Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Framework

NIS2 and the German NIS2 Implementation Act

The German BSI Act as amended by the NIS2 Implementation Act has applied since 6 December 2025. Complass guides you from classification through the ten minimum measures to incident reporting and evidence.

Try for free Request a demo
Still from the short video “Compliance management in 20 seconds”
Compliance management in 20 seconds Project, next step, checklist, Statement of Applicability, audit package. Beispieldaten der Demo-Firma.

What is NIS2?

NIS2 is EU Directive (EU) 2022/2555 on a high common level of cybersecurity. In Germany it is transposed by the NIS2 Implementation and Cybersecurity Strengthening Act, mainly through the BSI Act: entities covered must register, implement risk management measures and report significant incidents; management is responsible.

Content as of:

Does it apply to me?

Companies are covered if they belong to one of the types of entity in Annex 1 or 2 of the BSIG and reach certain sizes. Simplified: essential entities from 250 employees or more than EUR 50 million turnover and EUR 43 million balance sheet total (Annex 1), important entities from 50 employees or more than EUR 10 million turnover and balance sheet total (Annex 1 and 2). Operators of critical facilities are covered regardless of size.

The first phase in the module guides you through assignment, size thresholds, group structures and special regimes, with a justification for your records.

This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.

Legal basis

  • § 28 BSIG§ 28 BSIG Besonders wichtige Einrichtungen und wichtige Einrichtungen(1) Als besonders wichtige Einrichtung gelten - 1. Betreiber kritischer Anlagen, - 2. qualifizierte Vertrauensdiensteanbieter, Top Level Domain Name Registries oder DNS-Diensteanbieter, - 3. Anbieter öffentlich zugänglicher Telekommunikationsdienste oder Betreiber öffentlicher Telekommunikationsnetze, die - a) mindestens 50 Mitarbeiter beschäftigen oder - b) einen Jahresumsatz und eine Jahresbilanzsumme von jeweils …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗Essential and important entities
  • § 2 BSIG§ 2 BSIG BegriffsbestimmungenIm Sinne dieses Gesetzes ist oder sind - 1. „Beinahevorfall“ ein Ereignis, das die Verfügbarkeit, Integrität oder Vertraulichkeit gespeicherter, übermittelter oder verarbeiteter Daten oder der Dienste, die über informationstechnische Systeme, Komponenten und Prozesse angeboten werden oder zugänglich sind, beeinträchtigt haben könnte, dessen Eintritt jedoch erfolgreich verhindert worden ist oder aus anderen Gründen …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗Definitions
  • Art. 2 NIS2-RichtlinieArticle 2 NIS 2 Directive Scope1. This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union. Article 3(4) of the Annex to that …As of: 29.09.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Scope
  • Art. 3 NIS2-RichtlinieArticle 3 NIS 2 Directive Essential and important entities1. For the purposes of this Directive, the following entities shall be considered to be essential entities: - (a) entities of a type referred to in Annex I which exceed the ceilings for medium-sized enterprises provided for in Article 2(1) of the Annex to Recommendation 2003/361/EC; - (b) qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their …As of: 29.09.2026 · Source: EUR-LexOpen original (EUR-Lex) ↗Essential and important entities

