Software · NIS2
NIS2 software should prove that your entity meets the obligations of the German BSI Act (BSIG): the ten risk management measures under section 30 BSIG, the reporting obligations under section 32, registration under section 33 and management responsibility under section 38. This page shows what software must do for this, what to look for when choosing it and how Sightadel puts it into practice.
Starting point
In Germany, NIS2 applies through the BSI Act to important and essential entities. There is no NIS2 certificate. What is needed is a robust body of evidence for the Federal Office for Information Security (BSI), customers and auditors. The ten areas of measures under section 30(2) BSIG range from risk analysis and incident handling through backup and emergency planning, supply chain, vulnerabilities, training and cryptography to access control and multi-factor authentication.
Compared with a classic ISMS, three points are new above all. Significant security incidents must be reported to the BSI in stages: early warning within 24 hours, incident notification within 72 hours, final report no later than one month after the notification was submitted; the first two deadlines run from the time of becoming aware. Entities concerned must register with the BSI. And management implements the measures, monitors their implementation and regularly takes part in training.
NIS2 software must therefore do more than tick off measures. The reporting channels must be in place before something happens. Management decisions must be filed with a date. Evidence such as restore tests or vendor assessments must stay up to date. Management still has to decide: on risk acceptance, resources and responsibilities.
Why now
Sector, headcount and turnover show that you fall under the German BSI Act. Registration, measures and management duties now have to be tackled in an orderly way.
Under section 38 BSIG, responsibility stays with management, even if others do the work. Management wants to see what is implemented, what is missing and by when.
Even companies that are not themselves in scope receive the requirements through customers. These must assess their service providers and request evidence.
You have ISO 27001 and want to reuse the evidence. On top come the reporting chain, registration and management decision, without duplicate documentation.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
For important and essential entities under the German BSI Act. In Sightadel broken down into 40 controls on the ten measures under section 30, plus reporting chain, registration and management decision. Reaching a robust body of evidence typically takes three to nine months.
View framework →Not a must for NIS2, but the measures under section 30 BSIG largely match Annex A. If you run an ISMS, your effort is more likely to be at the lower end.
View framework →A security incident can also be a personal data breach and trigger both reporting obligations. The technical measures under Art. 32 use the same evidence.
View framework →For financial entities, DORA takes precedence. Many measures overlap; the reporting deadlines differ in their starting point: DORA is tied to the classification, NIS2 to becoming aware.
View framework →Recommended order
Record the classification as an important or essential entity with justification, complete registration with the BSI and file it as evidence.
Define responsible persons, deputies and contact details, file reporting templates. This comes before everything else, because an incident does not wait.
Work through the 40 controls step by step and map existing documents. At the end you know what is evidenced and what is missing.
Action plans with owners and deadlines. Typical big items are restore tests, vendor assessment and the coverage of multi-factor sign-in.
Management gets trained, adopts a dated decision on implementing the measures and determines how it monitors implementation.
Internal review, management review and an exercise of the incident process. After that, these steps recur as a cycle.
Selection
Many tools offer a checklist of the ten measures. Check whether the software also covers the parts that distinguish NIS2 from a classic ISMS.
The requirements should refer to sections 30, 32, 33 and 38 BSIG, not just to the EU directive. Audits are carried out under German law.
Responsible persons, deputies and templates should be stored in advance. Make sure that the three deadlines are calculated from the time of becoming aware.
The software should file the management decision and management's training evidence with a date. Without this record, the part for which management is personally responsible is missing.
Critical service providers, questionnaires, contractual requirements and certificates with expiry dates belong in one list with a reminder of the next assessment.
If you have an ISMS, you should not have to copy evidence. One record should count for Annex A and section 30 BSIG at the same time.
There is no NIS2 certificate. Be careful with providers who hold one out. The goal is a robust body of evidence.
How Sightadel helps
The ten measures under section 30 BSIG in 40 controls, each as a question with an explanation. Plus controls on the reporting chain, registration and management responsibility.
Learn more →Test reports, training lists and policies with version and validity date. Sightadel reminds you before expiry. One piece of evidence counts for NIS2, ISO 27001 and the GDPR at the same time.
Learn more →Service providers with criticality, questionnaires and evidence including validity dates. Expired certificates stand out, reassessments come as reminders.
Learn more →Gaps become measures with an owner and a deadline. With the Viewer role, management sees what is open and overdue and can thus meet its duty to monitor.
Learn more →The Security Score rates the externally visible attack surface of your domains with a grade from 0 to 100 and lists concrete issues. That supports handling vulnerabilities under section 30(2) no. 5.
Learn more →Industry templates provide drafts, for example for the information security policy, the cryptography concept and reporting templates. The AI makes suggestions from data you have already entered. You decide which procedures are permitted and which residual risk is acceptable.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are the number of sites and service providers, your starting point and the time management contributes.
What you license · typically Professional
An entity with several people involved and a number of critical service providers typically takes NIS2 in the Professional edition, often together with ISO 27001. If ISO 27001 is included, NIS2 permanently costs less. With many vendors or subsidiaries, Enterprise is the right fit.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
The law does not prescribe software. It requires implemented and provable measures, working reporting channels and management that monitors implementation. Software pays off as soon as several people are involved, evidence has to be renewed regularly and management needs an up-to-date status.
Excel can list the ten measures. You then have to maintain deadlines for evidence, reminders of vendor assessments and links to records by hand. Existing spreadsheets can be imported into Sightadel.
Sightadel is licensed per framework and edition, annually. The current amounts are on the pricing page. If ISO 27001 is already licensed, NIS2 permanently costs less. You can try it free for 14 days, without payment details.
No. NIS2 has no certificate. The goal is a robust body of evidence for the BSI, customers and auditors. An ISO 27001 certificate can help, but does not replace the reporting chain, registration and management decision. More on this on the page on NIS2.
No. Sightadel guides you through the requirements and records the status. You choose consultants from the partner network in the app or bring your own. Audits are carried out by independent auditors, also from the partner network or your own. No commission is paid for any referral.
It implements the measures, monitors implementation and regularly takes part in training. Responsibility stays with management, even if others do the work. It decides on risk acceptance, resources and responsibilities. Sightadel files the decision and training evidence with a date.
No. You submit the report yourself. Sightadel keeps reporting channels, responsible persons, deputies and templates ready and calculates the three deadlines from the time of becoming aware.
Sightadel is developed in Germany and operated in Germany.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
