NIS2 Q&A

NIS2 is the revised EU directive on network and information security.

It requires companies in critical sectors to protect their IT systems against cyberattacks, report security incidents within 24 hours and undergo regular supervision.

Compared with the first NIS Directive from 2016, NIS2 expands the scope from around 25,000 to roughly 160,000 affected companies in the EU. Personal liability for management is also new: if you ignore cybersecurity as a managing director, you risk not only fines of up to €10 million but also personal liability.

NIS2 has a clear goal: making Europe more resilient against cyberattacks.

The directive closes three major gaps in its predecessor. First, it sets uniform minimum standards so that companies in all EU countries implement comparable security measures.

Second, it covers significantly more industries, including food supply, waste management and public administration.

Third, meaningful penalties and personal liability make cybersecurity a management priority. The intended result is a robust safety net that protects critical infrastructure and strengthens trust in digital services.

Unlike the GDPR, NIS2 is not a regulation but a directive.

As a regulation, the GDPR applies directly in all EU member states. NIS2, as a directive, does not. It must first be transposed into national law before it applies to companies based in the member states. The GDPR and NIS2 also protect different legal interests. The GDPR focuses on protecting

the personal data of natural persons. NIS2, by contrast, secures the networks and information systems of critical infrastructure.

A ransomware attack on a hospital can trigger both frameworks: NIS2 because critical services are disrupted, the GDPR because patient data is affected. The reporting obligations differ considerably: NIS2 requires an initial notification within 24 hours, while the GDPR allows 72 hours for personal data breaches.

Here is a table comparing the GDPR and NIS2:

ISO 27001 is an international standard for information security management systems (ISMS), while NIS2 is a legal requirement. The key difference: ISO 27001 is voluntary and leads to certification; NIS2 is mandatory, with regulatory supervision and sanctions.

In practice, ISO 27001 covers about 70-80% of NIS2 requirements. Companies with an existing ISO certification have a significant head start but still need to close gaps: ISO 27001 does not include the strict reporting deadlines, the explicit management liability or the registration obligations.

Here is a table comparing ISO 27001 and NIS2:

ISO 42001 is the new standard for AI management systems and addresses the specific risks of artificial intelligence: bias, transparency and human oversight. NIS2 treats AI systems only as part of the general IT infrastructure that needs protecting. The overlap is small.

A company that operates AI-based services in a sector covered by NIS2 needs both: ISO 42001 for responsible AI management, NIS2 for the cybersecurity of the underlying systems. The EU AI Act adds another regulatory layer, for which ISO 42001 can serve as an implementation framework.

Here is a table comparing ISO 42001 and NIS2:

The GDPR protects data, NIS2 protects systems, ISO 27001 systematizes security and ISO 42001 governs AI risks. For companies in critical sectors, this means: NIS2 compliance is mandatory, ISO 27001 provides 70-80% of the foundation, the GDPR applies in parallel wherever personal data is involved, and ISO 42001 becomes relevant as soon as AI systems are in use.

The good news: Kertos automates all four frameworks in one platform. Overlaps are identified automatically, so there is no duplicate work.

The EU directive entered into force on January 16, 2023. Member states had to transpose it into national law by October 17, 2024. Germany missed this deadline. The NIS2 Implementation Act entered into force on December 6, 2025.

There is no transition period: the obligations have applied since the act entered into force. If you have not completed implementation yet, start with registration and risk management now.

Not sure whether your company is affected? The free Kertos NIS2 Check shows you in a few minutes which requirements apply to you.

The transposition deadline ended on October 17, 2024. Many member states missed it and only passed their laws afterward. Germany implemented NIS2 through the NIS2 Implementation Act, which entered into force on December 6, 2025. The European Commission publishes the current implementation status in each member state.

For German companies, the obligations under the BSI Act apply without a transition period. If you are affected, you must register with the BSI and implement the risk management measures under Section 30 BSIG.

No. NIS2 is a legal obligation, not a voluntary certification like ISO 27001. The difference matters: with ISO 27001, the company decides for itself whether to get certified.

With NIS2, the legislator decides that certain companies must meet the requirements. Compliance is monitored by national authorities such as the BSI. Violations can lead to substantial fines and personal liability for management.

That said, an ISO 27001 certification covers about 70-80% of NIS2 requirements and makes compliance considerably easier.

NIS2 distinguishes between essential and important entities across a total of 18 sectors.

Essential entities (Annex I): energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space.

Important entities (Annex II): postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

The size threshold is generally 50 or more employees, or annual revenue above €10 million combined with a balance sheet total above €10 million. In Germany, around 29,850 companies are affected.

Want to know whether your company falls under NIS2? The free Kertos NIS2 Check gives you clarity in a few minutes.

