NIS2 is now enforceable. Start getting compliant today.

Personal liability for executives is now enforceable under German law. Don't risk €10 million fines or management bans. Are you actually affected? Book a call and find out...

Leading companies trust us with their Nis2 Compliance Journey

WHO's affected

Does NIS2 Apply to Your Company?

NIS2 covers 18 sectors across two categories. If you have 50+ employees or €10M+ revenue in these industries, you're in scope.

Essential Entities

Stricter oversight. Proactive supervision. Higher penalties.

Energy (electricity, gas, oil, hydrogen, district heating)
Transport (air, rail, water, road)
Banking & financial infrastructure
Healthcare (hospitals, labs, pharma)
Drinking water & wastewater
Digital infrastructure (DNS, data centers, cloud)
ICT service providers (MSPs, MSSPs)
Public administration
Space

Threshold: 250+ employees OR €50M+ revenue
‍Penalty: Up to €10 million or 2% global turnover

Important Entities

Significant obligations. Reactive supervision. Self-assessment required.

Manufacturing (medical devices, electronics, machinery, vehicles)
Food production & distribution
Chemical production
Postal & courier services
Waste management
Digital providers (marketplaces, search engines, social platforms)
Research organizations

Threshold: 50+ employees OR €10M+ revenue
Penalty: Up to €7 million or 1.4% global turnover

Not sure which category applies? Our 2-minute assessment tells you exactly where you stand.

Find out if you're affected

The Cost of Non-Compliance

NIS2 isn't just another checkbox. It introduces personal liability for executives and penalties that can cripple a business. The clock is already running.

€10M

Maximum fine for Essential Entities

Of global turnover

24h

To report significant incidents

Per-sonal

Executive liability now enforceable

WHY NIS2 is different

Personal Liability for Executives

NIS2 isn't just another compliance checkbox. For the first time, EU cybersecurity regulation holds individual executives personally accountable — not just the company.

What Article 20 Requires

Under NIS2, management bodies must:

Approve cybersecurity risk management measures
Oversee implementation of those measures
Complete regular cybersecurity training
Be held personally liable for failures

This isn't corporate liability passed to individuals. This is direct, personal accountability written into law.

€10M
‍Personal fines (not covered by most D&O insurance)
Management ban
Temporary prohibition from executive positions
Criminal liability
In cases of gross negligence
Reputational damage
Follows the individual, not the company

Not sure which category applies? Our 2-minute assessment tells you exactly where you stand.

Find out if you're affected

How Kertos Gets You NIS2 Compliant

All 10 Article 21 Measures — Covered

NIS2 mandates 10 specific security controls. Kertos maps every requirement to actionable tasks, pre-built policies, and automated evidence collection. No gaps. No guesswork.

Learn more

24-Hour Incident Reporting — Built In

NIS2 requires initial incident notification within 24 hours. Kertos includes pre-configured workflows, notification templates, and audit trails so you never miss the window.

Learn more

Executive Liability — Documented

Personal liability means executives need proof they approved and oversaw security measures. Kertos creates the documentation trail that protects leadership when regulators ask questions.

Learn more

ISO 27001 Overlap — 70% Head Start

Already certified? ISO 27001 covers most of what NIS2 requires. Kertos shows exactly where you're already compliant and what's left to close the gap.

Learn more

NIS2 Compliant in weeks, not months

Traditional consulting takes months and costs hundreds of consulting hours. Here's how Kertos gets you there in weeks with 80% less manual work.

Assessment & Setup

Policies & Documentation

Technical Controls

Training & Awareness

Incident Readiness

Validation & Registration

NIS2 IN GERMANY

The NIS2UmsuCG Is Now in Effect

Germany transposed NIS2 through the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz. If you operate in Germany, these are the specifics that matter.

BSI Registration Is Mandatory

All affected entities must register with the Bundesamt für Sicherheit in der Informationstechnik (BSI).

Designate a point of contact
Provide IP ranges and domain names
Update within 2 weeks of any changes
Failure to register = immediate non-compliance

Kertos generates your registration documentation automatically.

German Classification Terms

NIS2 uses EU terminology. German law uses different labels.

Essential Entities vs. Besonders wichtige Einrichtungen
Important Entities vs. Wichtige Einrichtungen
Critical Infrastructure vs. KRITIS-Betreiber

Know which category applies to you — it determines your obligations and supervision level.

KRITIS + NIS2 = Both Apply

Classified as KRITIS operator? NIS2 adds requirements — it doesn't replace obligations.

24-hour incident reporting (vs. 72h for KRITIS)
Personal liability for management
Expanded supply chain requirements
BSI registration under new categories

Kertos manages both frameworks from one platform.

Why German Companies Choose a German Platform

US platforms built for SOC 2 and retrofitted for Europe don't understand the nuance. Kertos was built here, for here.

🇩🇪 German-built: Developed in Germany, by a German team, for German requirements
🔒 German data residency: Your compliance data stays in Germany — no transatlantic transfers
🗣️ German-language support: Native support as standard, not an afterthought
📋 BSI expertise: We understand German regulatory context firsthand
✓ SOC 2 Type II certified: We practice what we preach

Kertos manages both frameworks from one platform.

