Why Complying with NIS-2 Pays Off for You

Germany's NIS-2 implementation act came into force on 6 December 2025. Since then, the BSI has supervised around 29,500 entities instead of roughly 4,500, and the obligations apply from that day. Many companies have since checked whether they are affected. If your answer was no, you are not off the hook: the requirements still reach you through customers, insurers and tenders. They are also a pretty good benchmark for your own IT security.

What NIS-2 requires from affected companies

The law distinguishes between essential and important entities, depending on sector and company size. The range extends from energy, healthcare and finance through public administration to manufacturing, logistics and digital services. Affected companies face three core obligations:

• Registration: Affected companies must register with the BSI themselves. The BSI portal has been open for this since January 2026.
• Risk management: ten minimum measures, from risk analysis and access control through cryptography and multi-factor authentication to backups, emergency plans and supply chain security.
• Reporting: Significant security incidents must be reported in stages, with an early warning within 24 hours, a notification within 72 hours and a final report after one month.

Responsibility lies explicitly with senior management. It must approve the measures, oversee their implementation and undergo training, and it is liable for failures. Essential entities face fines of up to 10 million euros or 2 percent of worldwide annual turnover.

Why NIS-2 pays off even without an obligation

At first glance, this looks like effort you can save as long as your company is not covered by the law. Three reasons argue against that.

Your customers will ask. Affected companies have to keep an eye on the security of their supply chain. They pass these requirements on to suppliers and service providers through questionnaires, contract clauses or audits. If you have already implemented the measures, you can answer such requests quickly and with evidence.

The measures make a useful checklist. NIS-2 covers the security-relevant areas of a company almost completely. Following it answers questions every company should be asking anyway:

• Where are the current weaknesses in your IT?
• How do you protect identities and access from misuse?
• How do you keep track of all access to your network?
• How do you make your employees aware of phishing?
• What happens if you are attacked anyway?

You reduce risk and follow-up costs. Every measure you implement makes a successful attack less likely and limits the damage if it does happen. And if your company falls under the law later, for example because it grows, you don't start from scratch.

Which security approach fits

There is no single product that fulfils NIS-2. The requirements interlock: access control, encryption, detection and recovery have to work together. That is why a coherent approach such as SASE has proven itself: it looks at network and security together instead of just replacing the weakest link. Why NIS-2 ultimately points to Zero Trust is explained in our article Zero Trust becomes the standard.

How to proceed

1. Check whether you are affected: Sector and company size determine whether and at which level your company falls under the law.
2. Identify gaps: Compare your current state with the minimum measures and prioritise by risk.
3. Build up evidence: Document measures, responsibilities and reporting channels so that you can provide information to customers, auditors and, in an emergency, the BSI.

Our NIS2 compliance page shows how we implement the requirements technically and run them as a managed service. If you would like to assess where you stand, talk to us.