Complass
NIS2 for companies in every sector: directly in scope or via your customers
A questionnaire in your inbox, a deadline closing in: why NIS2 reaches far beyond the usual suspects – and how to get ready in ten steps.
The NIS2 directive (EU) 2022/2555 and its German implementation in the BSI-Gesetz (BSIG) oblige thousands of companies to take risk-management measures, register and meet staged reporting duties. This affects not only classic sectors such as energy or health, but increasingly IT service providers, logistics and manufacturing companies – and companies that are not directly in scope themselves but are affected via their customers' contracts and security questionnaires.
The whitepaper opens with a questionnaire landing in an inbox on a Friday afternoon, then explains from there who is directly or indirectly affected via customer requirements: the core obligations (risk-management measures under Section 30 BSIG, management-body duties under Section 38 BSIG, registration under Section 33 BSIG, reporting deadlines from 24 hours to one month under Section 32 BSIG), and a 10-step implementation plan.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot that maps the legal requirement to the matching module (decision W11); only features already live are named.
13 pages · Version 1.2 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.