The NIS2 Implementation Act has applied in Germany since December 2025 — with no transition period. In a free consultation call, one of our experts will help you:
Meet the NIS2 requirements in weeks, not months
Manage risks, incidents and policies on one platform
Prove compliance and avoid fines of up to €10M
Wir freuen uns auf das Gespräch. Falls Sie noch keinen Termin ausgewählt haben, können Sie das über den folgenden Link nachholen:
.avif)
Answer three questions for a first assessment.
01
Does your company operate in one of the sectors covered by NIS2? These include energy, transport, health, digital infrastructure, and digital services. In manufacturing, they include mechanical engineering, motor vehicles, and electrical and electronic products.
02
Do you have at least 50 employees, or do your annual turnover and balance sheet total both exceed €10 million?
03
Some organizations fall under NIS2 regardless of their size, for example providers of DNS services, trust services, or public telecommunications networks.
If both sector and size apply, you are very likely affected. Even if they don't, companies covered by NIS2 must secure their supply chain and often pass requirements on to their suppliers.
With one central platform and an experienced expert, you implement your NIS2 obligations in a structured way and can prove them at any time.
NIS2 reporting process
Tools
People on the team
Integrations
NIS2 reporting process
Platform
Expert at your side
Integrations
All your NIS2 documents in one place
Risk assessments, incident reports, security policies, and supply chain reviews live on one central platform. Your teams create, review, and approve documents there together, with a traceable approval process.
Instead of sending emails back and forth, we work with you to create policies, inventories, and risk analyses that fit the way you work.
300+ integrations
Connect Kertos to the tools you already use, such as ticketing systems, asset management, or communication channels. Documentation, notifications, and reports then run largely on their own.
Compliance that stays up to date
We keep your measures and evidence up to date on an ongoing basis, including after go-live.
We take care of your compliance so you can focus on your core business. A certified expert supports you along the way.
PROCESS
You build up your NIS2 obligations step by step. An expert supports you from registration through to ongoing operations.
STEP 1
We check whether and how NIS2 applies to your company. Organizations in scope must register with the BSI, and we help you do it.
STEP 2
Kertos shows which requirements you already meet and where the gaps are.
STEP 3
You assess risks, implement the required measures, and create policies from templates. Kertos collects evidence through integrations.
STEP 4
You define how significant security incidents are reported to the BSI on time. Management approves the measures and takes part in training.
After that, Kertos keeps measures and evidence up to date, so you can prove compliance to the BSI and your customers at any time.
COSTS
Costs fall into three blocks: analysis and planning, implementing the measures, and ongoing operations with evidence and a reporting process. How high they are depends mainly on your company size and your starting point.
With Kertos, the manual effort for documentation, evidence, and policies drops the most. Your price depends on your company size and your starting point. You get a concrete estimate in the first call.
From the very start, we felt that we were working with a partner who takes a realistic view of the effort and the process involved. The result, for us, is now a central platform that lets us manage our compliance topics in a structured way, across teams.
After having a disappointing experience with a US-based provider, we wanted a platform that truly supports us efficiently and saves time. With Kertos, we achieved ISO 27001 certification in just 2.5 months—without external consultants and without blocking our team. Everything was clearly structured, well managed, and technically well thought out. The decisive factor for us was also the integrated Trust Center: it allows us to immediately demonstrate to our customers how seriously we take security.
With Kertos, we were able to achieve our ISO27001 certification within a few weeks. It was immediately obvious that this was a powerful compliance automation solution developed in and for the European market!
For us, Kertos is the reliable partner for all compliance issues. Whether it's ISO27001 certification or data protection, we really appreciate Kertos' expertise and support.
As a mid-market company, we don't have a large compliance team, and Kertos means we don't need to build one. It automated our GDPR workflows so thoroughly that work which used to take days now takes minutes, and in many cases doesn't need a compliance manager to touch it at all. Onboarding took an afternoon, including connecting our own homegrown software via API. And unlike the mass compliance providers, we get a European partner who understands our requirements firsthand.
Kertos quickly and precisely guided us through the GDPR and ISO27001 certification compliance jungle. The Kertos platform was easy to implement and is a real compliance powerhouse due to the high level of automation.
Kertos adapts to our changing needs so we can focus on growing our business.
FAQ
The German NIS2 Implementation Act took effect on December 6, 2025. There is no transition period, so the obligations already apply.
Sector and size decide. If your company operates in one of the sectors covered by NIS2 and has at least 50 employees, or both its annual turnover and balance sheet total exceed €10 million, you are very likely affected. Some organizations fall under NIS2 regardless of their size.
The law distinguishes by sector and size. Essential entities are usually companies in highly critical sectors with at least 250 employees, or more than €50 million in annual turnover and more than €43 million in balance sheet total. They face stricter supervision and higher fines.
Yes. Organizations in scope register through the BSI portal, which requires an ELSTER organization certificate. The registration deadline has already passed. If you have not registered yet, you should do so now.
You report significant security incidents to the BSI in three stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month.
Up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher. Management is also responsible for implementation.
