NIS2 in Germany: The Guide for SMBs

Since 6 December 2025, Germany's revised BSI Act (BSIG) has implemented the EU cybersecurity directive NIS2. Companies in scope must register with the BSI, document security measures, report significant incidents without undue delay and train their management. This guide explains the main duties, implementation costs and a practical order of work for SMBs.

What has applied since 6 December 2025

Germany transposed Directive (EU) 2022/2555 with the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), published on 5 December 2025 (BGBl. 2025 I No. 301). Since then, the rewritten BSIG is what counts, not the directive; all paragraphs in this article refer to it.

• No general transition period. According to the BSI FAQ, the duties apply from the date the law took effect.
• No notice from the BSI. The BSI does not tell companies whether they are in scope. You assess this yourself.
• Many are not yet registered. The federal government expects around 29,850 entities in scope (BT-Drs. 21/1501). By 30 September 2026, the BSI had registered 20,141.

Who is in scope, in one paragraph

Activity and size decide (§ 28 BSIG). A company is an important entity if it offers an activity from Annex 1 or 2 on the market and has at least 50 employees, or turnover and balance sheet total each above EUR 10 million. It is an essential entity (besonders wichtige Einrichtung) if the activity is from Annex 1 and it has at least 250 employees, or more than EUR 50 million turnover and more than EUR 43 million balance sheet total. Some entities, such as operators of critical facilities and DNS service providers, are in scope regardless of size, and group figures can count. The sector list, counting rules, special cases and worked examples are in Does NIS2 apply to your company?. Our NIS2 scope check gives a first assessment in about two minutes.

The four core duties

1. Registration with the BSI (§ 33)

No later than three months after your company first counts as an essential or important entity, you register it in the BSI portal with, among other things, contact details, sector and type of entity. For companies in scope since the law took effect, the deadline expired on 6 March 2026. The duty continues to apply: if you missed the deadline, register now. Missing, incorrect or late information can be fined up to EUR 500,000 (§ 65(2) no. 6, (5) sentence 1 no. 5).

2. Risk management measures (§ 30)

Companies in scope must take appropriate, proportionate and effective technical and organisational measures and document compliance with them (§ 30(1)). § 30(2) names ten areas that must be covered at a minimum, from risk analysis, incident handling, backups and supply chain security to multi-factor authentication. The measures should follow the state of the art and take relevant standards into account. All ten areas, with matching ISO® 27001 controls and examples of evidence: The ten NIS2 measures under § 30 BSIG.

3. Reporting significant incidents (§ 32)

A significant security incident is reported to the BSI in stages: an early warning without undue delay, within 24 hours at the latest, and an incident notification with a first assessment without undue delay, within 72 hours at the latest, both counted from when you become aware of it, and a final report no later than one month after the notification. If the incident is still ongoing, a progress report replaces the final report (§ 32(2)). The deadlines also run at weekends. What counts as significant and what goes into each report: NIS2 incident reporting: 24 h, 72 h and 1 month.

4. Management duties and training (§ 38)

Management must implement the risk management measures and monitor their implementation. Managers who culpably breach these duties are liable to their company under the corporate law rules of its legal form. Management must also attend training regularly; according to the explanatory memorandum, at least every three years. Content, format, records and an agenda: NIS2 management training under § 38 BSIG.

Fines for breaches (§ 65)

Breaches of the risk management and reporting duties can be fined up to EUR 10 million for essential entities and up to EUR 7 million for important entities. Only for companies with more than EUR 500 million in total turnover is the cap a percentage instead: 2 percent of worldwide turnover for essential and 1.4 percent for important entities.

What implementation costs

The federal government estimates the annual effort for the minimum level of IT security alone at around EUR 86,000 per important entity and around EUR 215,000 per essential entity, made up of staff hours and material costs (BT-Drs. 21/1501). It puts the one-off setup at roughly one year's effort. These are averages across all sizes. They are not a budget forecast for an individual SMB. Separate your own estimate into existing security operations, gaps to close and ongoing documentation and training.

Implementation in seven steps

This is a work plan, not a legal grace period. The duties apply in parallel; urgent security gaps and incident reporting must not wait for registration or training to finish.

1. Check your scope and record the result. Keep the reasoning, even if the answer is no: customers and auditors will ask.
2. Register with the BSI. First, because the deadline is running or has already passed.
3. Set up incident reporting. Decide who assesses whether an incident is significant, who reports and who covers at weekends.
4. Train management. The first session also settles roles and budget for what follows.
5. Run a gap analysis against § 30. For each area: current state, owner, deadline. With ISO® 27001 or TISAX®, start from there: NIS2 and ISO® 27001, NIS2 for automotive suppliers.
6. Close the gaps and collect evidence. Policies, risk register, supplier assessments, restore tests, training records.
7. Review effectiveness. § 30(2) no. 6 requires procedures for this. An internal audit and a management review at least once a year work well and also document management's oversight.

Why an ISMS is the practical way

NIS2 does not require a certificate, but it does require documented, current measures whose effectiveness is reviewed. That is what an information security management system (ISMS) does. An ISMS based on ISO® 27001 can structure the implementation of § 30 alongside the NIS2-specific duties: registration, reporting deadlines and management training.

Valiido is ISMS software with a dedicated NIS2 framework in the Valiido Guide: from the chapter on scope and registration to incidents with the 24-hour, 72-hour and one-month deadlines and training templates for employees and management. You submit registration and reports yourself in the BSI portal; Valiido prepares and documents them. As NIS2 usually starts at 50 employees, companies in scope typically need the Pro plan at EUR 299 per month (EUR 249 with annual billing).

See how Valiido implements NIS2

Frequently Asked Questions

Can management hand NIS2 over to IT or the information security officer?

The work, yes; the responsibility, no. Management can delegate tasks, but it remains ultimately responsible (BT-Drs. 21/1501, p. 154). It cannot delegate its own training under § 38(3).

Does the BSI check whether we meet the duties?

For essential entities, the BSI can order audits, inspections or certifications by independent bodies (§ 61 BSIG). For important entities, it checks when facts suggest that duties are not or not properly met (§ 62 BSIG).

We are too small for NIS2. Do we still need to do anything?

Often yes, indirectly: under § 30(2) no. 4 BSIG, customers in scope must manage the security of their supply chain and pass requirements on to their suppliers. A documented ISMS is the usual answer to their questionnaires.