NIS2 Directive: What Companies Need to Know Now

Key Takeaways

• Expanded cybersecurity requirements: Around 29,500 entities supervised by the BSI in Germany are affected (BSI, as of December 2025).
• Stricter penalties & personal liability: Executives can be held personally liable.
• ISO 27001 ISMS: The most effective way to meet NIS2 obligations.

Introduction

Cybersecurity is becoming increasingly important. With the NIS2 Directive, entering into force in Germany on October 18, 2024, the EU significantly strengthens its cybersecurity framework. NIS2 replaces the previous NIS1 Directive and expands obligations to a much larger group of companies.

Around 29,500 entities supervised by the BSI will need to adjust their security measures and comply with stricter reporting, risk management, and governance requirements.

Overview of the NIS2 Directive

The directive aims to harmonize cybersecurity across the EU and introduces:

• Higher security requirements
• Stronger reporting obligations
• Risk-based security measures
• Expanded list of affected sectors
• Mandatory “state-of-the-art” controls

Member states must transpose NIS2 into national law by October 18, 2024.

Scope of NIS2

NIS2 significantly expands its reach through:

New entity classifications

• Essential Entities
• Important Entities

Expanded sectors (11 essential, 7 important)

Including:

• Energy
• Water
• Healthcare
• IT & Telecommunications
• Finance & Insurance
• Public administration
• Waste & wastewater
• Food production
• Space
• Postal & courier services

The size-cap rule brings any medium-sized or larger company into scope if active in one of these sectors.

NIS2 Requirements

1. Cybersecurity risk management

• Regular risk assessments
• Supply chain security
• Incident response and continuity planning

2. Technical & organizational measures

• Encryption
• Network segmentation
• Patch management
• Employee training

3. Strict incident reporting

• Initial notification within 24 hours
• Follow-up report after 72 hours
• Final report after 1 month

4. Mandatory participation in information-sharing

Especially for essential entities.

Implementing NIS2

The most efficient implementation path is an Information Security Management System (ISMS) based on ISO 27001.

Steps include:

1. Gap analysis
2. Definition of required controls
3. Technical & organizational implementation
4. Employee awareness
5. Risk management introduction
6. Audit preparation

Typical ISMS projects take 6–18 months.

Costs & Audits

German estimates indicate:

• One-time NIS2 implementation costs: ~€1.37 billion
• Annual recurring costs: ~€1.65 billion

Regular internal and external audits ensure compliance and continuous improvement.

Penalties & Liability

NIS2 introduces much tougher sanctions:

Fines

• Essential entities: up to €10M or 2% global revenue
• Important entities: up to €7M or 1.4% global revenue

Personal liability

Executive management can be held personally responsible.

No transition period

Full compliance is required starting October 18, 2024.

Challenges

• High resource requirements
• Tight reporting deadlines
• Increased administrative burden
• Organizational complexity
• Need for specialized cybersecurity expertise

Opportunities

• Stronger organizational resilience
• Competitive advantage via demonstrable security
• Greater trust from clients and partners
• Professionalization of internal structures

Conclusion

The NIS2 Directive marks a major step in strengthening Europe's cybersecurity landscape. Although demanding, it offers a unique opportunity for companies to modernize their cybersecurity posture.

Implementing an ISO 27001 ISMS provides a structured, auditable, and efficient path to full NIS2 compliance and long-term cyber resilience.