Yes, since December 2025. After considerable delays, Germany passed the NIS2 Implementation Act (NIS2UmsuCG), which transposes the EU directive into national law.

The original EU deadline of October 17, 2024 was missed – Germany was among the latecomers. The act substantially expands the previous IT Security Act and the BSIG (the German BSI Act, which governs the Federal Office for Information Security). Enforcement lies with the BSI as the competent supervisory authority.

NIS2 fundamentally changes the requirements for companies. Under Section 38 BSIG, management must implement and oversee the risk management measures and is liable for breaches of duty. Companies must demonstrate risk management across ten defined security areas, including incident handling, business continuity, supply chain security and cryptography.

Security incidents are subject to a three-stage reporting obligation: an early warning within 24 hours, a detailed notification after 72 hours and a final report after 30 days. Fines reach up to €10 million or 2% of global annual revenue for essential entities and up to €7 million or 1.4% for important entities. Also new is mandatory training for management on cybersecurity risks and how to oversee them.

Around 29,850 companies in Germany fall under NIS2 – a massive expansion compared with the previous KRITIS rules.

The thresholds are clearly defined: at least 50 employees, or annual revenue above €10 million combined with a balance sheet total above €10 million. Both financial criteria must be exceeded.

18 sectors are affected, divided into two categories. Essential entities cover energy, transport, banking, financial market infrastructure, health,

drinking water, wastewater, digital infrastructure, ICT service management, public administration and space. Important entities cover postal and courier services, waste management, chemicals, food, manufacturing, digital providers and research.

Companies outside the EU are also affected if they provide services in Germany and meet the criteria. They must designate a representative in an EU member state.

Not sure whether your company falls under NIS2? Kertos offers a free NIS2 Checker

NIS2 preparation starts with a clear assessment of where you stand. First, check whether your company falls within scope at all – this applies to companies with more than 50 employees or more than €10 million in annual revenue in the 18 defined sectors.

The practical path to compliance involves five core steps: Run a gap analysis against the ten security domains in Article 21. Establish a risk management framework that systematically identifies and assesses threats. Build an incident response capability that enables 24-hour notifications – this is operationally demanding and takes time. Document your supply chain security, because NIS2 explicitly requires you to assess ICT service providers.

Brief your management on personal liability under Article 20 – this is no longer an IT task but a board-level issue. Expect 6 to 12 months of implementation time if your starting maturity is low. With an existing ISO 27001 certification, this drops to 2 to 4 months, since about 70% of the requirements overlap.

The market offers three options with very different price-performance ratios. Traditional consultancies such as the Big Four or specialized IT security consultants typically charge €150,000 to €300,000 for NIS2 projects. This approach is labor-intensive and project-based, and it often ends in one-off compliance rather than continuous conformity.

Compliance automation platforms like Kertos combine software with expert guidance. Your own effort drops to 15 to 20 hours, and costs fall significantly.

The advantage: automated evidence collection, integrated risk management and continuous compliance instead of a yearly rush before the audit. Hybrid approaches use a platform as the foundation and add consulting selectively for complex special cases. For German mid-sized companies that want to handle NIS2 without six-figure consulting budgets, the platform route is a pragmatic path.

NIS2 does not prescribe specific technologies; it requires "appropriate and proportionate" measures. However, the ten security domains in Article 21 call for certain categories of technology.

For incident detection and response, you need SIEM systems or managed detection services that make incidents detectable and reportable within 24 hours.

For backup and business continuity, you need immutable backup solutions with geographic separation and tested recovery processes. Access management requires multi-factor authentication and privileged access management – NIS2 explicitly calls for MFA for critical access.

Vulnerability management includes continuous scanning and patch management to meet the "vulnerability handling" requirement.

For cryptography, you need encryption for data in transit and at rest, where appropriate.

Integration matters more than individual tools: compliance platforms with more than 300 native integrations collect evidence automatically from existing systems such as AWS, Azure, GitHub or JIRA and reduce manual documentation effort by up to 80%.

The original NIS Directive from 2016 laid the foundation for cybersecurity in the EU. NIS2 builds on it, significantly tightens the requirements and expands the

scope. If you are already NIS1-compliant, you have a solid base – but you should expect substantial gaps.

Areas already covered by NIS1:

Risk analysis and security measures were already at the core of compliance under NIS1. Companies had to implement "appropriate and proportionate" technical and organizational measures. However, NIS1 remained vague in its definitions – NIS2 now makes this concrete with ten explicitly named security domains.

Incident reporting was also already mandatory. NIS1 required notifications within about 72 hours. NIS2 tightens this into a three-stage system: a 24-hour early warning, a 72-hour detailed notification and a 30-day final report.

Core sectors such as energy, transport, banking, financial markets, health, drinking water and digital infrastructure fall under both directives. However, NIS2 expands coverage from 7 to 18 sectors.

