{"id":73416,"date":"2026-08-05T22:34:30","date_gmt":"2026-08-05T20:34:30","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73416"},"modified":"2026-08-05T22:34:30","modified_gmt":"2026-08-05T20:34:30","slug":"nis2-umsetzung","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/cybersecurity-resilienz\/nis2-umsetzung\/","title":{"rendered":"Implement NIS2 in practice"},"content":{"rendered":"
\"Cybersecurity<\/span>

\u2190 Cybersecurity & Resilience<\/a><\/p>

Implement NIS2 in practice<\/h1>

Translate NIS2 requirements into responsible, effective and verifiable security measures.<\/strong><\/p><\/div><\/div>\n\n\n\n

NIS2 does not require isolated tool adoption for affected entities, but rather managed cybersecurity risk management. In Germany, the corresponding obligations have applied since the NIS 2 Implementation Act and the amended BSIG came into force on December 6, 2025. A pragmatic approach combines management responsibility, risks, reporting channels, supply chain and reliable evidence in a prioritised roadmap. Whether a company is covered must be legally examined on a case-by-case basis.<\/p>\n<\/div>\n\n\n

Background<\/h2>\n\n
\"Cybersecurity<\/figure>
\n

Many organisations already have security measures in place, but responsibilities, risk decisions, service provider management and evidence are not always linked in a robust overall picture. This becomes particularly critical in the case of security incidents: Who decides, who coordinates the technical steps, who evaluates the reporting requirement and what information is available in a timely manner?<\/p>\n<\/div><\/div>\n\n\n\n

NIS2 makes these connections a managerial and operational task. The approach should therefore not start with an unrelated list of measures, but with the services, systems, supply relationships and risks that are material to the company.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n

Directive (EU) 2022\/2555 creates an EU framework for a high common level of cybersecurity. As a guideline, it had to be implemented nationally. In Germany, the NIS 2 Implementation Act was announced on December 5, 2025; According to the BSI, the amended BSIG came into force on December 6, 2025. The implementation law is an article law and amends other specialist laws in addition to the BSIG.<\/p>\n\n\n\n

The scope of application depends, among other things, on the type of facility according to the appendixes to the BSIG, size thresholds and special cases. The BSI provides a non-binding impact assessment for this, but does not make a binding decision on a case-by-case basis. ADIUMENTO also does not establish any binding effect and does not provide legal advice.<\/p>\n\n\n\n

NIS2 is of product obligations of the Cyber Resilience Act<\/a> to distinguish. For the higher-level classification leads Cybersecurity & Resilience<\/a> on.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n
\"IT-Security-Spezialistin<\/figure>
\n