Complass
NIS2 and the Energy Industry Act for municipal utilities: one company, two legal regimes
Network control centre under the Energy Industry Act, waterworks under the BSI Act, and an IT security catalogue under revision: what municipal utilities must meet today and how they prepare for the new catalogue.
Since the NIS2 transposition on 6 December 2025, the IT security of network and plant operators has been governed by Sections 5c to 5e of the German Energy Industry Act (EnWG). Operators of energy supply networks are in scope regardless of size; the core duties of the BSI Act do not apply to them (§ 28(5) BSIG). For water, wastewater, district heating and other lines of business in a multi-utility, the BSI Act still applies.
The whitepaper assigns each line of business to its legal regime and explains the IT security catalogue of the Federal Network Agency: the catalogues of 2015 and 2018 that apply today, the twelve topics of § 5c(4) EnWG and the status of the new catalogue, which is under revision but not yet determined. It also covers reporting to the BSI reporting office (24 hours, 72 hours, one month), documentation and fines, management duties under § 5e EnWG and physical resilience under the KRITIS Umbrella Act and § 5f EnWG.
With a 10-step plan, a practice example of a multi-utility, a checklist and "Implementation in Complass" boxes, including the EnWG and IT security catalogue framework; only features that exist are named.
18 pages · Version 2.1 · as of · Author Marc Linden, Complass GmbH
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.