Book a Demo

TESTIMONIALS

What our customers say

ISO 27001 covers 70% of NIS2 requirements. Here's how companies used that head start.

Jonas Menesklou

CEO & Co-Founder

"Besonders gut gefällt uns uns das Trust Center"

Nachdem wir mit einem US-amerikanischen Anbieter keine guten Erfahrungen gemacht haben, wollten wir eine Plattform, die uns effektiv weiterhilft und Zeit spart. Mit Kertos haben wir die ISO 27001 in 2,5 Monaten geschafft – ohne externe Berater und ohne unser Team zu blockieren. Alles war klar strukturiert, gut geführt und technisch durchdacht. Ausschlaggebend war für uns auch das integrierte Trust Center: Damit können wir gegenüber Kunden sofort zeigen, wie wir Sicherheit leben.

Florian Fesch

Co-Founder, Tech & Product

“Interne Prozesse nachhaltig optimieren“

Mit Kertos konnten wir den komplexen ISO 27001-Zertifizierungsprozess deutlich beschleunigen und unsere internen Prozesse nachhaltig optimieren. Die intuitive Plattform, kombiniert mit der umfassenden Automatisierung, hat uns enorm entlastet – ein echter Gamechanger für wachsende Unternehmen mit hohen Sicherheitsanforderungen.

Janina Möllmann

CEO @GAIA Technologies

“ISO 27001-Zertifizierung innerhalb weniger Wochen“

Mit Kertos konnten wir unsere ISO27001-Zertifizierung innerhalb weniger Wochen erreichen. Es war sofort klar, dass dies eine leistungsstarke Compliance-Automatisierungslösung ist, die in und für den europäischen Markt entwickelt wurde!

Stefan Hessel

Salary Partner & Head of Digital Business, reuschlaw

“Verlässlicher Partner in allen Compliance-Fragen”

Für uns ist Kertos der verlässliche Partner in allen Compliance-Fragen. Ob bei der ISO27001-Zertifizierung oder dem Datenschutz – wir wissen die Expertise und Unterstützung von Kertos sehr zu schätzen.

Matthias Knoche

COO, McMakler

“Einzigartige Lösung für europäische Unternehmen”

Kertos bietet eine einzigartige Compliance-Automation Lösung für europäische Unternehmen, die sich durch die Kombination aus Expertise und Automatisierung deutlich von der Massenabfertigung großer Compliance-Unternehmen anderer Kontinente abhebt.

Julian Lübke

Co-Founder & CEO, deeploi

“Echtes Compliance Powerhouse”

Kertos hat uns schnell und präzise durch den Compliance-Jungle zur DSGVO und ISO27001-Zertifizierung geführt. Die Kertos-Plattform war einfach zu implementieren und ist durch den hohen Grad an Automation ein echtes Compliance Powerhouse.

Adrian Kapsalis

CEO of Kyon Energy

“Passt sich unseren ändernden Bedürfnissen an”

Kertos passt sich unseren ändernden Bedürfnissen an, sodass wir uns auf das Wachstum unseres Unternehmens konzentrieren können.

Mirco Roth

Co-Founder & CTO, Augmented Industries

“Hat uns absolut begeistert”

Vom Start bis zur ISO 27001 in 2,5 Monaten? – Mit Kertos wurde dieses Ziel möglich. Die Kombination aus technischer Innovation, umfassendem Expertenwissen und flexibler Anpassung an unsere Unternehmensbedürfnisse hat uns absolut begeistert.

Ferdinand Schmidt-Thomé

Co-Founder, Aware

“Flexible und skalierbare Lösung zur Einhaltung der DSGVO”

Als Health-Tech-Unternehmen, das mit sensiblen Kundendaten umgeht, haben wir mit Kertos eine flexible und skalierbare Lösung zur Einhaltung der DSGVO gefunden. Sie stärkt das Vertrauen unserer Kunden, setzt durch Automatisierung neue Maßstäbe und das Support-Team ist bei dringenden Anliegen durchweg reaktionsschnell und zuverlässig – Kertos ist somit die All in One Lösung, die sich für uns wirklich auszahlt.

Alle Success Stories

AUTOMATED EVIDENCE COLLECTION

100+ Integrations. Evidence Collects Itself.

NIS2 requires proof that controls are working. Kertos connects to your existing tools — cloud infrastructure, HR systems, ticketing, identity providers — and pulls compliance evidence automatically. No screenshots. No spreadsheets.

See all integrations

$// Select the button and form elements const button = document.querySelector('.button-scroll.scroll_button.z-index-9'); const form = document.querySelector('.ERC_form-block'); // Create an IntersectionObserver const observer = new IntersectionObserver((entries) => { entries.forEach(entry => { if (entry.isIntersecting) { // When the form enters the viewport, set button opacity to 0 button.style.opacity = '0'; } else { // When the form leaves the viewport, reset button opacity to 1 button.style.opacity = '1'; } }); }, { threshold: 0.1 // Adjust as needed (0.1 means 10% of the form is visible) }); // Observe the form element if (form) { observer.observe(form); }$