Cybersecurity & Resilience

NIS2 in organisations: what applies to you — and what to do (Germany)

Reading time 8 min Sebastian Bach

Key takeaways

  • NIS2 strengthens cybersecurity and incident reporting for organisations in certain sectors; in Germany the BSIG sets the rules — who is in scope depends on activity and company size.
  • Orientation comes from fixed size criteria (headcount, turnover, balance sheet) plus sector mapping; the BSI official scoping tool is not legal advice but gives a structured first check.
  • In practice this often means BSI registration, documented risk management, reporting of serious incidents and clear ownership — not “more paper”, but controllable security.
  • Management bodies are explicitly on the hook (e.g. training, oversight); technical and organisational measures must fit the actual risk.
  • Delivery frequently needs profiles that connect regulation, IT security and operations — not certificates alone.

Subscribe to our newsletter

Receive regular insights, strategies and best practices on IT recruitment and cybersecurity (many articles in German).

Many companies ask: does NIS2 apply to us — and if so, what must change in organisation and technology? For NIS2 compliance under the German BSIG, scoping starts with sector and size criteria; the official BSI NIS2 scoping questionnaire gives a structured first check (not legal advice). Later execution often hinges on NIS2/BSIG compliance staffing — people who can connect legal duties, security operations and governance. This article summarises the essentials in plain language and states the size thresholds from the BSIG in force in Germany. Authoritative detail and updates come from official EU and German sources linked in each section.

Not legal advice. For edge cases (groups, multiple sites, outsourced IT), involve qualified counsel.

NIS2 in brief

The EU NIS2 Directive aims to align network and information security across Europe: organisations in certain sectors must be able to report incidents, manage risk and keep evidence where the law requires. In Germany this is transposed in the BSIG (Act on the Federal Office for Information Security); the BSI (Federal Office for Information Security) is the central entry point and publishes FAQs and a scoping questionnaire.

EU-level background (English): Directive (EU) 2022/2555 on EUR-Lex. Policy overview: European Commission — NIS2.

NIS2: which companies are affected?

Not every company is in scope — the type of activity comes first (e.g. energy, transport, health, water, public electronic communications, digital services and other areas listed in the annexes to the German act). If you are unsure, the BSI’s NIS-2 scoping questionnaire (German UI) walks through activity questions; it does not replace a legal case review but helps orientation.

BSI FAQs (German, authoritative): The comprehensive general FAQ is published in German: BSI — General FAQ on NIS-2 (full page: FAQ hub). There is no separate English FAQ mirror with the same depth on bsi.bund.de at the time of writing; for English context on registration and the BSI portal, see the BSI’s About NIS-2 page on the MIP2 site.

From what size does it matter — thresholds at a glance

Once the sector fits in principle, company size matters. Under the BSIG, two tiers apply: essential entities (broader duties) and important entities. The exact figures are in Section 28 BSIG; the boxes below reflect the usual cases (excluding special rules such as certain KRITIS operators, DNS or trust services — those can apply regardless of size).

Wording (German law): Section 28 BSIG (consolidated; German). The thresholds implement the NIS2 size logic in national law.

Electronic communications (public networks or publicly available services)

  • Essential: at least 50 employees, or annual turnover and balance sheet total each over EUR 10 million.
  • Important: fewer than 50 employees and both annual turnover and balance sheet total at EUR 10 million or below.

Other sectors under the annexes to the act (e.g. energy, health, many digital-infrastructure activities — see the law for the full list)

  • Essential: at least 250 employees, or annual turnover over EUR 50 million and balance sheet total over EUR 43 million.
  • Important: at least 50 employees, or annual turnover and balance sheet total each over EUR 10 million.

Figures follow SME aggregation rules; group companies may be included — see Section 28(4) BSIG and the BSI FAQ on groups and “size cap” (German).

Always cross-check with the scoping tool or legal advice — multi-activity companies and partial groups are common edge cases.

Edge cases: what the BSI does not provide

The BSI does not give binding legal opinions on whether you are in scope. Where unclear, it points to external legal support.

