This guide takes you through every step, with examples from industry and OT. Three separate guides go deeper: "Who is affected by NIS2?", "Registering with the BSI step by step" and "The NIS2 reporting duty in practice".
The route at a glance
- Clarify applicability. Does your activity match Annex 1 or 2 BSIG, and do you reach the size threshold?
- Register with the BSI. First "Mein Unternehmenskonto", then the BSI portal.
- Involve management. It implements the measures, oversees their implementation and attends training.
- Define scope and risks. Which systems carry your services, and where do you stand today?
- Implement the ten minimum measures. Gaps become tasks with owners and dates.
- Prepare reporting channels. Who assesses an incident, and who reports it?
- Document and check effectiveness. What is implemented has to be traceable.
Step 1: clarify applicability
The starting point is your activity and your size. Covered are the types of entity in Annex 1 or 2 BSIG that reach the thresholds of § 28 BSIG. For industry, Annex 2 names mechanical engineering, the manufacture of electrical equipment and vehicle manufacturing, among others.
The assessment is yours, as the BSI does not tell you the result. Record the classification, the figures and the reasoning. The guide "Who is affected by NIS2?" explains sectors, thresholds and group questions.
Step 2: register with the BSI
Essential and important entities register at the latest three months after they first or again qualify as such (§ 33(1) BSIG). This takes two stages: first "Mein Unternehmenskonto" (MUK), then the BSI portal.
Allow some lead time, because part of the activation data arrives by post. The guide "Registering with the BSI step by step" shows all fields.
Step 3: involve management
Under § 38(1) BSIG, management is obliged to implement the risk management measures and to oversee their implementation. Under § 38(3) BSIG, it attends training regularly.
Settle three things early: who runs the topic day to day, how often management reviews the status and when each member is trained. In industry, those responsible for production belong at the table, not only IT.
Step 4: define scope and risks
§ 30(1) BSIG covers the information technology systems, components and processes you use to provide your services. In production, these usually include controllers, control systems, engineering stations and remote maintenance access alongside office IT and ERP.
Record these systems in an inventory and carry out a risk analysis. A gap analysis against the ten areas from step 5 shows where you stand.
What "proportionate" means
The measures must be appropriate, proportionate and effective. Under § 30(1) sentence 2 BSIG you take into account:
- Exposure to risk. How strongly are your systems exposed to threats?
- Size of the entity. A mid-sized company needs different structures from a corporate group.
- Implementation costs. They feed into the assessment but do not replace it.
- Likelihood and severity of security incidents.
- Societal and economic impact of such incidents.
Record this assessment, because compliance with the duty has to be documented (§ 30(1) sentence 3 BSIG). That way it stays traceable why you implemented a measure the way you did.
Step 5: implement the ten minimum measures
§ 30(2) BSIG names ten areas that the measures must cover as a minimum. They should comply with the state of the art, take relevant European and international standards into account and must be based on an all-hazards approach.
The areas are shortened here. The examples are our illustration, not statutory text.
| No. | Area | Example from industry |
|---|---|---|
| 1 | Concepts for risk analysis and IT security | A risk analysis that covers office IT and machines together |
| 2 | Handling security incidents | Incident procedure with on-call duty for IT and maintenance |
| 3 | Business continuity, backup management, crisis management | Tested backups of PLC programs and recipes |
| 4 | Supply chain security | Security requirements for integrators in the contract |
| 5 | Security in acquisition, development and maintenance, vulnerabilities | Security requirements when buying machines, handling vendor advisories |
| 6 | Assessing effectiveness | Restore test with a record |
| 7 | Training and awareness | Instruction for shift leaders and maintenance staff |
| 8 | Cryptography | Encrypted remote maintenance connections |
| 9 | Personnel, access control, management of ICT systems | Controlled granting and removal of access to controllers |
| 10 | Multi-factor authentication, secured communication | MFA for remote access, emergency contacts on paper |
For certain digital types of entity, such as cloud providers and managed service providers, the requirements of Implementing Regulation (EU) 2024/2690 take precedence (§ 30(3) BSIG). Operators of critical facilities also use attack detection systems (§ 31(2) BSIG).
Step 6: prepare reporting channels
You report significant incidents in several stages to the joint reporting desk of the BSI and the BBK (§ 32 BSIG). The first stage is due without undue delay, at the latest 24 hours after becoming aware.
