NIS 2 Update: What businesses need to know now

Implementation in Germany took place later than expected due to the change of government. The scope of the obligations is now governed by the current BSI Act (BSIG). The key provisions can be found in sections 28 to 42 of the BSIG.

In this article, we break down the provisions of the BSIG for you and show you how quickly a company can be classified as a critical infrastructure operator.

If you wish to check whether your company falls under the NIS 2 regulation and what measures this may entail, please do not hesitate to contact us.

 

Overview: What obligations do affected companies have?

	Operators of critical infrastructure	Particularly important facility	Important facility
Registration requirement	✅	✅	✅
Reporting obligation	✅	✅	✅
Risk management measures	✅	✅	✅
Stricter requirements for risk management measures	✅	❌	❌
Use of intrusion detection systems	✅	❌	❌
Information obligations	✅	✅	✅
Obligation to provide evidence	✅	❌*	❌*
Management’s duty to implement, monitor and provide training	✅	✅	✅

*Obligation to provide evidence may apply in individual cases

Which sectors are classified as high-criticality sectors under the NIS2UmsuCG?

The sectors classified as high-criticality are set out in Annex 1 of the NIS2UmsuCG:

Sector	Sub-sector	Type of organisation
Energy
	Electricity supply
		Electricity suppliers (Section 3(31c) of the Energy Industry Act (EnWG))
		Operators of electricity distribution networks (Section 3(3) of the Energy Act)
		Transmission system operators (Section 3(10) of the Energy Act (EnWG))
		Operators of generation facilities (Section 3(18d) of the Energy Act (EnWG))
		Designated electricity market operators (Article 2(8) of Regulation (EU) 2019/943)
		Aggregators (Section 3(1a) of the Energy Act (EnWG))
		Operators of energy storage facilities (Section 3(15d) of the Energy Act (EnWG))
		Providers of balancing services (Section 3(1b) of the Energy Act (EnWG))
		Charging point operators (Section 2(8) of the LSV)
	District heating and cooling supply
		Operators of district heating or district cooling supply (Section 3(19), (20) GModG)
	Fuel and heating oil supply
		Operators of crude oil pipelines
		Operators of facilities for the production, refining and processing of crude oil, as well as operators of crude oil storage facilities and crude oil pipelines
		Central stockpiling facilities (Article 2(f) of Directive 2009/119/EC)
	Gas supply
		Operators of gas distribution networks (Section 3(8) of the Energy Industry Act (EnWG))
		Operators of transmission networks (Section 3(5) of the Energy Industry Act (EnWG))
		Operators of gas storage facilities (Section 3(6) of the Energy Industry Act (EnWG))
		Operators of LNG facilities (Section 3(9) of the Energy Act)
		Gas suppliers (Section 3(19b) of the Energy Act)
		Operators of natural gas extraction facilities
		Operators of facilities for the refining and processing of natural gas
		Operators in the field of hydrogen production, storage and transmission
Transport and traffic
	Air transport
		Air carriers used for commercial purposes (Article 3(4) of Regulation (EC) No 300/2008)
		Airport managing bodies (Article 2(2) of Directive 2009/12/EC), airports (Article 2(1) of Directive 2009/12/EC), including core network airports and entities operating associated facilities located within airports (Annex II, Section 2 of Regulation[EU] No 1315/2013)
		ATM/ANS providers (Article 2(2) of Implementing Regulation (EU) 2017/373)
	Rail transport
		Railway infrastructure managers (Section 2(6), (6a) of the AEG), including central organisations that plan train operations in advance and in the event of unexpected incidents
		Railway undertakings (Section 2(3) of the AEG), including operators of service facilities (Section 2(9) of the AEG)
	Shipping
		Passenger and freight transport undertakings in inland, maritime and coastal shipping (Annex I to Regulation (EC) No 725/2004) The individual vessels operated by these undertakings are not included
		Port managing bodies (Article 3(1) of Directive 2005/65/EC), including their port facilities (Article 2(11) of Regulation[EC] No 725/2004), as well as organisations operating facilities and equipment located within ports
		Operators of a facility or system for the safe operation of a waterway (Section 1(6)(1) of the Waterways Act (WaStrG))
	Road transport
		Operators of a facility or system for traffic control in road traffic, including the facilities referred to in Section 1(4)(1), 3 and 4 of the FStrG, for example traffic, operations and tunnel control centres, drainage systems, intelligent transport systems and specialist units for information technology and security in road construction, as well as the telecommunications networks of the federal motorways.
		Operators of an intelligent transport system (Section 2(1) of the IVSG)
Finance and insurance
	Banking
		Credit institutions: organisations whose business consists of accepting deposits or other repayable funds from the public and granting loans for their own account
	Financial market infrastructures
		Trading venues (Section 2(22) of the German Securities Trading Act (WpHG))
		Central counterparties which act as an intermediary between the counterparties to contracts traded on one or more markets and thus act as a buyer for every seller and as a seller for every buyer
Health
		Healthcare service providers (Directive 2011/24/EU)
		EU reference laboratories (Article 15 of Regulation (EU) No 2022/2371)
		Companies carrying out research and development activities relating to medicinal products (Section 2 of the German Medicines Act (AMG))
		Companies that manufacture pharmaceutical products (Section C, Division 21, NACE Rev. 2)
		Companies that manufacture medical devices classified as critical during a public health emergency (Article 22 of Regulation (EU) No 2022/123)
Water and wastewater
	Drinking water supply
		Operators of water supply facilities (Section 2(3) of the Drinking Water Ordinance (TrinkwV)), excluding suppliers for whom the supply of water intended for human consumption constitutes a non-essential part of their general activity of supplying other raw materials and goods
	Wastewater disposal
		Undertakings that collect, dispose of or treat waste water (Section 2(1) of the Waste Water Act), excluding undertakings for which this constitutes a non-substantial part of their general business activities
Information technology and telecommunications
		Operators of Internet exchange points
		DNS service providers, excluding operators of root name servers
		TLD name registries
		Providers of cloud computing services
		Data centre service providers
		Operators of content delivery networks
		Trust service providers
		Providers of public electronic communications networks
		Providers of publicly available electronic communications services
		Managed services providers
		Managed security services providers
Space
		Operators of ground-based infrastructure owned, managed and operated by Member States or private parties, which supports the provision of space-based services, excluding providers of public electronic communications networks

