NIS2 Consulting
Whether and how NIS2 affects you is what we clarify in the applicability assessment. Then we translate the obligations of the German implementing act into a concrete roadmap: risk management, reporting channels, supply chain security and the responsibility of the management body. You get the evidence the supervisory authority wants to see, without building more than the law requires.
Who falls under NIS2, and who does not
NIS2 has been implemented in Germany: the revised BSI Act (BSIG) applies and distinguishes between essential entities and important entities (Section 28 BSIG). Put simply: anyone active in one of the sectors in Annexes 1 and 2, from energy, transport and health through digital infrastructure to manufacturing such as machinery, vehicles, chemicals or medical devices, and with at least 50 employees or more than €10 million in annual turnover and balance sheet total is generally affected. Essential entities start at 250 employees or €50 million in turnover; operators of critical facilities are included regardless of size.
Operators of critical facilities (KRITIS)
A “critical facility” is a facility within the meaning of Section 2 no. 3 of the {{de:KRITIS-Dachgesetz}} (KRITIS Umbrella Act) (Section 2 no. 22 BSIG). Its operators count as essential entities regardless of company size (Section 28(1) no. 1 BSIG).
Critical facilities supply the general public in sectors such as energy, water, food, IT and telecommunications, health, transport or finance; their failure would have significant consequences for society. Whether a facility is critical is determined by facility-specific thresholds; the standard benchmark is supplying 500,000 people. Additional obligations apply to KRITIS operators.
Telecommunications providers
Providers of publicly available telecommunications services or operators of public telecommunications networks are essential entities if they employ at least 50 people or their annual turnover and annual balance sheet total each exceed €10 million (Section 28(1) no. 3 BSIG); below that, they are important entities (Section 28(2) no. 2 BSIG).
This means there is no lower limit for telecom providers: even the smallest provider is at least an important entity. Their operational security obligations, however, are governed by the Telecommunications Act (TKG) (Section 28(5) BSIG).
Qualified trust services, TLD registries, DNS
Qualified trust service providers (Art. 3 no. 20 eIDAS Regulation; Section 2 no. 34 BSIG), top-level domain name registries (Section 2 no. 42 BSIG) and DNS service providers, meaning publicly available recursive or authoritative services excluding root name servers (Section 2 no. 8 BSIG), always count as essential entities (Section 28(1) no. 2 BSIG).
These services carry the trust and addressing foundation of the internet, which is why they are classified regardless of any size threshold.
Non-qualified trust services
Trust service providers within the meaning of Art. 3 no. 19 eIDAS Regulation (Section 2 no. 44 BSIG) count as important entities regardless of their size (Section 28(2) no. 1 BSIG).
This refers to providers without eIDAS qualification, such as simple signature, seal or time stamp services. The qualified providers are already covered one level higher as essential entities.
Annex 1: sectors of high criticality
Annex 1 BSIG lists the types of entities in the sectors of essential and important entities: energy, transport, banking and financial market infrastructure, health, water, digital infrastructure and space. Anyone offering goods or services here for a fee becomes an essential entity from the thresholds of Section 28(1) no. 4 BSIG.
In the German Annex 1, managed service providers and managed security service providers also belong to digital infrastructure. The complete list of sectors is in the expandable table below the diagram.
Annexes 1 and 2: all covered sectors
Annex 2 BSIG adds the sectors of important entities: postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research. For classification as an important entity, the types of entities in both annexes count (Section 28(2) no. 3 BSIG).
Manufacturing includes, among others, machinery, vehicles, electronics and medical devices; the details are in the expandable table below the diagram.
Not affected? Really?
Anyone who cannot be assigned to a sector or stays below the thresholds generally does not fall under the BSIG. Through the supply chain obligations of affected customers (Section 30(2) no. 4 BSIG), the requirements often arrive anyway, and growth or new lines of business can change the classification. The BSI’s online applicability assessment offers a non-binding initial assessment.
Telecom size check: employees
At least 50 employees (Section 28(1) no. 3(a) BSIG). The number of employees is determined according to EU SME Recommendation 2003/361/EC (Section 28(4) BSIG).
The entire company is counted in annual work units, with part-time staff counted pro rata.
Telecom size check: financial figures
Annual turnover and annual balance sheet total each above €10 million (Section 28(1) no. 3(b) BSIG).
Both figures must be exceeded. If a telecom provider also misses this threshold, it remains an important entity; there is no lower limit for telecom.
