Key Takeaways
- Legally, NIS2 responsibility in Germany sits with the management body: Section 38(1) BSIG requires it to implement the ten risk management measures under Section 30 BSIG and to oversee their implementation.
- The BSIG does not prescribe a specific role such as a CISO or an information security officer. Management can distribute the operational work, but oversight and the regular training duty under Section 38(3) BSIG stay with management.
- In the Kertos NIS2 Readiness Study 2026 (51 companies in NIS2 sectors, 50 to 1,000 employees), 63% name the head of IT as responsible. In 41%, the head of IT is the only role named, and only 22% name the managing directors.
- 84% of the companies surveyed have neither an in-house nor an external CISO, and 73% name exactly one role as responsible for NIS2 and information security.
- A workable model spreads NIS2 across at least three levels: executive management (accountability and oversight), a coordinating role such as an information security officer or CISO, and IT, procurement, and business units (implementation).
Ask a German mid-sized company who owns NIS2 internally, and you usually get one of three answers: IT, because it is about systems; quality management, because it already runs a management system under ISO 9001; or executive management, because the law names it. NIS2 responsibility cannot be settled with a single name on the org chart, though. The law defines who is accountable. Who does the work is for the company to decide.
This article explains what the German BSI Act (BSIG) says about accountability, how 51 companies in NIS2 sectors split the task today, and which part IT, quality management, and executive management should each take on. The full set of obligations NIS2 triggers, from registration to reporting deadlines, is covered in our guide to the NIS2 Directive.
What Section 38 BSIG says about NIS2 responsibility
The law's answer is clear: the management body is accountable. Germany's NIS2 Implementation Act has applied since December 6, 2025, and it recasts the BSI Act (BSIG) in full. Under Section 38(1) BSIG, the management bodies of essential and important entities must implement the risk management measures under Section 30 BSIG and oversee their implementation. At EU level, the corresponding provision is Article 20 of the NIS2 Directive.
Three duties therefore sit with management itself:
- Implement: The ten areas of measures in Section 30(2) BSIG have to reach the company, from risk analysis and supply chain security to multi-factor authentication.
- Oversee: Management has to receive regular reports and check whether the measures work.
- Get trained: Section 38(3) BSIG requires management bodies to attend training regularly, so they can identify and assess risks and risk management practices.
If management breaches these duties, Section 38(2) BSIG makes it liable to its own entity under the company law that applies to the entity's legal form, which for a German GmbH means the GmbH Act. You can read the full text of Section 38 BSIG in German.
What the law does not do is name a function that has to do the work. The BSIG does not require a CISO or an information security officer. Companies that follow the BSI's IT-Grundschutz methodology are in a different position: there, module ISMS.1.A4 requires top management to appoint an information security officer, give that person adequate resources, and allow them to report directly to management.
Management's personal obligations in detail, from training to documentation, are listed in our NIS2 checklist for managing directors.
How German mid-sized companies split NIS2 today: data from the NIS2 Readiness Study 2026
In practice, NIS2 at German mid-sized companies almost always sits with the head of IT, and usually with the head of IT alone. For the NIS2 Readiness Study 2026, Kertos surveyed 51 companies in Germany between August and September 2026, all operating in sectors the directive covers and all with 50 to 1,000 employees. Respondents could name more than one role as responsible for NIS2 and information security.
| Role named as responsible | Companies | Share | Named as the only role |
|---|---|---|---|
| Head of IT | 32 of 51 | 63% | 21 |
| Managing directors | 11 of 51 | 22% | 7 |
| Data protection officer | 10 of 51 | 20% | 4 |
| In-house CISO | 7 of 51 | 14% | 3 |
| Compliance or risk officer | 7 of 51 | 14% | 1 |
| Legal department | 3 of 51 | 6% | 0 |
| External or virtual CISO | 1 of 51 | 2% | 1 |
Three patterns stand out. First, 37 of the 51 companies (73%) name exactly one responsible role, so NIS2 usually hangs on a single person. Second, the head of IT and the managing directors are named together in only 4 companies, even though the law is built on exactly that pairing of implementation and oversight. Third, 43 of 51 companies (84%) have neither an in-house nor an external CISO.
What the numbers do not show matters too. Laggards name the head of IT about as often as companies that are already registered or implementing measures (15 of 25 versus 16 of 24). Ownership alone does not explain progress. What counts is whether the person responsible has time, a mandate, and backing. Quality management was not a separate answer option in the survey; the closest category is compliance or risk officers at 14%. How the German trade press covered the study is summarized in our article on NIS2 implementation in Germany.
