Solutions · Management
Since the German NIS2 Implementation Act (NIS2UmsuCG), management has been explicitly accountable. It must implement the cyber security measures, oversee their implementation and undergo regular training. Sightadel shows you the status on one page, makes open decisions visible and records what you decided and when.
Starting point
For a long time, information security was a matter for IT. Management approved a budget and asked for a report now and then. Under the revised German BSI Act (BSIG), that is no longer enough for entities in scope. Under section 38 BSIG, management itself is obliged to implement the risk management measures under section 30 and to oversee their implementation. If it culpably breaches this duty and damage results, it is liable to its own entity under the rules of company law, for example the law on limited companies (GmbH) or stock corporations (AG).
Others do the actual work: the information security officer, IT, procurement, external service providers. The responsibility still stays with you. When something goes wrong, nobody asks whether IT did a good job. The question is whether management knew the situation, made decisions and followed up on their implementation. A folder of policies does not answer that question. Dated resolutions, regular reports and traceable measures do.
For management, this is above all a question of overview. You do not need access to every single control. You need a reliable status: where do we stand, what is open, where is it stuck, what do I need to decide? That is exactly what the management view in Sightadel is built for.
Why now
The new BSI Act has applied since December 2025. Important and essential entities must register with the Federal Office for Information Security (BSI), implement measures and report incidents. The management duties apply from day one, not only after a transition period.
Members of management must take part in training regularly. The aim is to be able to identify and assess information security risks and to judge their consequences for your own services. A one-off presentation is not enough for this in the long run.
After a malware attack or a longer outage, the supervisory board or the shareholders' meeting asks questions. What counts then is whether you decided and oversaw things beforehand, and whether you can evidence it.
Large customers have to assess their supply chain. They send questionnaires and demand certificates and contract clauses. Without organised answers you lose time in sales or, at worst, the contract.
Cyber insurers, lending banks and auditors now ask specifically about multi-factor authentication, backups and contingency planning. The answers should come from a maintained status, not from memory.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
Binding for important and essential entities under the BSI Act. Management must implement the measures under section 30 BSIG, oversee their implementation and take part in training regularly. The EU directive says that management approves the measures. The German law goes further and makes management itself accountable for implementation. Whether your company is affected depends on sector and size.
View framework →For banks, insurers, investment firms, payment institutions and other financial entities, DORA takes precedence. Here the management body bears ultimate responsibility for ICT risk. It approves the ICT risk management framework, sets the risk appetite, provides resources, approves the policies on business continuity and service providers and keeps its own knowledge up to date through training.
View framework →Not a legal obligation, but the framework customers ask for most often. The standard gives management a fixed role: set the policy and objectives, provide resources and evaluate the system regularly in the management review. In doing so, management fulfils much of what NIS2 expects of it, in an audited form.
View framework →Applies to every company that processes personal data. The controller within the meaning of the GDPR is the company, and so ultimately its management. Data protection and information security interlock in measures, service providers and incidents and can be managed together.
View framework →Recommended order
Does your company fall under NIS2 or DORA, and if so, in which category? Have the classification recorded with reasons and have the registration with the BSI completed. If in doubt, your legal advisers take on the legal assessment.
Appoint a person responsible for information security, internal or external, and give them time and authority. Set how and how often they report to you. Without this decision, every project remains a side job.
Have yourself and the other members of management trained before you make major decisions. Afterwards you will understand the team's proposals better. Attendance is stored as evidence with the date and the next due date.
The team goes through the requirements point by point and shows what is evidenced and what is missing. From this you get a list of open points with a suggested order, not a hundred-page audit report.
You decide on priorities, budget, staff and accepted residual risks. The resolution is dated, signed and filed. Every open point becomes a measure with an owner and a deadline.
Overseeing does not mean checking every task yourself. It means looking at the status at fixed intervals, raising delays and adjusting course. A short meeting each quarter with a documented outcome is a good start.
Your role
Much can be delegated. These points cannot. They set the framework the team works in, and they are what a supervisor or a court will want to see later.
