NIS2: Is my company in scope? A five-step check

What it is about

The EU NIS2 Directive (EU 2022/2555) significantly raises the minimum level of cybersecurity across the Union. In Germany it is transposed by the NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG, German NIS2 Implementation and Cybersecurity Strengthening Act), which entered into force on 6 December 2025. At its core is a revised BSI-Gesetz (BSIG, German BSI Act). According to the Federal Government’s estimate, almost 30,000 companies are covered – many times the number of previous KRITIS (critical infrastructure) operators.

The most important difference from the previous law: there is no designation by the authorities. Every company must check for itself whether it falls under the act – and bears the risk of getting it wrong. The act provides no transition periods for the substantive obligations.

Step 1: Determine the sector

Annexes 1 and 2 of the BSIG are decisive. They correspond to Annexes I and II of the Directive:

What matters is the actual business activity, not the entry in the commercial register. Activities that are negligible in relation to the overall business activity may be disregarded in the classification – you should document this assessment in a traceable way.

Step 2: Determine the size

The thresholds are based on the European Commission’s SME Recommendation (2003/361/EC). Important: partner and linked enterprises are counted too. A small subsidiary of a large group is therefore not itself a small company.

• Medium-sized company: at least 50 employees or more than €10 million annual turnover and more than €10 million balance sheet total.
• Large company: at least 250 employees or more than €50 million annual turnover and more than €43 million balance sheet total.

Covered regardless of size are, among others, operators of critical facilities, qualified trust service providers, top-level domain name registries and DNS service providers, as well as certain providers of public telecommunications networks and services.

Step 3: Establish the category

Sector and size determine the category – and with it the intensity of supervision and the level of possible fines:

Particularly important entities are supervised by the BSI proactively, regardless of any specific cause; important entities as a rule only when there are indications of infringements. The substantive obligations are largely the same.

Step 4: Check sector-specific law

NIS2 does not stand alone. For some industries, more specific rules take precedence over or supplement the BSIG:

• Financial sector: for banks, insurers and investment firms, the EU regulation DORA applies with priority. More on this in our article DORA for ICT service providers.
• Energy: operators of energy supply networks and facilities follow the IT security catalogues of the Bundesnetzagentur (Federal Network Agency) under the EnWG (German Energy Industry Act).
• Telecommunications: additional obligations under the TKG (German Telecommunications Act).
• Digital services such as cloud, data centres, managed services and managed security services: Commission Implementing Regulation (EU) 2024/2690 sets out the technical requirements directly.

Step 5: Document the result and act

Record the check in writing – with sector, size calculation, category and rationale. This documentation is your evidence towards the BSI, auditors and management. If your company falls under NIS2, four blocks of obligations follow:

1. RegisterRegistration in the BSI portal with contact details, sector and IP address ranges. The regular deadline expired in March 2026 – anyone not yet registered should do so without delay.
2. Manage risksAppropriate technical and organisational measures under § 30 BSIG: including risk analysis, handling of security incidents, backup and emergency management, supply chain security, cryptography, access control and multi-factor authentication, training.
3. Report incidentsSignificant security incidents: early warning within 24 hours, notification within 72 hours, final report after one month.
4. Involve managementManagement approves the measures, oversees their implementation and takes part in training regularly. Breaches of duty may result in personal liability.

Not in scope? Then perhaps indirectly

Even if your company does not itself fall under NIS2, your clients must manage the security of their supply chain. In practice, suppliers and IT service providers therefore receive questionnaires, contract clauses on information security and reporting obligations, audit rights and requests for evidence. Those who are prepared here – for example with a lean ISMS and clear points of contact – win tenders instead of losing them.

Operating internationally?

NIS2 is transposed in every EU country by its own national law. Subsidiaries abroad check, register and report under the law of their country – with their own authorities and deadlines. Our article NIS2 in a European group shows how groups steer this centrally with a Group CISO.

From practice: what we often see

• Group structures are underestimated. Size is often calculated per company, although linked enterprises count. In a project for a European group, we clarified scope individually for the German and Austrian companies – with a separate result for each company.
• Security measures exist – evidence does not. Firewalls and backups are in place, but there is no risk management that justifies them and no documentation that proves them.
• The reporting process has not been rehearsed. 24 hours is short. Anyone who only clarifies who reports what when an incident occurs loses valuable time.

Our approach: first clarify scope bindingly, then prioritise the gaps by risk and build an ISMS that fits the size of the company. On request, we take over ongoing operation as a managed service – up to acting as the point of contact towards the BSI.

Frequently asked questions

Note: This article provides a professional overview (as of October 2026) and does not replace legal advice. For a binding assessment of your company, we are happy to work with your legal advisers on request.