NIS2 Germany 2026: Practical Guide for Companies
NIS2 is operational reality in Germany under the current BSIG. For covered organizations, the task is not a one-time compliance folder but effective risk management, reporting/registration processes and management accountability.
What §30 means in practice
Section 30 BSIG requires appropriate, proportionate and effective technical and organizational measures. Organizations should prioritize risks, assign control owners and be able to demonstrate that key measures actually operate.
Why management must be involved
Section 38 BSIG requires management of covered essential and important entities to implement and oversee risk-management measures and undergo regular training. This cannot be treated as an IT-only project.
What evidence matters
Current identity and role information, MFA coverage, device compliance, security monitoring, backup restore tests, incident exercises, supplier assessments and documented exceptions are operational evidence sources.
Next step
Clarify scope and gaps first. Then prioritize high-impact technical risks while building governance, evidence and management reporting in parallel.