IT, quality management, or executive management: what each role can do
None of the three roles can carry NIS2 alone, but each brings something the others lack. The real question is not who is responsible, but who takes which part.
Head of IT: knows the systems, but should not audit itself
A common misconception is that NIS2 is an IT project. It is true that a large share of the ten areas of measures is technical: backups, access control, vulnerability management, encryption, and multi-factor authentication. None of that happens without the head of IT.
At least three areas sit outside IT, though: supply chain security (Section 30(2) No. 4 BSIG) involves procurement and contracts, personnel security involves HR, and training involves every employee. There is also a structural issue. ISO 27001:2022 Annex A 5.3 requires conflicting duties and areas of responsibility to be segregated. The person who configures the firewall should not be the one who assesses its effectiveness and tells management that everything is fine. Why "NIS2 equals IT" leads companies astray is also covered in our article on the most common NIS2 misconceptions.
What if the information security officer is also the system administrator?
In small IT teams this is the rule rather than the exception: the only administrator is also appointed information security officer, because nobody else knows the systems. Neither the BSIG nor ISO 27001 explicitly prohibits this. It does, however, create exactly the conflict of interest Annex A 5.3 is meant to resolve. The security officer ends up assessing risks and controls they set up themselves as administrator, and approving their own access rights. Internal audits get tight as well, because clause 9.2 of ISO 27001 requires auditors to be selected so that the audit stays objective and impartial.
If the double role cannot be avoided, three compensating measures help. A second person approves changes to privileged accounts. Someone else audits IT, either internally from quality management or externally. And the security officer reports directly to executive management, not through the head of IT. In the long run, the double role is a good reason to add external expertise to the coordinating role.
Quality management: knows management systems, but not automatically information security
Many German mid-sized manufacturers and suppliers have run a quality management system under ISO 9001 for years, so handing NIS2 to the quality management representative seems obvious. ISO 9001 and ISO 27001 share the same Harmonized Structure, with clauses 4 to 10 covering context, leadership, planning, support, operation, performance evaluation, and improvement. Anyone who already runs management reviews, internal audits, and corrective actions brings exactly the method to an information security management system (ISMS) that IT often lacks.
The catch is the content. Quality management assesses risks to product quality and customer satisfaction; an ISMS assesses risks to the confidentiality, integrity, and availability of information. The 93 controls in Annex A of ISO 27001 and the ten areas of measures in Section 30 BSIG require technical understanding that a quality team rarely has. A quality manager can steer the ISMS well, provided IT or external experts supply the technical depth. Where ISO 27001 and NIS2 overlap and where they do not is covered in our article on NIS2 and ISO 27001 overlap.
Executive management: carries accountability, not the detailed work
Executive management cannot hand NIS2 off, but it does not have to implement it personally either. Under the wording of Section 38 BSIG, oversight and training stay with management. In practice, that means appointing the coordinating role, giving it budget and authority, receiving reports at fixed intervals, and deciding which risks the company knowingly accepts.
Many managing directors underestimate what oversight takes. A quarterly meeting where the head of IT reports that "everything is green" is not oversight. Management needs a report with metrics: open risks, the status of measures, incidents, supplier assessment results, and training completion rates.
What about the data protection officer?
In the study, 20% name the data protection officer as responsible for NIS2, and 4 companies name the DPO as the only role. That is the second common misconception: data protection and information security overlap, but they are not the same thing. The GDPR protects personal data; NIS2 protects the network and information systems a company uses to deliver its services, whether or not they hold personal data. Article 38(6) GDPR allows the DPO to take on other tasks, but requires that they do not result in a conflict of interest. A DPO who audits security measures they are responsible for as security officer quickly ends up in exactly that conflict.
A NIS2 role model that works for mid-sized companies
A three-level model has proven itself: executive management is accountable and oversees, a coordinating role steers, and the business functions implement. Depending on the company, the coordinating role is called CISO, information security officer, or information security coordinator. What matters is that it reports directly to executive management, not through the head of IT.