EE threshold: employees
At least 250 employees (Section 28(1) no. 4(a) BSIG), determined according to the EU SME Recommendation (Section 28(4) BSIG).
The last annual financial statements are decisive; the classification only changes once the threshold is exceeded or fallen below in two consecutive financial years.
EE threshold: financial figures
Annual turnover above €50 million and annual balance sheet total above €43 million (Section 28(1) no. 4(b) BSIG).
Anyone who misses both EE thresholds is checked again against the thresholds for important entities, which is why the no path leads back to the sector check of Annexes 1 and 2.
IE threshold: employees
At least 50 employees (Section 28(2) no. 3(a) BSIG), determined according to the EU SME Recommendation (Section 28(4) BSIG).
The entire company is counted in annual work units, with part-time staff counted pro rata.
IE threshold: financial figures
Annual turnover and annual balance sheet total each above €10 million (Section 28(2) no. 3(b) BSIG).
Anyone who stays below this as well generally does not fall under the BSIG, with special cases such as telecom or trust services excepted.
KRITIS as a subset of EE
Operators of critical facilities are essential entities (Section 28(1) no. 1 BSIG). Special requirements also apply to them, including the use of attack detection systems (Section 31, Section 2 no. 41 BSIG) and obligations to provide evidence to the BSI.
KRITIS operators therefore carry the full EE obligations plus extended obligations regarding measures and evidence: the strictest level of the law.
Essential entities (EE)
Section 28(1) BSIG lists them exhaustively: 1. operators of critical facilities; 2. qualified trust service providers, top-level domain name registries and DNS service providers; 3. telecom providers with at least 50 employees or turnover and balance sheet total each above €10 million; 4. entities in the Annex 1 sectors with at least 250 employees or more than €50 million turnover and more than €43 million balance sheet total.
Essential entities carry the full obligations of the BSIG (risk management, registration, reporting channels, obligations of the management body) and are subject to proactive supervision by the BSI.
Important entities (IE)
Section 28(2) BSIG: 1. trust service providers; 2. telecom providers below the EE thresholds; 3. entities in the sectors of Annexes 1 and 2 with at least 50 employees or turnover and balance sheet total each above €10 million, provided they are not already essential entities.
Important entities carry largely the same obligations as essential entities but are supervised by the BSI on an ad hoc basis; the ranges of fines also differ.
Annex 1: sectors of high criticality
| Energy | Electricity, district heating and cooling, fuel and heating oil, gas, hydrogen: from suppliers through network, storage and generation operators to charging point operators |
| Transport | Air, rail, water and road transport, including airlines and airports, railway infrastructure and services, ports, traffic management centers |
| Finance | Credit institutions, trading venues, central counterparties |
| Health | Healthcare providers, EU reference laboratories, pharmaceutical research, manufacturers of pharmaceutical products and critical medical devices |
| Water | Drinking water supply, wastewater disposal |
| Digital infrastructure | Internet exchange points, DNS services, TLD registries, cloud and data center services, CDNs, trust services, telecom networks and services, managed (security) service providers |
| Space | Operators of ground infrastructure for space-based services |
Annex 2: other critical sectors
| Transport | Postal and courier services |
| Waste management | Companies whose main economic activity is waste management |
| Chemicals | Manufacturers, importers and distributors of chemical substances and mixtures subject to registration |
| Food | Wholesale as well as industrial production and processing |
| Manufacturing | Medical devices and in vitro diagnostics, computers/electronics/optics, electrical equipment, machinery, motor vehicles and parts, other transport equipment |
| Digital providers | Online marketplaces, online search engines, social networking platforms |
| Research | Research organizations |
There are special cases: financial entities fall under DORA instead of the NIS2 obligations (Section 28(6) BSIG). Telecommunications and energy companies are classified, but their operational obligations run via the Telecommunications Act (TKG) and the Energy Industry Act (EnWG) respectively. And the thresholds follow the EU SME Recommendation, so linked enterprises may count. Our applicability assessment provides the binding answer before you invest in implementation.
What NIS2 specifically requires
At the core of the obligations are the risk management measures under Section 30 BSIG: appropriate, proportionate and effective technical and organizational measures according to the state of the art. The law lists ten minimum areas; the colors show our classification by field of action:
- Registration (Section 33 BSIG)
- Affected entities must register no later than three months after they fall under the law, via the joint registration facility of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK).
- Reporting obligations (Section 32 BSIG)
- For significant security incidents: an initial report within 24 hours, a more detailed report within 72 hours and a final report after one month at the latest, to the joint reporting office of the BSI and the BBK.
