Rights & obligations

NIS2: does it affect me? What the cybersecurity law means for small and medium-sized companies

Since December 2025, the NIS2 law has applied in Germany, and over 20.000 entities are registered. Who is affected – and why suppliers should take a look.

From the Audit Monster

4 min read

Audit Monster says: “Check first. Then act.”

Have you received an email in recent months with “NIS2” in bold and the word “fine” not far away? Take a quick breath.

NIS2 is an EU directive for more cybersecurity. In Germany it has applied since 6 December 2025 through the NIS2 Implementation Act, which mainly rewrote the BSI Act (BSIG – the law on Germany's Federal Office for Information Security). There was no transition period. Since then, many small companies have been asking themselves: am I affected? For most, the honest answer is: probably not directly – but perhaps through their customers.

In short

  • The law has applied in Germany since 6 December 2025, with no transition period.
  • Those directly affected are mainly medium-sized and large companies in certain industries.
  • Those affected must register, take precautions, report incidents and train management.
  • Small suppliers often notice NIS2 through their customers' questions.

Who is directly affected

The law distinguishes between “particularly important” and “important entities”. Whether you're one of them depends mainly on two things:

  • Sector: Certain sectors are covered, such as energy, transport, health, water, digital infrastructure, IT services for businesses, postal and courier services, waste, chemicals, food, parts of industry and digital providers.
  • Size: As a rule, it's about medium-sized and large companies – roughly from 50 employees or from more than 10 million euros in annual turnover and balance sheet total. The BSI (Germany's Federal Office for Information Security) assesses size according to EU Recommendation 2003/361/EC. For some services the law applies regardless of size.

The BSI offers a non-binding online check to see whether you're affected. It doesn't replace legal advice, but it gives you a first indication within a few minutes.

What those affected have to do

  • Register: no later than three months after being deemed affected, via the joint portal of the BSI and the BBK (§ 33 BSIG).
  • Take precautions: implement appropriate information security measures – from an emergency plan to backups to access control (§ 30 BSIG).
  • Report: Significant security incidents are reported to the BSI in three stages (§ 32 BSIG).
  • Involve management: Management must implement the measures, monitor their implementation and take part in training regularly (§ 38 BSIG).
Duty to report a significant security incident
  1. within 24 hoursEarly warning: what happened, is an attack suspected?
  2. within 72 hoursReport with an initial assessment of severity and impact.
  3. a month laterFinal report – or a progress report if the incident is still ongoing.

Deadlines from becoming aware of the incident, under § 32 BSIG. Applies to entities covered by the law.

How many there really are

By 30 September 2026, according to the BSI, 20.141 entities had registered: 6.837 particularly important and 13.252 important entities, plus a few special cases. Over the same period, 1.272 initial reports of security incidents were received. This shows: it affects many – but by no means every business.

The indirect route: when your customer is affected

This is where it gets interesting for small companies. Affected businesses must also keep an eye on the security of their supply chain. If you supply IT services, software, maintenance or components to an affected company, your customer may well ask questions or want to see evidence. Do you have an emergency plan? How do you secure access? Are there backups that get tested?

This isn't harassment – it's how the law reaches the wider economy. If you can answer these questions calmly and honestly, you have an advantage – including when it comes to new contracts.

Keep calm

Many emails about NIS2 are advertising with a threatening backdrop. If you don't work in one of the sectors and you're small, the law doesn't affect you directly. Good basic security is still worth it – no legal paragraphs required.

Good basic security that always helps

Affected or not: what NIS2 requires is, at its core, sensible homework. An emergency plan on one page. Two-factor login for email and important accounts. Backups that are stored separately and tested. Updates that don't wait for months. And a team that knows who to call when something seems odd. How to handle backups is explained in The backup that really saves you.

A one-page emergency plan beats any folder nobody can find.

The Audit Monster

What we hear most often in conversations

“We're a trades business with twelve people. Does this apply to us?” As a rule, no. Trades usually aren't among the covered sectors, and the size is below the thresholds. There are exceptions, for example if you're part of the energy supply.

“We're a small IT systems house.” This is worth a closer look. Managed IT services for businesses are a covered sector. Whether you're affected then depends mainly on size. And even if not: your customers will ask.

“Our customer wants a self-assessment. What do we put in it?” The truth, in calm words. What you already do, what you're planning and by when. Nobody expects a ten-person business to have the security department of a large corporation. What's expected is that you know where your risks lie and that you're working on them.

What you can do now

  • Do the BSI's applicability check and save the result with the date.
  • If you're affected: check registration, assign responsibilities, write down reporting channels.
  • If you're a supplier: ask your big customers what proof they expect.
  • Create a one-page emergency plan: who decides, who do we call, where are the backups?
  • Plan a short training session for management – mandatory for those affected, sensible for everyone else.

Want to know where you stand? The Audit Monster checks with you whether NIS2 affects you and writes down clearly what makes sense. For the emergency plan, reporting channels and training, the Cyber Monster is there.

Note: This article gives a general overview (as of: 22.10.2026) and is not legal advice. For your individual case, please ask a lawyer.

Sources

  1. BSI: NIS-2 in Zahlen (Stand 30.09.2026)
  2. BSI: Fragen und Antworten zu NIS-2 (inkl. Betroffenheitsprüfung)
  3. § 30 BSIG – Risikomanagementmaßnahmen
  4. § 32 BSIG – Meldepflichten
  5. § 33 BSIG – Registrierungspflicht
  6. § 38 BSIG – Pflichten der Geschäftsleitung
  7. Heuking: Ab jetzt gilt’s – NIS2-Umsetzungsgesetz in Kraft (05.12.2025)

Sources last checked on 05.11.2026. The links lead to external pages.

Audit Monster helps – calmly

Checked. And in black and white.

Don't want to do this alone? Tell us what's going on. First you get an assessment with a price, then you decide.

Call a monsterTo the Audit Monster

You might also like

All articles in the Monster Magazine