NIS2 in Germany: what the NIS2UmsuCG requires of companies

Since when it applies

The German NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was promulgated in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I No. 301) and came into force on 6 December 2025. It rewrites the BSI Act (BSIG). There is no general transition period: the duties have applied since that day.

Who is covered

Companies in the sectors listed in annexes 1 and 2 of the BSIG are covered once they reach certain sizes. As a rule of thumb: from 50 employees, or more than €10 million in annual turnover and balance-sheet total. The act distinguishes:

• particularly important entities: as a rule from 250 employees, or more than €50 million in turnover and €43 million in balance-sheet total, in the sectors of annex 1, plus certain entities whatever their size;
• important entities: the other medium-sized and large companies covered.

Whether a company is covered depends on its exact activity, not on the name of its sector. The free NIS2 scope checker gives a first estimate; the act is what binds.

The four duties

1. Registration with the BSI. Entities covered when the act came into force had three months to register, that is until 6 March 2026. An entity covered later has three months from that point.
2. Risk management. Appropriate technical and organisational measures, including policies on risk analysis, incident handling, business continuity, supply-chain security, vulnerability management, cryptography, access control and multi-factor authentication.
3. Reporting. Significant security incidents are reported to the BSI in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
4. Management responsibility. Management must approve the measures, oversee their implementation and take part in training regularly. It can be held liable for breaches of these duties.

Breaches can be fined up to €10 million or 2% of worldwide annual turnover for particularly important entities, and up to €7 million or 1.4% for important entities, whichever is higher.

Where to start

• Establish whether the company is covered and, if so, register if that has not been done.
• List the company’s domains, services and suppliers: there is no risk management without an inventory.
• Set the reporting path: who decides whether an incident is significant, and who reports within 24 hours.
• Include the supply chain: the act requires the security of suppliers to be taken into account. See Assessing a supplier’s security.

What an outside view contributes, and what it does not

A passive audit from outside, such as Perimetry’s, shows part of what the act covers under vulnerability management and cryptography: outdated certificates, open ports, missing e-mail authentication, forgotten subdomains. It does not replace the risk analysis, the organisational measures, the reporting process or management training. For small companies that are not covered by the act but are asked about it by customers, see NIS2 for small companies.

This guide is not legal advice.