The following split is a suggestion to adapt to your company. A stands for accountable, R for responsible (does the work), C for consulted (contributes), and I for informed.
| Task | Executive management | Security officer / CISO | Head of IT | Quality management | Procurement / HR / business units |
|---|---|---|---|---|---|
| Scoping assessment and registration (Section 33 BSIG) | A | R | C | I | I |
| Risk analysis and security policies (Section 30 BSIG) | A | R | C | C | C |
| Technical measures (backups, access, MFA, patches) | A | C | R | I | I |
| Supply chain security and supplier assessment | A | C | C | C | R |
| Reporting significant security incidents (Section 32 BSIG) | A | R | C | I | I |
| Internal audits and effectiveness assessment | A | C | C | R | I |
| Employee training | A | R | C | I | C |
| Management training (Section 38(3) BSIG) | A, R | C | I | I | I |
| Oversight and management report (Section 38(1) BSIG) | A, R | C | C | C | I |
The incident reporting row deserves particular attention. Under Section 32 BSIG, the initial notification must reach the joint reporting office of the BSI and the BBK within 24 hours of becoming aware of a significant security incident, followed by an assessment after 72 hours. Who decides on a weekend whether an incident is significant, and who sends the report, has to be settled in advance, including deputies. How to build incident and reporting processes is explained in our guide to NIS2 emergency planning.
"The biggest challenge is often not a lack of tools, but clear processes, fixed responsibilities, and the ability to stay operational even in a crisis."
Dr. Kilian Schmidt, co-founder and CEO of Kertos, translated from German
Kilian Schmidt develops this point further in a guest article for Security-Insider (in German).
Here is what that can look like in practice. A machinery manufacturer with 180 employees falls under the BSIG as an important entity. IT consists of two people, and an experienced quality manager runs the ISO 9001 system. Executive management appoints the quality manager as information security officer at 30% of her working time, because she already knows how to run audits and management reviews. The head of IT implements the technical measures and reports to her. Procurement handles supplier assessments using a fixed questionnaire. For technical depth in information security, the company brings in an external expert. Management receives a report every quarter and attends training once a year. NIS2 no longer hangs on one person, and IT no longer audits itself.
How Kertos maps NIS2 responsibilities
A role model on paper only helps if day-to-day work shows who has done what. The Kertos platform maps the NIS2 requirements to measures, assigns each measure an owner, and collects the evidence where it is created. Management sees implementation status without relying on email updates. Companies that already work to ISO 27001 reuse their existing controls for NIS2 instead of maintaining them twice.
For companies that cannot fill the coordinating role themselves, a Kertos expert takes on the role of external CISO in the Pro and Premium packages. Responsibility under Section 38 BSIG stays with the management body, which gets a structure it can use to oversee implementation.
Kertos customers particularly value clearly assigned tasks. One customer writes on G2:
"Kertos helps us carry out the ISO 27001 certification in an organized and structured way. It defines clear tasks and offers AI-supported suggestions tailored to our company structure."
Martin S., Agentic AI Engineer, Small-Business (50 or fewer emp.), G2, translated from German
If you want to see how NIS2 responsibilities can be mapped in your company, we can show you in a demo.
Frequently asked questions
Who is responsible for NIS2 in a company?
Legally, the management body. Section 38(1) BSIG requires it to implement the risk management measures under Section 30 BSIG and oversee their implementation. In practice, the operational work at German mid-sized companies usually sits with the head of IT, named as responsible by 63% of companies in the NIS2 Readiness Study 2026.
Can management delegate NIS2 to IT?
Management can hand the operational implementation to IT, an information security officer, or external experts. Oversight of implementation and regular training under Section 38(3) BSIG stay with management. If management breaches these duties, it is liable to its company under the applicable company law.
Do you need an information security officer for NIS2?
The BSIG does not require an information security officer or a CISO. Without a role that coordinates the ten areas of measures and reports directly to management, the oversight duty is hard to meet in practice. Companies that follow BSI IT-Grundschutz must appoint an information security officer under module ISMS.1.A4.
Can the data protection officer also be responsible for NIS2?
In principle, yes: Article 38(6) GDPR allows the DPO to take on other tasks as long as no conflict of interest arises. NIS2 goes beyond personal data, though, and covers all network and information systems. In the study, 20% of companies name the data protection officer as responsible for NIS2.
Can the quality management representative run the ISMS for NIS2?
Yes, with technical support in information security. ISO 9001 and ISO 27001 share the same Harmonized Structure with clauses 4 to 10, so the method from audits and management reviews carries over. The technical content of the 93 controls in Annex A of ISO 27001 still needs IT knowledge or external experts.
