NIS2
NIS2 already applies: are you registered and able to evidence it?
We establish whether you are affected and take you through registration, reporting duties and risk management the way the BSI expects — whether you are a mid-sized company or a corporation.
Find out in 20 minutes whether you are affectedHow we work together
No obligation, no sales pressure
NIS2 / BSIG (German Federal Act on IT Security)
§ 30 BSIGBSI notification
The reality
NIS2 makes cyber security a board matter: management is personally liable. Anyone not registered with the BSI commits a separate offence even without a security incident.
The risk of waiting
Up to €10m or 2 % of global turnover, plus personal liability of the management. In force since 6 December 2025, with no transition period.
The advantage of acting
Demonstrable NIS2 conformity is increasingly a condition in tenders and supply chains — an advantage with customers who are themselves subject to NIS2.
Which companies does NIS2 apply to?
Medium-sized companies in the 18 NIS2 sectors
From 50 employees, or more than 10 million euros in turnover and balance sheet total, they count as an important entity and have to register with the BSI.
Large companies and operators of critical installations
From 250 employees, or more than 50 million euros in turnover and 43 million in balance sheet total, in highly critical sectors they count as essential; operators of critical infrastructure regardless of size.
Suppliers and IT service providers of affected companies
Companies subject to NIS2 have to account for the security of their supply chain and pass the requirements on to their service providers, including those not required to register themselves.
What you get
- Applicability analysisClarity on whether you fall under NIS2 as an important or a particularly important entity.
- BSI registrationSupport with registering at the BSI, which is mandatory even without a security incident.
- Reporting procedures (24/72 h)A procedure with which you report significant security incidents within the legal deadlines.
- Risk management (§ 30 BSIG)Security measures as the law requires them, documented and prioritised.
- Governance & board trainingManagement knows its duties and can approve and monitor the measures.
- Audit-proof evidenceDocuments with which you can evidence your measures to the authority and to customers.
Technical implementation
SOC & MDR and monitoring from our IT security team.
Many companies arrive at a no when they check whether NIS2 applies to them, but they do not record why, or on which assumptions. If the company later exceeds the thresholds, nobody notices.
How we work together
Check whether you are affected
An important or a particularly important entity? We establish that with you.
Registration & reporting lines
BSI registration, reporting deadlines of 24 hours / 72 hours / 1 month.
Risk management & evidence
Security measures under § 30 BSIG that you can evidence when it matters.
Are you already registered with the BSI?
We will review with you, without obligation, whether NIS2 applies.
- No obligation
- No sales pressure
Frequently asked questions
Which sectors does NIS2 cover?
NIS2 distinguishes between "important" and "particularly important" entities across 18 sectors, among them energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, public administration, space and large parts of manufacturing such as mechanical engineering and electronics. As a rule the thresholds are 50 employees or €10 million in annual turnover or balance sheet total, although some sectors carry duties regardless of size. Being classified as "particularly important" brings active supervision by the authority on top of self-assessment, while "important" entities are primarily reviewed when there is cause. Both groups must register with the BSI and report security incidents within the deadlines.
What happens if we simply do nothing?
Failing to register is already an offence in its own right, whether or not a security incident ever occurs.
We are a 60-person operation — is this worth it for us?
Yes. NIS2 distinguishes by sector and size, not by whether a company is “big enough for consultants”. We establish whether you are affected in a short conversation.
How long does implementation usually take?
Registration is usually a matter of days; robust risk management typically takes 2–4 months depending on where you start.
Let's talk about your project.
Tell us what you have in mind. Your message goes straight to our team.
Daniel Tölgyesi
CEO
Loading the form …