Which locations, companies, systems and services are included? A scope that is too narrow leaves gaps, one that is too wide delays everything. Defining it is a business decision, not a technical one.
No company can eliminate every risk. You decide which risk is acceptable and explicitly accept remaining risks. This acceptance belongs in the documentation with a date and reasons.
Without time and money, measures remain declarations of intent. You decide how many hours are available internally, what is bought in and which consulting is added.
Who is the information security officer or CISO, with what authority and what direct line to management? The appointment is recorded in writing and announced internally.
The information security policy and key rules, for example on access, backups or emergencies, carry your approval. This makes them binding for all employees.
Whether a critical service provider stays despite weak evidence, is replaced or has its contract improved is a trade-off between cost, dependency and risk. Management makes this trade-off.
Whether you aim for an ISO 27001 certificate, by when and for which area depends on customers, market and effort. The decision shapes the team's planning and budget for the coming months.
How Sightadel helps
The dashboard shows progress for each framework, for example NIS2 and ISO 27001 side by side. You see how many requirements are answered and evidenced and where the team has not yet made progress. With the Viewer role you have read access to everything without accidentally changing anything.
Learn more →Every open measure has an owner and a deadline. Overdue points stand out without you having to ask. This turns the duty of oversight into a short, regular look at a list instead of a meeting full of status updates.
Learn more →The Security Score rates how your domains and systems look from the outside, as a grade and as a number. The most important issues appear directly on the dashboard. Management and IT talk about the same thing, without you needing to know the technical terms.
Learn more →Management resolutions, training records and approved policies are kept with date and version in the evidence archive. The activity log records who did what and when. If something goes wrong, this lets you show that you decided and oversaw.
Learn more →Critical service providers are listed with their assessment, contracts and evidence. Where a certificate has expired or answers are missing, you see it before a customer or auditor asks.
Learn more →In the Trust Center you show customers your security posture, certificates and approved documents in one place. Sales points to one address instead of sending questionnaires back and forth for weeks.
Learn more →Effort and duration
The ranges are based on experience, not a promise. The biggest factor is whether management makes decisions promptly and gives the team enough time.
What you license · typically Professional
A company subject to NIS2 that is also aiming for ISO 27001 certification takes both frameworks in the Professional edition. It includes ten users, enough for management, the responsible person, IT and individual departments. If ISO 27001 is included, there is a permanent discount on NIS2.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
Under section 38 BSIG, management is liable to its entity for damage caused by culpable breach of its duties. The liability rules of company law for the respective legal form apply. What this means in an individual case, clarify with your legal advisers. Sightadel does not provide legal advice, but it ensures that your decisions are evidenced.
The work, yes; the responsibility, no. The law addresses the duty to implement and oversee to management. You can appoint a responsible person and bring in external help. But you need to know what is happening and step in when things stall.
The law does not prescribe a form. A fixed rhythm has proven effective: a regular report from the responsible person, a look at open and overdue measures, decisions on bottlenecks and short minutes. In Sightadel you see the status for each framework and the open issues at a glance.
The law requires regular participation but does not set a fixed interval. Many companies plan a refresher once a year and additionally after major changes. Attendance is recorded with a date; Sightadel reminds you before the next one is due.
For financial entities, DORA takes precedence. There too, the management body bears ultimate responsibility for ICT risk, approves the framework and the key policies, sets the risk appetite and keeps up its training regularly. The supervisor is the Federal Financial Supervisory Authority (BaFin).
No. With the Viewer role you see the dashboard, progress for each framework, open issues and action plans without having to work on controls yourself. The actual work is done by the responsible person and the team.
No. There is no certificate for NIS2; supervision lies with the BSI. Sightadel does not certify either. For ISO 27001 you choose an independent certification body, from our partner network or one of your own. No commission is paid for audits, neither to us nor to the partners.
Then add consulting as a package in the app. Experienced consultants help with the difficult parts, such as scope, risk assessment or preparing for an audit. You can also invite your own external consultants to your account.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
