NIS-2: clarify whether you are affected, implement the obligations

What NIS-2 requires

With the German NIS-2 implementation in the BSIG, the circle of regulated companies has grown considerably: the categories the BSIG calls especially important and important entities, from the sectors in Annexes 1 and 2 of the BSIG, are covered, generally from 50 employees or more than 10 million euros in annual turnover and balance sheet total. The most important obligations:

• Registration of the entity with the BSI (Section 33 BSIG), no later than three months after it first qualifies as affected.
• Risk management measures (Section 30 BSIG): including risk analysis, handling of security incidents, business continuity, supply chain security, encryption, access control and training.
• Reporting obligations for significant security incidents (Section 32 BSIG): an early initial notification within 24 hours, a report within 72 hours, and a final report within one month.
• Duties of management (Section 38 BSIG): they must implement the risk management measures and oversee their implementation, are liable for culpable breaches of these duties (subsection 2), and must take part in training regularly (subsection 3). What this means in concrete terms is explained on our page for management.
• Documentation and evidence (Section 61(3) BSIG): the implementation and effectiveness of the measures must be documented appropriately; the BSI can request evidence.

The measures must be appropriate, proportionate and effective (Section 30(1) BSIG) and reflect the state of the art. The BSI requires a holistic, all-hazards approach that covers not only IT but also the physical environment. What is appropriate for your entity is something we determine with you on a risk basis.

Risk management explicitly includes assessing the effectiveness of your own security measures (Section 30(2) no. 6 BSIG). In its NIS-2 info packages, the BSI names the penetration test explicitly as an example of the regular tests for reviewing your own measures. As a BSI-certified provider for IS penetration testing (BSI-APS-9080), we demonstrate this effectiveness independently.

The basis is the BSIG as amended by the German NIS-2 implementation. We clarify your current status of affectedness and implementation with you in the initial call.

How we work

1. 1
   Applicability
   Check sector, size and thresholds, derive the obligations.
2. 2
   Maturity
   Determine the level of implementation, for example via BSI RUN.
3. 3
   Implementation
   Anchor the measures in a management system.
4. 4
   Evidence
   Demonstrate technical effectiveness.

Without your own information security function, we start with the free CyberRisikoCheck. We anchor the measures in an ISMS, and a penetration test demonstrates that they work technically.

How we support you

• Building and developing an ISMS per BSI IT-Grundschutz or ISO 27001, including the processes required by NIS-2.
• Business continuity management for the required maintenance of operations.
• Penetration tests as independent proof of the effectiveness of your measures.
• Secure development and maintenance (Section 30(2) no. 5 BSIG): security considered from the start (security by design and by default), with regular vulnerability scanning and penetration tests across the lifecycle, which the BSI explicitly names here.
• Supply chain security: when your customers pass requirements on to you, we help with the answer, from the questionnaire to the evidence.

Do you operate critical infrastructure? Then additional requirements apply: Information security for KRITIS operators.