What are other critical sectors?

Other critical sectors are set out in Annex 2 to the NIS2UmsuCG:

Sector	Sub-sector	Type of facility
Transport and traffic
	Postal and courier services
		Providers of postal services (Section 3(15) of the Postal Services Act), including providers of courier services
Municipal waste management
		Waste management companies (Section 3(14) of the Waste Management Act (KrWG)), excluding companies for which waste management does not constitute their main economic activity
Production, manufacture and trade in chemical substances
		Companies that manufacture substances and trade in substances or mixtures (Article 3(9), (11) of Regulation (EC) No 1907/2006) and companies that produce articles made from substances or mixtures (Article 3(3) of Regulation[EC] No 1907/2006)
Production, processing and distribution of food
		Food businesses engaged in wholesale trade as well as in industrial production and processing (Article 3(2) of Regulation (EC) No 178/2002)
Manufacturing industry/production of goods
		Companies that manufacture medical devices (Article 2(1) of Regulation (EU) 2017/745) and establishments that manufacture in vitro diagnostic medical devices (Article 2(2) of Regulation[EU] 2017/746), with the exception of those establishments already listed in Annex I under ‘Health’ that manufacture medical devices
	Manufacture of medical devices and in vitro diagnostic medical devices
		Companies that manufacture medical devices (Article 2(1) of Regulation (EU) 2017/745) and companies that manufacture in vitro diagnostic medical devices (Article 2(2) of Regulation [EU] 2017/746), with the exception of companies that manufacture medical devices which, during a public health emergency, are classified as critical under Article 22 of Regulation (EU) 2022/123 (“List of critical medical devices for public health emergencies”) public health emergency are classified as critical under Article 22 of Regulation (EU) 2022/123 (‘List of critical medical devices for public health emergencies’); or
	Manufacture of data-processing equipment, electronic and optical products
		Undertakings carrying out any of the economic activities defined in Section C, Division 26 of NACE Rev. 2
	Manufacture of electrical equipment
		Undertakings carrying out any of the economic activities defined in Section C, Division 27 of NACE Rev. 2
	Mechanical engineering
		Enterprises engaged in any of the economic activities defined in Section C, Division 28 of NACE Rev. 2
	Manufacture of motor vehicles and parts thereof
		Enterprises engaged in one of the economic activities defined in Section C, Division 29 of NACE Rev. 2
	Manufacture of other transport equipment
		Enterprises engaged in any of the economic activities defined in Section C, Division 30 of NACE Rev. 2
Digital service providers
		Online marketplace providers
		Online search engine providers
		Providers of social networking platforms
Research
		Research organisations

What is a particularly important institution?

