NIS2 & Cybersecurity

The German implementation act (NIS2UmsuCG) distinguishes two tiers in § 28 BSIG. Essential Entities are organisations with at least 250 employees or annual turnover exceeding EUR 50 million operating in one of the 18 sectors listed in Annex I — including energy, transport, banking, health, water, digital infrastructure and cloud providers. Important Entities cover medium-sized organisations (50 employees or EUR 10 million turnover and above) in the sectors of Annex II, such as postal services, waste management, food and manufacturing. In addition, micro-enterprises with 50 employees or more fall within scope where they operate in high-risk sectors such as qualified trust services or DNS services. Crucially, there is no official BSI list of NIS2-regulated entities — each organisation must self-assess whether it falls within scope. Where this is uncertain, formal self-registration through the BSI reporting portal under § 33 BSIG is recommended.

§ 32 BSIG codifies a tiered reporting regime for significant incidents. Within 24 hours of becoming aware of an incident, an Early Warning must be submitted to the BSI — it contains an initial assessment of whether the incident was caused by unlawful or malicious acts and whether cross-border impact is suspected. Within 72 hours, the Incident Notification follows with an updated situation assessment, a first evaluation of severity and impact, and indicators of compromise where available. No later than one month after the notification, the Final Report must be filed, providing a detailed description of the incident, root causes, mitigation measures taken and any cross-border consequences. Alongside this, § 38 BSIG imposes personal management liability: managing directors and board members must actively approve the risk-management measures, supervise their implementation and attend regular training. In the event of breaches of duty, they are personally liable with their private assets towards the company — a waiver by shareholder resolution is excluded.