- Obligations of the management body (Section 38 BSIG)
- The management body must implement and oversee the risk management measures itself; in the event of a breach of duty, it is liable to the entity for culpably caused damage. In addition, there is an obligation to attend regular training.
- Penalties
- Violations can be punished with substantial fines; the NIS2 Directive provides for up to €10 million or 2 percent of worldwide annual turnover for essential entities.
From applicability to proof
Our NIS2 consulting starts with the applicability assessment: sector, thresholds, special rules, linked enterprises, in writing and on solid ground. We then use a gap analysis to check where you stand against the ten areas of measures in Section 30 BSIG and translate the gaps into a prioritized implementation roadmap: risk management, detection and reporting channels, business continuity, supply chain security, MFA and cryptography.
We rehearse the reporting processes with you and prepare the management body for its obligations and training under Section 38 BSIG. At the end, you have the evidence the supervisory authority wants to see, without building more than the law requires. Anyone who already operates an ISMS integrates the NIS2 obligations there; anyone who does not have one does not need to build one for NIS2: a structured security program is sufficient.
TISAX® as a building block of proof for automotive suppliers
Suppliers to the automotive industry fall under NIS2 themselves as manufacturers of motor vehicles and parts or in other vehicle manufacturing (Annex 2 BSIG) as soon as they exceed 50 employees or €10 million in turnover and balance sheet total. Many of them already hold a TISAX® label. In a 2025 expert opinion, ENX concludes that sites set up in compliance with TISAX meet the requirements of the NIS2 Directive, provided the assessment objectives reflect the overall risk and all affected sites are in scope. That is the opinion of the standard owner, not a finding by the BSI; registration, reporting obligations and the obligations of the management body remain unaffected.
NIS2 requires effectiveness, and we deliver the proof
Two requirements of the law are often overlooked: the measures must be effective (Section 30(1) BSIG), and there must be procedures to assess this effectiveness (Section 30(2) no. 6). A binder full of policies does not meet that. We prioritize implementation along the techniques of your real adversaries (Threat-Informed Defense), use the CIS Controls as a workable catalog of measures, and prove effectiveness with tests that follow actual adversary behavior. This turns a compliance obligation into a security gain.
Talk to us now, not to the regulator later.
Frequently asked questions about NIS2 consulting
Does NIS2 apply to our company?
Probably, if you are active in one of the sectors in the BSIG annexes, which besides energy, transport, health and digital infrastructure also include classic manufacturing such as machinery or chemicals, and have at least 50 employees or more than €10 million in turnover and balance sheet total. But there are special rules, exceptions and the question of linked enterprises. The applicability assessment provides a reliable answer.
What happens if we do nothing?
Besides fines, up to €10 million or 2 percent of worldwide annual turnover under the NIS2 Directive, the responsibility explicitly lies with the management body: it must implement and oversee the measures itself under Section 38 BSIG and is liable to the entity for culpably caused damage in the event of a breach of duty. Sitting it out is therefore no longer an option that only affects the company.
By when do we have to implement?
The law applies; there is no general transition period for the risk management measures. Registration is due no later than three months after an entity falls under the law. Anyone who has not started yet should start now with priorities: first applicability, then the gaps with the greatest risk.
Do we need ISO 27001 certification for NIS2?
No. NIS2 requires effective measures, not a certificate. An ISMS under ISO 27001 is a proven framework for fulfilling and documenting the obligations in a structured way, and the ten areas of measures largely overlap with Annex A topics. For many affected organizations, however, a lean security program along the CIS Controls is the faster route to the required effectiveness.
We are a financial entity. NIS2 or DORA?
DORA. For financial entities, the requirements of Regulation (EU) 2022/2554 take precedence as the more specific law; the central NIS2 obligations of the BSIG do not apply to them (Section 28(6) BSIG). Details are on our DORA page.
What is the difference between essential and important entities?
The obligations are largely the same; the difference lies mainly in thresholds and supervision: essential entities (from 250 employees or €50 million in turnover, plus operators of critical facilities) are subject to proactive supervision by the BSI, while important entities are supervised on an ad hoc basis. The ranges of fines also differ.
Daniel Thomas Heessel was named CISO of the Year 2026 and, as the security lead of an international group of companies, translated regulatory requirements into security programs that are actually lived. Daniel is a certified ISO 27001 Senior Lead Auditor, CISSP and CISM.
Reviewed in August 2026 against the current BSIG (revised version); sections cited: Sections 28, 30, 32, 33, 38 BSIG.