A ‘particularly important facility’ is legally defined in Section 29(1) of the BSIG.

The following are regarded as particularly important facilities:

1. Operators of critical infrastructure
2. Qualified trust service providers, top-level domain registries or DNS service providers
3. Providers of publicly accessible telecommunications services or operators of public telecommunications networks with at least 50 employees or an annual turnover and balance sheet total exceeding 10 million euros
4. Companies operating in sectors listed in Annex 1 with either more than 250 employees or an annual turnover of more than 50 million euros and an annual balance sheet total of more than 43 million euros.

Excluded are federal government bodies, provided they are not also operators of critical infrastructure.

What is a critical infrastructure?

An essential facility is legally defined in Section 29(2) of the BSIG.

The following are regarded as essential facilities:

1. trusted service providers,
2. providers of publicly accessible telecommunications services or operators of public telecommunications networks with fewer than 50 employees or an annual turnover and annual balance sheet total of 10 million euros or less in each case, and
3. undertakings operating in the sectors listed in Annexes 1 and 2 with either more than 50 employees or an annual turnover and annual balance sheet total of more than 10 million euros each,

which do not qualify as particularly important entities. Federal government bodies are also excluded from this provision.

Are there any exceptions?

Financial undertakings within the meaning of Article 2(2) of Regulation (EU) 2022/2554 are exempt. These include:

• credit institutions
• Payment institutions
• Account information service providers
• E-money institutions
• Investment firms
• Providers of crypto-asset services authorised under the Crypto-Asset Markets Regulation and issuers of value-referenced tokens
• Central securities depositories
• Central counterparties
• Trading venues
• Transaction registers
• Alternative investment fund managers
• Management companies
• Data provision services
• Insurance and reinsurance undertakings
• Insurance intermediaries, reinsurance intermediaries and part-time insurance intermediaries
• Occupational pension schemes
• Credit rating agencies
• Administrators of critical benchmarks
• Crowdfunding service providers
• Securitisation registers

Furthermore, companies are exempt where the requirements of Regulation (EU) 2022/2554 apply on the basis of Section 1a(2) and Section 2a of the German Banking Act or Section 293(5) of the German Insurance Supervision Act.

What are critical assets?

Critical assets are, pursuant to Section 2(22) of the German Securities Market Act (BSIG), in conjunction with Section 2(3) of the KRITIS Framework Act (KRITISDachG), assets that are essential for the provision of a critical service. Critical services are, pursuant to Section 2(4) of the KRITISDachG, services for the supply of the general public in the sectors

• energy
• transport and traffic
• Finance
• social security benefits and basic income support for jobseekers
• Healthcare
• Water
• Food
• Information technology and telecommunications
• Space
• Municipal waste management

the failure or disruption of which would lead to significant supply shortages or pose a threat to public safety.

Under Section 5 of the KRITISDachG, the Federal Ministry of the Interior may, by statutory order, lay down the framework conditions for classifying a service as critical.

What measures must be implemented?

Particularly important and important facilities

In accordance with Section 30(1) of the BSIG, particularly important and important facilities are obliged to take appropriate, proportionate and effective technical and organisational measures. The aim of these measures is to prevent disruptions to IT systems and to minimise the impact of security incidents.

Pursuant to Section 30(2) of the BSIG, the measures taken must cover at least the following aspects:

• Policies relating to risk analysis and the security of information systems,
• management of security incidents,
• business continuity, such as backup management and disaster recovery, and crisis management,
• supply chain security, including security-related aspects of the relationships between individual institutions and their direct suppliers or service providers,
• security measures relating to the procurement, development and maintenance of information technology systems, components and processes, including the management and disclosure of vulnerabilities,
• Concepts and procedures for assessing the effectiveness of risk management measures in the field of cybersecurity,
• basic cyber hygiene practices and cybersecurity training,
• Policies and procedures for the use of cryptography and encryption,
• staff security, concepts for access control and the management of facilities,
• the use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications, and, where appropriate, secure emergency communication systems within the organisation.

Operators of critical infrastructure

Pursuant to Section 31(1) of the BSIG, more onerous measures under Section 30(1), first sentence, of the BSIG are also deemed proportionate for operators of critical infrastructure, provided that the required effort is not disproportionate to the consequences of a failure or disruption to the critical infrastructure concerned.