Certificates such as ISO 27001 or IT-Grundschutz modules can structure evidence — they do not replace alignment with the measures required in your specific case.

What this means in day-to-day work

Regardless of section numbers, many in-scope organisations face the same themes:

  • Registration and data in the BSI portal (often via organisational access / ELSTER-style credentials — see BSI registration guidance; English notes on the portal: About NIS-2).
  • Risk analysis and documented measures: not only “IT firefighting”, but traceable decisions and owners.
  • Incident reporting for serious security incidents: internal routes and who notifies whom; the BSI FAQs stress timeliness even when details follow later (German FAQ).
  • Management: training and oversight duties are explicit — without leadership involvement, many requirements are hard to sustain.
  • Suppliers and outsourced IT: contracts alone are not enough; the entity remains responsible for making requirements manageable.

More on reporting and roles: BSI general NIS-2 FAQ (German). Directive context: NIS2 on EUR-Lex.

Financial sector and DORA

Financial entities subject to DORA are largely carved out from large parts of NIS2 duties under the BSIG — registration may still apply. Duplicate reporting of the same incident is avoided where DORA reporting already applies. Details: BSI FAQ section on DORA and NIS2 (German).

Optional: managed service providers (MSP)

If you operate IT for others with deep technical access, you may qualify as a managed service provider under certain conditions — “brand responsibility” without operations is not enough. In-house group IT can be in scope when it actively manages systems for other group companies. See the MSP section of the BSI FAQ (German).

Practical next steps (checklist)

For your programme plan

  • Use the BSI scoping questionnaire or clarify internally: sector, size, group.
  • Name owners: information security, IT, business units, incident reporting contacts.
  • Baseline: which systems and vendors are critical? Where is documentation or emergency routing missing?
  • Prepare registration: organisational access / BSI portal (allow lead time).
  • Plan management training and awareness — as a control mechanism, not a box-ticking exercise.
  • If you operate across borders, check additional reporting duties in other EU states (BSI reporting does not replace them).

If you hire for programmes or permanent roles, separate “pure security” from “pure compliance” — translating between rule, technology and operations is usually the bottleneck.

Why people and NIS2 belong together

Delivery is rarely one tool or one policy: you need people who can prioritise risk, assemble evidence and talk to auditors and the BSI. That is where demand for experienced specialists arises — the FAQ answers below describe how Perfomynd supports that.

Conclusion

NIS2 applies only to organisations in the defined fields of activity — combined with clear size criteria or special cases. Even if the thresholds look clear, still use the BSI scoping questionnaire or professional advice. In practice, expect registration, documented risk management, reporting and management accountability — and workable collaboration between IT, security and business units.

For depth, the BSI general NIS2 FAQ (German) remains the primary BSI reference; the NIS2 legal text on EUR-Lex and the Commission NIS2 page anchor the EU perspective in English.

If you want to move from scoping to staffing and execution, use our cybersecurity recruitment hub.

FAQ

How does Perfomynd find experts to deliver NIS2 programmes in organisations?
Together with the client we clarify role profile, responsibilities and interfaces (IT, information security, business units, external auditors where relevant). We then run active market research and direct outreach, including to candidates who do not respond to job ads; qualification focuses on depth and fit with the client's regulated context. Shortlists reflect delivery reality, not keyword matching.
Why is it currently so hard to hire people for NIS2 implementation?
Regulatory demands, evidence expectations and ISMS process maturity are rising in parallel; relatively few specialists combine demonstrable BSIG/NIS2 practice with documentation, reporting and supply-chain work. Many organisations compete for the same profiles; generalists without reference projects often fall short on demanding mandates.
What qualifications are typical for NIS2 implementation roles?
Usually provable experience with risk management and security measures under the BSIG, familiarity with relevant standards (e.g. ISO/IEC 27001, IT-Grundschutz where applicable), understanding of BSI registration and reporting processes, and the ability to steer technical and organisational measures — plus sector or process knowledge in the organisation. The mix depends on whether governance, execution or audit preparation leads.