So decide in advance who assesses significance, who reports and who deputises. The guide "The NIS2 reporting duty in practice" explains the stages, criteria and examples.
Step 7: document and check effectiveness
Entities must document compliance with the duty under § 30(1) BSIG. This includes assessing effectiveness (§ 30(2) no. 6 BSIG). When the records are needed depends on the classification:
| Classification | What applies | Reference |
|---|---|---|
| Important entity | The BSI can check if facts justify the assumption that duties are not or not correctly implemented | § 62 BSIG |
| Essential entity | The BSI can order audits, inspections or certifications and, at the earliest three years after entry into force, also require evidence from other entities in this category | § 61(1) and (3) BSIG |
| Operator of a critical facility | Proof to the BSI every three years | § 39(1) BSIG |
Example from industry
This example is invented. A manufacturer of switchgear has 180 employees and one plant, and it runs its IT itself.
- Classification. The activity falls under the manufacture of electrical equipment (Annex 2 BSIG) and the size fits: important entity.
- Scope. Production control joins office IT, because no orders run without it.
- Gap. An integrator maintains machines through permanently open access. This leads to a task for engineering and a contract change.
- Oversight. Management reviews the status every quarter and records its instructions.
Checklist
- Applicability checked per company, classification documented with reasons.
- Registration in the BSI portal completed, upkeep of the data settled.
- Roles defined, management oversight and training scheduled.
- Scope described, including OT and remote access.
- Risk analysis and gap analysis against the ten areas carried out.
- Gaps created as tasks with owners and due dates.
- Important suppliers assessed.
- Reporting procedure defined and practised.
- Assessment of proportionality recorded.
- Evidence assigned to the matching requirement, effectiveness checked.
Implementing NIS2 in Complass
A spreadsheet is enough to start with. Once several people work on it and evidence comes in, one shared state is easier than lists in mailboxes:
- Check applicability. The free applicability check gives a first assessment without sign-up. In the portal, the applicability check names the classification, reasoning, legal reference and deadlines.
- Work with guidance. The NIS2 module guides you in eight phases from classification to evidence, with document templates such as the applicability analysis and the reporting plan.
- Run measures in the catalogue. The catalogue for § 30 BSIG breaks the ten areas into implementation points, each with applicability, status and evidence.
- Turn gaps into tasks. The gap analysis shows the biggest gaps and, if you wish, moves them into the action plan.
- Involve management. In the cockpit under § 38 BSIG, oversight and training records come together, and each member confirms personally.
- Check incidents with guidance. Questions lead to a justified decision, and Complass calculates the deadlines under § 32 BSIG. You submit the report yourself in the BSI portal.
- Pass on the status. You export the status report and catalogues as PDF and Excel. You invite your auditor for a limited time, with a log of every access.
The guide "NIS2 without Excel" shows how to bring in existing lists.
Frequently asked questions
Do important entities have fewer duties?
The duties under §§ 30, 32, 33 and 38 BSIG apply to both categories. The difference lies mainly in supervision: for important entities the BSI checks when there is a reason (§ 62 BSIG), while it has wider powers over essential entities (§ 61 BSIG).
Is ISO 27001 certification enough for NIS2?
No. The BSIG does not require certification, and according to the BSI there is no general certificate for NIS2. An ISO 27001 certificate can be taken into account according to the BSI, but it does not replace your own check per measure. Check whether its scope covers the systems behind your services, including OT, and compare it with the ten areas.
Do we have to submit evidence to the BSI on our own initiative?
According to the BSI, essential and important entities present evidence only when ordered to. Operators of critical facilities provide it without being asked (§ 39 BSIG). Everyone has to document.
How often does management need training?
The law says "regularly" and names no interval. According to the BSI, the explanatory memorandum assumes at least every three years, but the BSI considers that sufficient only in the rarest cases. It recommends basing the interval on the risk and on the knowledge of the people involved.
In a demo we show you how the seven steps come together in Complass.
Request a demo Try it for 14 days
Read more
- Guide "Who is affected by NIS2?"
- Guide "Registering with the BSI step by step"
- Guide "The NIS2 reporting duty in practice"
- Guide "NIS2 without Excel: one portal instead of lists"
- Whitepaper "NIS2 for companies in every sector: directly in scope or via your customers"
- NIS2 and the BSIG in Complass: applicability, duties and implementation
- Compliance management: catalogues, action plan and evidence
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG is authoritative.