Furthermore, operators of critical infrastructure must, in accordance with Section 32(2) of the BSIG, deploy intrusion detection systems. These systems must:

• be state-of-the-art
• continuously identify and prevent threats
• provide for appropriate measures in the event of disruptions

The use of intrusion detection systems is also subject to the principle of proportionality: the effort required for this must not be disproportionate to the consequences of a failure or disruption to the facility in question.

Must implementation be demonstrated?

Operators of critical infrastructure

Operators of critical infrastructure must, in accordance with Section 39 of the BSIG, provide evidence of the implementation of the measures. This evidence must be provided no earlier than three years after the initial classification or no later than three years after reclassification as an operator of critical infrastructure. Renewed proof must be provided every three years.

If security vulnerabilities are found, the BSI may require the submission of a remediation strategy or, in agreement with the competent supervisory authority, the rectification of the security vulnerability.

A special transitional provision applies to existing KRITIS operators: the new deadline for providing evidence is no earlier than three years after the last submission of evidence under the former Section 8a of the BSIG. Existing KRITIS operators whose compliance deadline would have expired by 5 December 2026 may still provide evidence in accordance with the old requirements within this period.
Particularly important and important facilities

Important and particularly important facilities must implement the measures, but are not required to provide regular evidence of this. Particularly important facilities may be required to undergo audits, inspections or certification in accordance with Section 61 of the BSIG. The BSI may also request the underlying documentation, plans for rectifying deficiencies and evidence that such deficiencies have been rectified. If there are facts that justify the assumption that an important organisation is not implementing the obligations imposed on it, or is not doing so correctly, an obligation to provide evidence in accordance with Section 62 of the BSIG may also be imposed on important organisations.

Who is subject to the registration requirement?

Particularly important organisations

Organisations that meet the criteria for an important organisation or a particularly important organisation for the first time, or again, must submit the information specified in Section 33(1) of the BSIG to the Federal Office within three months of meeting the criteria:

• Name of the organisation, legal form and commercial register number
• Address and current contact details
  • Email address
  • IP address ranges
  • Telephone numbers
• Relevant sector from Annex 1 or 2 and, where applicable, the sub-sector
• List of Member States in which the relevant services are provided

Important and particularly important facilities must register via the BSI portal. Instructions on how to register can be found here.

Operators of critical infrastructure

Companies designated as operators of critical infrastructure must, within three months, submit the following information to the Federal Office in accordance with Section 33(2) of the BSIG in conjunction with Section 8 of the KRITISDachG:

• Name of the organisation, legal form and commercial register number
• Address and current contact details
  • Email address
  • IP address ranges
  • Telephone numbers
• the name or a referenceable designation of the critical infrastructure,
• the sector and, where relevant, the industry to which the critical infrastructure belongs, as well as the critical service for the provision of which the infrastructure is essential,
• where relevant, the category of the critical infrastructure and its supply reliability values in accordance with the statutory instrument pursuant to Section 5(1), first sentence, the location of the critical infrastructure and its supply area, as well as its public IP address ranges,
• where applicable, a list of the Member States of the European Union in which or for which the operator of critical infrastructure provides essential services within the meaning of Article 2(5) of Directive (EU) 2022/2557, as amended on 14 December 2022, and Article 2 of Delegated Regulation (EU) 2023/2450, as amended on 25 July 2023, specifying which essential services it provides in or for which Member States,
• a point of contact through which the operator of critical infrastructure can be reached; with regard to measures under the BSI Act, availability must be ensured at all times, as well as
• the types of critical components used by the operator in accordance with Section 2(23) of the BSI Act.

If no notification is submitted, the Federal Office may also carry out the registration on behalf of the undertaking in question.

When must a report be made?

For all organisations

Significant security incidents must, regardless of the type of organisation, be reported to the BSI via the BSI portal set up for this purpose.

In this regard, there are three relevant deadlines to observe in the event of a significant security incident:

• Within 24 hours of becoming aware of the incident: Initial report
  • Indication of whether the significant security incident is attributable to unlawful or malicious acts or
  • could have cross-border implications
• Within 72 hours of becoming aware of the incident: Second notification
  • Confirm or update the details provided in the first report
  • Initial assessment of the significant security incident, including severity, impact and indicators of compromise
• Within one month of submitting the second report: Final report
  • Detailed description of the security incident
  • Details of the cause and measures taken
  • Potential cross-border implications

Interim reports must also be submitted at the request of the Federal Office. Specific requirements for operators of critical infrastructure

Where a significant security incident has, or could have, an impact on the critical infrastructure being operated, additional information must be provided:

• Type of facility affected and critical service
• Impact of the significant security incident on the critical service

When does a significant security incident occur?

