What is NIS2?

What exactly is NIS2?

NIS2 is the second version of the so-called Network and Information Security Directive (NIS Directive) of the European Union. It was developed to enhance cybersecurity within the EU and significantly improve the protection of critical infrastructures as well as important digital services. While the first NIS Directive of 2016 primarily affected operators of essential services, NIS2 significantly expands the scope: It now also obligates many other companies in sectors such as energy, health, transport, finance, public administration, and digital services to higher security standards.

Core elements of NIS2 include the introduction of stricter requirements for risk management and incident reporting, a clear assignment of responsibilities at the corporate management level, and significantly higher penalties for violations. The directive was published on December 27, 2022, and must be transposed into national law by October 2024 at the latest. The goal of NIS2 is to create a unified and more resilient cybersecurity landscape across Europe.

Who needs to implement NIS2?

The NIS2 Directive targets companies and organizations operating in certain critical sectors and meeting specific size criteria. The following are affected:

• Companies with at least 50 employees or

• Companies with an annual turnover of over 10 million euros

In addition, special regulations apply to certain entities, regardless of their size, such as providers of public electronic communication services, DNS service providers, and operators of top-level domain registries.

Affected Sectors

The directive distinguishes between "essential" and "important" entities, depending on the criticality of the sector:

• Essential entities: Companies in highly critical sectors such as energy, transport, banking, healthcare, drinking water supply, digital infrastructure, and public administration.

• Important entities: Companies in other critical sectors such as postal and courier services, waste management, chemical industry, food production, manufacturing, digital services, and research.

Can you get certified under NIS2?

Direct certification under the NIS2 Directive is not possible. NIS2 is a legal framework that defines cybersecurity requirements for companies and organizations, but it is not a certification standard itself. Instead, NIS2 requires affected entities to implement appropriate technical and organizational measures to ensure an adequate level of security.

However, companies can pursue certifications under recognized standards such as ISO/IEC 27001 (for information security management systems) or the BSI IT-Grundschutz. Such certifications can help demonstrate compliance with NIS2 requirements and are often recognized as appropriate measures during audits or inspections. Nevertheless, certification does not replace the obligation to define and regularly review individually appropriate measures.

When will NIS2 come to Germany

The implementation of the EU NIS2 Directive into German law is significantly delayed. Originally, the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was supposed to come into force by October 17, 2024. However, due to political developments, including the dissolution of the Bundestag and early new elections in February 2025, the legislative process has been interrupted. According to the principle of discontinuity, all legislative projects must be reintroduced, which means further delays.

Currently, it is unclear when the NIS2UmsuCG will be passed. Some sources suggest that implementation might not occur until the end of 2025 at the earliest. However, the Federal Office for Information Security (BSI) emphasizes that companies should already start implementing the known requirements of the NIS2 Directive to be compliant in time.

Although the NIS2 Directive came into effect at the EU level on January 16, 2023, it does not have immediate legal effect for companies in Germany without national implementation. Nonetheless, affected companies should act proactively to prepare for upcoming legal requirements and adjust their cybersecurity measures accordingly.

Why an ISMS tool like the fuentis Suite helps in implementing NIS2

Implementing the NIS2 Directive poses the challenge for companies to efficiently and demonstrably meet complex requirements for information security, risk management, and reporting obligations. An ISMS tool like the fuentis Suite plays a crucial role: It enables structured recording and assessment of risks, centrally manages security measures, and documents compliance with legal requirements comprehensively.

With integrated functions such as workflow management, incident handling, and compliance reporting, the fuentis Suite not only simplifies daily work but also provides the basis to quickly and comprehensively demonstrate compliance with the NIS2 Directive requirements in the event of audits by supervisory authorities. Thus, an ISMS tool significantly reduces organizational effort while increasing legal certainty.