you show customers your status without sending attachments every time. ISO 27001 certification is a proven, structured foundation, but it is not mandatory. If you would like an external audit, choose an auditor from our independent partner network or your own. No commission is paid for audits – neither to us nor to the partners.
To the independent auditor networkWith NIS2 there is no certification fee, because there is no certificate. Costs arise in three places. First, the tool: the Sightadel licence for NIS2 is charged monthly per edition, with a minimum term of one year. If your Sightadel licence includes ISO 27001 or ISO 9001, you receive a permanent discount on NIS2. You will find all prices and a calculator on our pricing page.
Second, the internal effort. One responsible person must steer implementation, coordinate risk analysis and measures, and involve management. On top of that come IT, purchasing for the supply chain, HR for training and management itself, which must implement, oversee and undergo training. How much time this takes depends heavily on the starting point: if you already run an ISMS, you mainly add the reporting chain, registration and management resolution.
Third, the technical measures that are still missing. Typical gaps are multi-factor authentication for all access, tested restoration from backups, an asset inventory and a defined approach to vulnerabilities. These costs arise regardless of the tool. Optionally, there are external audits that you commission yourself, for example to demonstrate an independent view to customers or your own supervisory board. You can add consulting as a package in the Sightadel app.
The German BSI Act (BSIG) requires four things of entities in scope: risk management measures under section 30, reporting of significant security incidents under section 32, registration with the BSI under section 33, and management that takes responsibility under section 38. Operators of critical facilities are subject to additional requirements, including regular proof to the BSI.
The fines are considerably higher than before. For violations of the measures and reporting obligations, essential entities face up to €10 million or 2% of worldwide annual turnover, and important entities up to €7 million or 1.4%, whichever is higher in each case. Violations of the registration obligation are also subject to fines. The BSI can also request evidence, order audits and issue instructions.
For management, section 38 is decisive. It must implement the measures, oversee their implementation and regularly attend training. Even if IT does the work, responsibility remains with management. If management culpably breaches these duties, it is liable to the entity under company law. A dated, signed resolution and training records are therefore more than formalities. Sightadel does not provide legal advice. Consult your legal advisers for an assessment of your individual case.
Applicability is determined by two questions: does your activity fall under one of the types of entity listed in the annexes to the BSIG, and do you reach the size thresholds? What matters is the activity, not the sector entered in the commercial register. A machine builder that operates a data centre for third parties or a retailer that also disposes of waste may be covered unexpectedly. For some types of entity, the obligations apply regardless of size.
For groups of companies, calculating the thresholds is not trivial, because headcount and turnover of partner and linked enterprises may have to be included. A careful review, documented with a justification, is worthwhile here.
Entities in scope must register with the BSI no later than three months after first falling under the law. For entities that were already covered when the law entered into force in December 2025, this deadline has passed. If you have not yet registered, you should do so immediately. You must also notify the BSI of any changes to your details. In Sightadel, you document the classification with a justification and file the registration including its date as evidence.
Unlike a standard, the law does not prescribe a list of documents. In a real case, however, you must prove to the BSI that you have implemented appropriate measures. This determines what should be in place: an information security policy, a documented risk analysis with a treatment plan, concepts and evidence for the ten areas of measures under section 30, a reporting chain with responsible persons and deputies, registration with the BSI, and management's resolution and training records.
The measures include concrete evidence from operations: logs of restore tests, results of access reviews, training attendance lists, assessments of critical service providers, an asset inventory and evidence of multi-factor authentication. A concept without evidence of implementation counts for little.
In Sightadel, each measure is broken down into controls to which you attach evidence with expiry dates. The activity log shows who did what and when, and the auditor receives their own access without deletion rights. When the BSI makes a request, you compile your status instead of having to search for it first.
The reporting deadlines are tight and start when you become aware of a significant security incident: early warning within 24 hours, incident notification within 72 hours, final report within one month. In a real incident, the team works under pressure, often outside business hours. Anything not clarified beforehand will then cost hours.
So clarify in advance: who decides whether an incident is significant, and according to what criteria? Who reports, who deputises? Which channel is used to report to the BSI? Who informs customers, if necessary? And who checks whether there is also a personal data breach under the GDPR that must be reported to the data protection supervisory authority?
Practise the chain at least once a year using a realistic scenario. In Sightadel, reporting channels, responsible persons and deputies are on record. You enter the time of becoming aware, the three deadlines are calculated from it, and the templates are ready. Exercises and real incidents are traceable in the activity log.
NIS2 is not a project with an end date. The measures must reflect the state of the art, and that changes. Risk analysis, vendor assessments, access reviews, restore tests and training belong in a fixed annual rhythm. Management should oversee implementation regularly and document this, for example in an annual report with a resolution.
ISO 27001 is not mandatory for NIS2, but it is the most proven framework. The risk management measures under section 30 largely match Annex A. If you run a certified ISMS, you have done a large part of the work and add registration, the reporting chain, the management resolution and management training. If you do not yet have an ISMS, you can also implement NIS2 without certification and decide later whether the step to a certificate is worthwhile.
In Sightadel, you link a piece of evidence once to all matching requirements from NIS2, ISO 27001, the GDPR or DORA. Recurring tasks run as cycles with reminders, and in the Trust Center you show your status to customers who assess you as a supplier.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
↓NIS2 – checklist for § 30 BSIGChecklist · XLSX, PDF↓NIS2 – reporting templates 24 h / 72 h / 1 monthTemplates · DOCX, PDFPractical aids, not legal advice.
Terms
The check has two stages. First, the sector: does your activity fall under the types of entity in the BSIG? Second, size: from 50 employees or more than €10 million in turnover and balance sheet total, you count as an important entity; from 250 employees or more than €50 million in turnover and €43 million balance sheet total, as an essential entity. Some entities are covered regardless of size. If in doubt, have the classification clarified legally.
For violations of the measures or reporting obligations, the BSIG provides for up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher in each case. Failure to register can also result in a fine.
Management must implement the measures, oversee their implementation and regularly attend training. If it culpably breaches these duties, it is liable to the entity under company law. In practice, this means a dated, signed resolution belongs in the minutes, not an email saying “looks fine”.
No. NIS2 is not a certifiable standard but an obligation subject to supervision. You prove implementation to the BSI, not to a certification body. A “NIS2 certificate” on offer has no legal effect.
Three. The early warning and the notification run from the time you become aware of a significant security incident: early warning within 24 hours, incident notification within 72 hours. The final report follows no later than one month after the notification was submitted. If the incident is still ongoing at that point, a progress report follows first. Note the date and time of becoming aware before you do anything else.
No. ISO 27001 is not a must, but it is the most proven way to implement the measures in a structured manner. If you already run an ISMS, you mainly add the reporting chain, registration and the management resolution.
No, deliberately so. The AI provides drafts from industry templates and helps with the wording. You decide on risk assessment, residual risks and responsibilities yourself – that is exactly what the supervisory authority wants to see.
Indirectly, yes, if your customers fall under NIS2. They must assess their supply chain and will ask you for evidence, contractual clauses and reporting commitments. Well-maintained evidence and a Trust Center save you many follow-up questions.
No later than three months after your entity first falls under the law. For entities that were already in scope when the law entered into force in December 2025, this deadline has passed. Make up for a missed registration immediately – a violation is subject to fines.
There is no certificate and therefore no certification fees. Costs arise from the Sightadel licence for NIS2 (prices on our pricing page), the internal effort and technical measures that are still missing, such as multi-factor authentication or tested backups. You only commission external audits if you want them or the BSI orders them.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