This is legally defined in Section 2(11) of the BSIG. The security incident

• has caused serious operational disruptions to the services or financial losses, or there is a risk that it
• has caused significant material or non-material damage to other natural or legal persons, or there is a risk of such damage occurring

What obligations are imposed on the managing director?

Section 38 of the BSIG requires the management to:

• to implement the risk management measures in accordance with Section 30 of the BSIG,
• to monitor their implementation, and
• to attend training courses on a regular basis

Through regular participation in training courses, the management is intended to acquire the necessary knowledge and skills to identify and assess risks, as well as to apply risk management methods in the field of cyber security.

If the management breaches its duties, it is liable to the organisation for any damage caused through its own fault in accordance with the provisions of company law applicable to the organisation’s legal form. Under the BSIG itself, liability arises only if the relevant provisions of company law do not contain any liability provisions.

Operators of critical infrastructure are also subject to these obligations, as they are simultaneously regarded as particularly important organisations in accordance with Section 28(1)(1) of the BSIG. Obligations regarding approval, monitoring and training under Section 38 of the NIS2UmsuCG.

What happens if you fail to fulfil your obligations?

Non-compliance quickly becomes costly. If a company intentionally or negligently breaches the provisions of the NIS2UmsuCG, substantial fines may be imposed in accordance with Section 65 of the BSIG.

In the case of particularly important organisations, certain breaches may be punished with a fine of up to 10 million euros. Where total global turnover exceeds 500 million euros, the fine may amount to up to 2 per cent of total global turnover. For important organisations, the maximum fines are generally 7 million euros or, where global turnover exceeds 500 million euros, up to 1.4 per cent of global turnover. Section 65 of the BSIG provides for lower maximum fines for other infringements.

What should you do?

The above-mentioned thresholds for the number of employees or annual turnover are easily reached. If your company meets the threshold for a significant or particularly significant organisation based on the number of employees or annual turnover, you should definitely take a closer look at the sectors concerned. Annexes 1 and 2 to the NISUmsuCG mention types of organisations, some of which are very broad in scope. It is therefore necessary to check carefully whether your company also falls under this category of organisation.

Example 1:

Annex 2 includes online marketplaces under the heading ‘digital service providers’. This term is legally defined in Section 312l(3) of the German Civil Code (BGB):

An online marketplace is a service that enables consumers, through the use of software operated by the trader or on the trader’s behalf – including a website, part of a website or an application – to conclude distance contracts with other traders or consumers

This definition covers not only platforms such as Amazon, but also online classifieds portals and even marketplaces within video games.

Example 2:

In addition to online marketplaces, Annex 2 also covers online search engines. Article 2(5) of Regulation (EU) 2019/1150 defines search engines as follows:

A digital service that enables users to enter queries in the form of a keyword, a voice command, a phrase or any other input, in order to carry out a search on any topic, in principle across all websites or across all websites in a specific language, and to have results displayed in any format, through which they can find information relating to the requested content.

This definition applies not only to traditional search engines such as Google or Bing, but may also cover (smaller) comparison websites.

Example 3:

Annex 2 also lists platforms for social networking services. These are legally defined in Section 2(30) of the NISUmsuCG:

A platform on which end users can connect and communicate with one another using various devices, in particular through chats, posts, videos and recommendations, as well as share and discover content.

Whilst this primarily brings to mind social networks such as X or Instagram, smaller local networks are also covered, provided they have more than 50 employees. According to publicly available information, this means that portals such as Jodel, with 60 employees, or nebenan.de, with 130 employees, also fall within the scope of the BSIG.

The scope of affected organisations may therefore be considerably broader than it appears at first glance.

Would you like to know whether your organisation meets the criteria for being classified as a ‘significant’ or ‘particularly significant’ organisation, and what measures you need to take? Then please get in touch with us – we’d be happy to help!

What happens next?

NIS 2 has taken immediate effect in Germany through its implementation in the BSIG and the KRITISDachG. Unless they have already done so, organisations should complete the necessary registrations and implement the risk management and reporting obligations. It is particularly important to maintain robust documentation of the measures taken, as the BSI can order audits, require evidence and, in the event of breaches, also mandate specific remedial actions.