Pilot programme: 30 % off in the first year. Places limited. See the conditions

Book a first call
Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Framework · NIS2 and the German NIS2 Implementation Act

Implement NIS2 without spreadsheet chaos

The German BSI Act as amended by the NIS2 Implementation Act has applied since 6 December 2025. Complass guides you from classification through the ten minimum measures to incident reporting and evidence.

Try for free Request a demo
Still from the short video “Compliance management in 20 seconds”
Compliance management in 20 seconds Project, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.

What is NIS2?

NIS2 is EU Directive (EU) 2022/2555 on a high common level of cybersecurity. In Germany it is transposed by the NIS2 Implementation and Cybersecurity Strengthening Act, mainly through the BSI Act: entities covered must register, implement risk management measures and report significant incidents; management is responsible.

Content as of:

Does it apply to me?

Companies are covered if they belong to a type of entity in Annex 1 or 2 of the BSIG and reach a certain size. Simplified:

Size thresholds under section 28 BSIG, simplified
CategoryEmployeesor turnover and balance sheet total
Essential (Annex 1)from 250over EUR 50 million turnover and EUR 43 million balance sheet total
Important (Annex 1 and 2)from 50over EUR 10 million turnover and balance sheet total
Operators of critical facilitiesregardless of size–

The first phase in the module guides you through assignment, size thresholds, group structures and special regimes, with a justification for your records.

Check for free whether NIS2 applies In a few minutes, no sign-up.

This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.

Legal basis

  • § 28 BSIG§ 28 BSIG Besonders wichtige Einrichtungen und wichtige Einrichtungen(1) Als besonders wichtige Einrichtung gelten - 1. Betreiber kritischer Anlagen, - 2. qualifizierte Vertrauensdiensteanbieter, Top Level Domain Name Registries oder DNS-Diensteanbieter, - 3. Anbieter öffentlich zugänglicher Telekommunikationsdienste oder Betreiber öffentlicher Telekommunikationsnetze, die - a) mindestens 50 Mitarbeiter beschäftigen oder - b) einen Jahresumsatz und eine Jahresbilanzsumme von jeweils …As of: 02.11.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗Essential and important entities
  • § 2 BSIG§ 2 BSIG BegriffsbestimmungenIm Sinne dieses Gesetzes ist oder sind - 1. „Beinahevorfall“ ein Ereignis, das die Verfügbarkeit, Integrität oder Vertraulichkeit gespeicherter, übermittelter oder verarbeiteter Daten oder der Dienste, die über informationstechnische Systeme, Komponenten und Prozesse angeboten werden oder zugänglich sind, beeinträchtigt haben könnte, dessen Eintritt jedoch erfolgreich verhindert worden ist oder aus anderen Gründen …As of: 02.11.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗Definitions
  • Art. 2 NIS2-RichtlinieArticle 2 NIS 2 Directive Scope1. This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union. Article 3(4) of the Annex to that …As of: 29.09.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Scope
  • Art. 3 NIS2-RichtlinieArticle 3 NIS 2 Directive Essential and important entities1. For the purposes of this Directive, the following entities shall be considered to be essential entities: - (a) entities of a type referred to in Annex I which exceed the ceilings for medium-sized enterprises provided for in Article 2(1) of the Annex to Recommendation 2003/361/EC; - (b) qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their …As of: 29.09.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Essential and important entities

Key dates

  1. BSIG as amended by the NIS2 Implementation Act applies

  2. Within three months

    Registration with the BSI after a company first or again qualifies as an entity

    § 33 BSIG§ 33 BSIG Registrierungspflicht(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sowie Domain-Name-Registry-Dienstleister sind verpflichtet, spätestens drei Monate, nachdem sie erstmals oder erneut als eine der vorgenannten Einrichtungen gelten oder Domain-Name-Registry-Dienste anbieten, dem Bundesamt über eine gemeinsam vom Bundesamt und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete …As of: 02.11.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗

  3. 24 hours / 72 hours / one month

    Early warning, notification and final report of significant security incidents

    § 32 BSIG§ 32 BSIG Meldepflichten(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, folgende Informationen an eine vom Bundesamt und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete gemeinsame Meldestelle zu melden: - 1. unverzüglich, spätestens jedoch innerhalb von 24 Stunden nach Kenntniserlangung von einem erheblichen Sicherheitsvorfall, eine frühe Erstmeldung, in der angegeben wird, ob der …As of: 02.11.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗

  4. Regularly

    Management training; being responsible for and overseeing the implementation of the measures

    § 38 BSIG§ 38 BSIG Umsetzungs-, Überwachungs- und Schulungspflicht für Geschäftsleitungen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Geschäftsleitungen besonders wichtiger Einrichtungen und wichtiger Einrichtungen sind verpflichtet, die von diesen Einrichtungen nach § 30 zu ergreifenden Risikomanagementmaßnahmen umzusetzen und ihre Umsetzung zu überwachen. (2) Geschäftsleitungen, die ihre Pflichten nach Absatz 1 verletzen, haften ihrer Einrichtung für einen schuldhaft verursachten Schaden nach den auf die Rechtsform der Einrichtung …As of: 02.11.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗

How Complass helps

  • 8phases
  • 29guided steps
  • 19document templates
  • 64requirements in the catalogue

  • Guided from classification to evidence

    Eight phases: applicability, registration, governance, risk and gap analysis, measures, reporting and effectiveness.

  • Catalogue for § 30 BSIG / Art. 21 NIS2

    Each minimum measure with applicability, status and evidence, linkable with ISO 27001 and IEC 62443.

  • Reports with deadlines

    Incidents under § 32 BSIG with check questions, reporting stages and countdown in incident management.

  • For management

    Management cockpit: resolve on the measures, oversee implementation every quarter and prove trainings, each member confirms personally; plus the management report as a PDF.

The phases in the module

  1. Applicability check and classification
  2. Registration with the BSI and communication with authorities
  3. Governance and duties of senior management
  4. Risk analysis and gap analysis
  5. Implementing measures I: organisation and resilience
  6. Implementing measures II: technology, people and access
  7. Reporting obligations for significant incidents
  8. Wirksamkeit, Nachweise und kontinuierliche Verbesserung

Catalogue: Art. 21(2) NIS2 / Section 30(2) BSIG – minimum measures

Matching modules: Compliance management · Incident management · Asset management

NIS2 in Complass: what you need at a minimum

If NIS2 applies to you, this selection covers the obligations in Complass. The free applicability check shows whether it does.

minimum selection NIS2

Start package, size S

€199 net per month

  • NIS2: Risk management measures and reporting duties; you prepare notifications in incident management (included). (§§ 30, 32 BSIG (opens in a new tab))
  • Management cockpit: Management must implement the risk management measures, monitor their implementation and attend training regularly. (§ 38 BSIG (opens in a new tab))
  • Incident management
  • GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)
Try free for 14 days: minimum selection NIS2 Order: minimum selection NIS2

Recommended

Business

€590 net per month

More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.

Try Business: minimum selection NIS2

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 6 November 2026. All packages and modules in the price overview

You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information

Frequently asked questions

We supply an affected company. Does NIS2 concern us?

Not directly, if you do not fall under § 28 BSIG yourself. Your customers do, however, have to consider supply chain security and often ask for evidence. You can provide it in a structured way with Complass, e.g. via ISO 27001.

Do I also need ISO 27001?

The BSIG does not require certification. ISO/IEC 27001 is a proven framework, though; in Complass you link both catalogues so that evidence counts for both.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo