The German NIS2 Implementation Act (NIS2UmsuCG) has been in force since 6 December 2025. It fundamentally revised the German BSI Act (BSIG) and greatly expanded the range of regulated companies in Germany. Instead of a few thousand operators of critical infrastructure, many mid-sized companies in numerous sectors are now covered, from energy and health through logistics and food to digital services and parts of manufacturing. Ten months after the start, the foundations should be in place. This article summarises where companies should stand now.
Are you affected?
The act distinguishes between essential and important entities. Two questions are decisive: are you active in one of the listed sectors, and do you reach the size threshold? Roughly speaking, medium-sized companies with 50 or more employees or with more than €10 million in annual turnover and balance sheet total can be covered. For some services, such as certain digital infrastructure, the act applies regardless of size. Each entity carries out its own classification. There is no confirmation from the Federal Office for Information Security (BSI). Record your assessment in writing, with your reasoning.
Registration under section 33 BSIG
Entities concerned must register with the BSI no later than three months after they first fall under the act. For all those covered when the act entered into force, this deadline ended on 6 March 2026. Because far fewer companies had registered than expected, the BSI called on them to catch up on registration by the end of July 2026. That date has also passed.
If you are still not registered, do so without further delay. Registration takes place via the BSI portal. It requires access via “Mein Unternehmenskonto” (the German business account), which is based on an ELSTER certificate. Allow a few days for this, as some access credentials are sent by post. If the details you reported change, for example the point of contact, you must inform the BSI promptly.
Measures under section 30 BSIG
The core of the act is appropriate risk management measures. Section 30 lists ten areas that must be covered as a minimum. Summarised in our own words:
- Policies on risk analysis and information system security
- Incident handling
- Business continuity, backup and recovery, crisis management
- Supply chain security
- Security in acquisition, development and maintenance, including vulnerability handling
- Assessment of the effectiveness of the measures
- Cyber hygiene and training
- Cryptography and encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communication
Appropriate means that the measures should be proportionate to the risk, the size of the entity and the costs, and take account of the state of the art. The act does not require certification. In an emergency, however, you must be able to show what you have implemented.
Reporting obligations under section 32 BSIG
Significant security incidents must be reported to the BSI in three stages: an initial report within 24 hours of becoming aware, a more detailed report within 72 hours and a final report no later than one month after that report. These deadlines can only be met if it has been decided in advance who determines whether an incident is significant, who reports and who acts as deputy. A reporting chain that is only drawn up during the incident comes too late.
Management duties under section 38 BSIG
Section 38 is addressed directly to management. It must implement the measures under section 30 and oversee their implementation. In addition, members of management must regularly attend training so that they can recognise risks and assess measures. The task cannot be handed over entirely to IT. If management culpably breaches its duties, it can be liable to the entity. So document decisions, reports to management and training records.
Priorities for the coming weeks
- Check and document your classification. With reasoning, sector and size criteria.
- Catch up on registration or check your details. Are the point of contact and data still correct?
- Define and rehearse the reporting chain. Responsible people, deputies, criteria for significance, templates for the three reporting stages.
- Gap analysis against section 30. Where do you stand in the ten areas? Whatever is missing goes into an action plan with a deadline and an owner.
- Involve management. Regular reports, documented decisions and initial training for management.
What this means for you
If you are affected, the obligations already apply. Registration and the reporting chain take priority, because deadlines are running here and failures can result in fines. After that comes the step-by-step implementation of the measures. If you already run an ISMS under ISO 27001, you have done much of this already and mainly need to add registration, reporting channels and the role of management.
In Sightadel, the measures under section 30 are broken down into controls, the reporting chain is available as a template, and you record management resolutions and training as evidence. More on the NIS2 page. Try it yourself: Try free for 14 days. For a legal assessment of your individual case, please consult your legal adviser.
As of: 7 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