Comparison table: NIS1 vs. NIS2 coverage

The critical gaps

If you meet NIS1, you cover about 30–40% of NIS2 requirements. The most critical new obligations:

Personal management liability is entirely new. Article 20 makes executives directly responsible for approving and overseeing security measures. In Germany, this is governed by Section 38 BSIG: management must implement and oversee the measures and is liable for breaches of duty.

The 24-hour reporting obligation requires operational capabilities that most companies do not yet have: 24/7 monitoring, fast classification processes and pre-authorized people responsible for reporting.

Supply chain security must be documented systematically – supplier assessments, contractual security requirements and continuous monitoring.

NIS1 compliance is a starting point, not a finish line. A formal gap analysis against the ten NIS2 security domains shows where action is needed.

As the competent authority, the BSI (German Federal Office for Information Security) provides official information and events. Industry associations such as Bitkom and the IHKs (German chambers of commerce) regularly run NIS2 training.

Kertos regularly hosts German-language webinars specifically for mid-sized companies, focusing on topics such as "NIS2 for mid-sized companies" and "Personal liability of management." Important to know: Article 20 of the NIS2 Directive explicitly requires members of management to take part in cybersecurity training. This obligation cannot be delegated.

The EU deadline for national transposition was October 17, 2024. Germany missed this deadline; the NIS2 Implementation Act entered into force on December 6, 2025. There is no transition period, so the obligations have applied since then. Affected companies must register with the BSI within three months (Section 33 BSIG). Companies without an established security program should plan 6 to 12 months for implementation.

The fines are modeled on the GDPR. Essential entities risk up to €10 million or 2% of global annual revenue, whichever is higher. Important entities can be fined up to €7 million or 1.4% of revenue.

What is really new about NIS2 is the responsibility of management. Under Section 38 BSIG, management must implement and oversee the risk management measures and is liable for breaches of duty under corporate law. In addition, supervisory authorities can temporarily prohibit executives of essential entities from performing their management duties.

A NIS2-compliant contingency plan is based on Article 21(2)(c) of the directive and covers three core areas: backup management, disaster recovery and crisis management.

In practice, you start with a business impact analysis (BIA).

First, identify your critical business functions and define a recovery time objective (RTO) for each – how quickly the function must be restored – and a recovery point objective (RPO) – the maximum amount of data loss

you can accept. A customer portal might need an RTO of 4 hours, while internal reporting systems can tolerate 72 hours.

Next, document concrete recovery procedures.

For every critical system, you need step-by-step instructions that someone unfamiliar with it can follow. These include activation criteria, required access credentials, verification steps and estimated times for each step.

The crisis management team must be defined in advance:

an executive sponsor with decision-making authority, a technical lead, a communications lead and a legal/compliance contact. Important: the team needs pre-approved decision-making powers – waiting for approvals during a crisis costs critical time.

Test regularly: run tabletop exercises every six months and functional backup recovery tests every quarter for critical systems. A contingency plan that has never been tested is an assumption, not a capability.

‍

NIS2 does not prescribe a specific provider. The directive requires you to assess your suppliers and set out security requirements in your contracts (Article 21(2)(d)).

A cloud provider supports your NIS2 compliance if it provides the following evidence:

ISO 27001 certification as a baseline, SOC 2 Type II reports for operational security, data residency within the EU (important for GDPR compliance and many national NIS2 implementations), and documented incident response processes with defined reporting deadlines.

The large hyperscalers (AWS, Azure, Google Cloud) offer EU regions and extensive compliance documentation. However, you remain responsible for correct configuration – under the shared responsibility model, the provider secures the infrastructure, while you secure your applications and data.

European alternatives such as IONOS, OVHcloud or Hetzner specifically target companies with strict data localization requirements. Check every provider: Is there a data processing agreement that meets GDPR standards? Are subprocessors documented? Which certifications are currently in place?

What matters for NIS2: Document your vendor assessment, add security clauses to your contracts and monitor providers continuously. Your regulated company remains responsible, even if the cloud service fails.

Official sources provide the binding foundation. ENISA (the EU Agency for Cybersecurity) publishes technical implementation guidance with concrete requirements for each article.

As the competent supervisory authority, the BSI provides implementation guidance for Germany. With Implementing Regulation (EU) 2024/2690, the European Commission has defined minimum technical requirements.

You can find practical implementation support at Kertos. At kertos.io/nis2, we offer a free NIS2 Check that analyzes in a few minutes whether you are affected and where you currently stand. The Kertos NIS2 module includes ready-made documentation, automated ICT supplier tracking and templates for the 24-hour reporting obligation.

The Kertos NIS2 FAQ answers common questions, from the basics and liability to concrete implementation steps. For companies that need clarity quickly: our certified experts support you from the initial assessment through implementation, with about 15 to 20 hours of effort on your side.