At a glance
- NIS2 generally applies where a company is established – each national subsidiary assesses, registers and reports under the law of its own country.
- The transposition laws are similar at their core but differ in authorities, deadlines, portals and evidence.
- A Group CISO sets uniform standards, creates a situation picture for group management and relieves the national subsidiaries.
- The management of each company remains responsible – governance must reflect this, not replace it.
One group, many jurisdictions
Under Art. 26 of the NIS2 Directive, an entity generally falls under the jurisdiction of the Member State in which it is established. For a group, this means: each national subsidiary is assessed under the law of its own country – with its own scope analysis, its own registration and its own reporting channels. A registration by the parent company does not cover the subsidiaries.
Exceptions apply to certain digital providers such as cloud services, data centres, managed service providers and online marketplaces: as a rule, they are subject only to the country of their main establishment in the EU.
In addition, size is calculated across the group. A small national subsidiary of a large group may therefore itself fall under NIS2 – how this works is shown in our article NIS2: Is my company in scope?
Status of transposition in selected countries
Most Member States have now transposed NIS2 – some with considerable delay. A selection (as of October 2026):
| Country | Transposition | Practical notes |
|---|---|---|
| Germany | NIS2UmsuCG (German NIS2 Implementation and Cybersecurity Strengthening Act), in force since 6 December 2025 | Registration in the BSI portal; reports to the BSI |
| Austria | NISG 2026 (Austrian Network and Information Systems Security Act), in force since 1 October 2026 | Registration with the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit) via the Business Service Portal (Unternehmensserviceportal) by the end of 2026; self-declaration of risk management measures by 30 September 2027 |
| Belgium | NIS2 Act, in force since 18 October 2024 | Centre for Cybersecurity Belgium (CCB); CyberFundamentals (CyFun) or ISO/IEC 27001 as recognised evidence frameworks |
| Italy | Decreto Legislativo 138/2024, in force since 16 October 2024 | Registration with the National Cybersecurity Agency ACN |
| Romania | Emergency Ordinance OUG 155/2024, since the end of 2024 | National Cyber Security Directorate (DNSC) |
| Netherlands | Cyberbeveiligingswet, adopted in 2026 | Late transposition – keep checking deadlines and implementing provisions |
| Spain | Law on the coordination and governance of cybersecurity still in the legislative process | Obligations under the Directive are foreseeable – preparing now pays off |
The differences lie less in the basic obligations than in the detail: competent authority, registration portal and deadline, form of evidence, language of reports, level of fines and procedure. In an emergency, it is precisely these details that determine whether a report reaches the right body in time.
The model: Group CISO and local responsibility
A hub-and-spoke model has proven itself: a Group CISO at group headquarters sets the framework, and local information security officers implement it in the national subsidiaries.
| Level | Responsibilities |
|---|---|
| Group management | Define security strategy and risk appetite, assess the situation picture, approve budget and resources |
| Group CISO | Group-wide security framework and policies, alignment with national laws, monitoring of implementation status, group-wide supplier and incident management, reports to group management |
| National subsidiary | Scope, registration and reporting under national law, implementation of measures, training and approval by local management |
The crucial point: the management of each national subsidiary remains responsible and liable under its national law. The Group CISO relieves them with standards, tools and expertise – but cannot take over their obligations. Good governance puts this division of labour in writing and makes it auditable.
Monitoring: one situation picture for all of Europe
Without monitoring, governance remains on paper. A group-wide situation picture answers the same questions for every national subsidiary:
- Obligation status: In scope? Registered? Evidence submitted on time?
- Maturity: Implementation status per area of measures, measured against the common framework – comparable across all countries.
- Risks and findings: open gaps, audit findings and their remediation.
- Incidents: reported security incidents, deadline compliance, lessons learned.
- Supply chain: assessment of critical service providers – ideally once for the group rather than anew in each country.
A shared ISMS tool with country-specific requirements keeps the situation picture up to date, instead of collecting it quarterly by spreadsheet.
Group governance in five steps
- Create a mapRecord all companies, sectors and countries; clarify scope and category for each company.
- Align the legal frameworkBring national requirements, authorities, deadlines and reporting channels for each country together in one matrix.
- Define the frameworkA common security framework, for example based on ISO/IEC 27001 or CyFun, with national additions.
- Build the organisationGroup CISO, local officers, reporting lines, escalation and training of management boards.
- Introduce monitoringSituation picture, KPIs and regular reports to group and national management; continuous improvement.
From practice
For the parent company of a European mobility service provider, we are building the Group CISO organisation: with a governance model, a common framework and monitoring for the national subsidiaries – in Germany, Austria, the Netherlands, Spain, Italy and Romania, among others. For the Austrian companies, we are registered with the competent authority as the official NIS2 officers. We prepare analyses and recommendations for action, coordinate the legal assessment and provide ongoing support for implementation as a managed service; decisions are taken and owned on the client side on the basis of our recommendations.
What we see in the process: the biggest hurdle is rarely the technology, but the coordination between headquarters and the countries. A clear mandate for the Group CISO, a common language for risks and a situation picture that everyone can see solve more problems than any additional policy.
Frequently asked questions
Is it enough for the parent company to register?
No. Every affected company must register in the country where it is established. Only certain digital providers are subject solely to the country of their main establishment.
Can an external service provider take over NIS2 support for a national subsidiary?
Yes. A service provider can take over implementation, evidence, deadlines and communication with the authority. Management remains responsible – this is safeguarded through regular reports and clear approvals.
How do we deal with countries that have not yet transposed NIS2?
The content of the Directive is fixed. Anyone already working there to the group-wide framework today will usually only need to add registration and formalities once the national law enters into force.
Which framework is suitable for a group?
ISO/IEC 27001 is widespread internationally and familiar to clients; CyberFundamentals offers tiered, easily measurable levels. A combination often makes sense – with a mapping to the national requirements.
Note: This article provides a professional overview (as of October 2026) and does not constitute legal advice. For a binding assessment of your company, we are happy to work with your legal advisers.
Related service