- Basis
- NIS2UmsuCG · BSIG
- Threshold
- from 50 employees in a covered sector
- Penalty
- up to EUR 10 million or 2 % of global turnover
- Source
- BSI zur NIS-2-Umsetzung
last checked 12 October 2026 · review cycle quarterly
What is required
Risk management under section 30 BSIG, registration with the BSI, a reporting chain at 24 hours, 72 hours and one month, training and personal liability of the management body under section 38 BSIG.
What has to be done
- deadline-boundRegister with the BSI within three months of meeting the criteria for a covered entity.
- one-offImplement the risk management measures of section 30 BSIG: risk analysis, incident handling, business continuity, supply chain security, cryptography, access control and multi-factor authentication.
- deadline-boundKeep to the reporting chain: early warning within 24 hours, incident notification within 72 hours, final report at the latest one month after the notification.
- ongoingThe management body oversees implementation, attends training regularly and is personally liable under section 38 BSIG.
- ongoingProduce evidence of implementation on request by the BSI.
Stages over time
Essential entity
- Entry into force of the NIS2UmsuCG
- End of the registration period with the BSI
Essential entities are supervised proactively by the BSI, important entities only for cause.
Important entity
- Entry into force of the NIS2UmsuCG
- End of the registration period with the BSI
Important entities are supervised for cause; the duties under section 30 BSIG are identical.
Criteria checked
- Sector under Annex 1 or 2
- Size criterion
Check this for your own company
Legal position as of 12 October 2026All nine regimes