NIS-2
NIS-2: Is my company affected?
The European NIS-2 directive significantly widens the circle of companies that must meet binding cybersecurity obligations. In Germany it is transposed into the BSI Act through the NIS-2 Implementation Act. Many mid-sized companies are therefore asking for the first time whether they are affected.
The two decisive criteria
What matters is the sector and the size. The directive distinguishes sectors of high criticality, such as energy, transport, health, digital infrastructure and ICT service management, from other critical sectors such as postal and courier services, waste management, chemicals, food, manufacturing and digital providers.
As a rule of thumb for size: from 50 employees, or more than 10 million euros in annual turnover and balance sheet total, a company in one of these sectors may be covered. This determines whether it is classified as an important or an essential entity. For some providers, such as certain DNS or trust services, the obligations apply regardless of size.
What being in scope means
- Risk management measures in line with the state of the art
- Reporting obligations for significant security incidents with short deadlines
- Registration with the competent authority
- Accountability and training obligations for management
The last point is new: management must approve the measures and oversee their implementation. Violations can lead to substantial fines.
Indirectly affected, too
Companies that are not in scope themselves but supply customers in regulated sectors will still feel NIS-2. Supply chain security is explicitly part of risk management, and affected customers pass requirements on to their service providers.
The first steps
It starts with a structured scope assessment: sector, size and business relationships are documented. This is followed by a gap analysis of existing security measures. The result is a realistic roadmap instead of a binder gathering dust on a shelf.