Key dates

  1. BSIG as amended by the NIS2 Implementation Act applies
  2. Within three months Registration with the BSI after a company first or again qualifies as an entity · § 33 BSIG§ 33 BSIG Registrierungspflicht(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sowie Domain-Name-Registry-Dienstleister sind verpflichtet, spätestens drei Monate, nachdem sie erstmals oder erneut als eine der vorgenannten Einrichtungen gelten oder Domain-Name-Registry-Dienste anbieten, dem Bundesamt über eine gemeinsam vom Bundesamt und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  3. 24 hours / 72 hours / one month Early warning, notification and final report of significant security incidents · § 32 BSIG§ 32 BSIG Meldepflichten(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, folgende Informationen an eine vom Bundesamt und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete gemeinsame Meldestelle zu melden: - 1. unverzüglich, spätestens jedoch innerhalb von 24 Stunden nach Kenntniserlangung von einem erheblichen Sicherheitsvorfall, eine frühe Erstmeldung, in der angegeben wird, ob der …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  4. Regularly Management training; being responsible for and overseeing the implementation of the measures · § 38 BSIG§ 38 BSIG Umsetzungs-, Überwachungs- und Schulungspflicht für Geschäftsleitungen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Geschäftsleitungen besonders wichtiger Einrichtungen und wichtiger Einrichtungen sind verpflichtet, die von diesen Einrichtungen nach § 30 zu ergreifenden Risikomanagementmaßnahmen umzusetzen und ihre Umsetzung zu überwachen. (2) Geschäftsleitungen, die ihre Pflichten nach Absatz 1 verletzen, haften ihrer Einrichtung für einen schuldhaft verursachten Schaden nach den auf die Rechtsform der Einrichtung …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗

How Complass helps

  • 8phases
  • 29guided steps
  • 19document templates
  • 64requirements in the catalogue

  • Guided from classification to evidence

    Eight phases: applicability, registration, governance, risk and gap analysis, measures, reporting and effectiveness.

  • Catalogue for § 30 BSIG / Art. 21 NIS2

    Each minimum measure with applicability, status and evidence, linkable with ISO 27001 and IEC 62443.

  • Reports with deadlines

    Incidents under § 32 BSIG with check questions, reporting stages and countdown in incident management.

  • For management

    Management cockpit: resolve on the measures, oversee implementation every quarter and prove trainings, each member confirms personally; plus the management report as a PDF.

The phases in the module

  1. Applicability check and classification
  2. Registration with the BSI and communication with authorities
  3. Governance and duties of senior management
  4. Risk analysis and gap analysis
  5. Implementing measures I: organisation and resilience
  6. Implementing measures II: technology, people and access
  7. Reporting obligations for significant incidents
  8. Wirksamkeit, Nachweise und kontinuierliche Verbesserung

Catalogue: Art. 21(2) NIS2 / Section 30(2) BSIG – minimum measures

Matching modules

Compliance management

Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.

Learn more

Incident management

Record incidents, check reporting obligations under NIS2, the CRA and the GDPR and track the reporting deadlines with a countdown.

Learn more

Asset management

IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.

Learn more

NIS2 in Complass: what you need at a minimum

The first selection covers the obligations in Complass if they apply to you. The free applicability check shows whether they do. To the applicability check

What you need at a minimum

If NIS2 applies to you: this selection covers the resulting obligations in Complass. It is preselected when you start a trial or order.

Portal size Start

  • NIS2: Risk management measures and reporting duties; you prepare notifications in incident management (included). (§§ 30, 32 BSIG (opens in a new tab))
  • Management cockpit: Management must implement the risk management measures, monitor their implementation and attend training regularly. (§ 38 BSIG (opens in a new tab)) (included)
  • Incident management: included
  • GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection): included
Price of the minimum selection
ItemNet price per month
Start S€179
NIS2included
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)included
Total€179 net/month

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try free for 14 days: minimum selection NIS2 Order: minimum selection NIS2

Adjust the selection in the price overview: minimum selection NIS2

Recommended for more impact Offer, not a duty

Business with Supplier Management

More impact with Risk management, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.

€548 net/month, €369 more than the minimum selection.

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try with Business: minimum selection NIS2

View in the price overview: minimum selection NIS2

Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information

Frequently asked questions

We supply an affected company. Does NIS2 concern us?

Not directly, if you do not fall under § 28 BSIG yourself. Your customers do, however, have to consider supply chain security and often ask for evidence. You can provide it in a structured way with Complass, e.g. via ISO 27001.

Do I also need ISO 27001?

The BSIG does not require certification. ISO/IEC 27001 is a proven framework, though; in Complass you link both catalogues so that evidence counts for both.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo