Approximately 30,000 companies in Germany must comply with the requirements of the NIS 2 Implementation Act. Fines can reach up to 10 million euros or 2 percent of annual revenue. In addition, management is personally liable for negligent failures to comply—this liability cannot be delegated.

Section 30 of the BSIG (BSI Act) defines ten areas of activity that every covered organization must address: risk analysis and IT security, incident response, business continuity, supply chain security, security in procurement and development, effectiveness assessment, cyber hygiene and training, cryptography and encryption, personnel security, and multi-factor authentication.

In the event of significant security incidents, Section 32 of the BSIG requires a tiered reporting process to the BSI—beginning as soon as the incident becomes known: an early warning within 24 hours, a full incident report within 72 hours, and a final report no later than one month afterward. Those who have not established this process in advance will be unable to organize it in an emergency.

Although the law does not specifically mention the term “ISMS” (Information Security Management System), §30(2) of the BSIG requires precisely its components: risk analysis, security concepts, a security culture put into practice through awareness training, and ongoing effectiveness assessments via audits or penetration tests. Anyone operating an ISMS in accordance with ISO/IEC 27001 or BSI IT-Grundschutz has 80 to 90 percent of the required framework covered.