NIS2 duties: the checklist.

Within three months of coming into scope, via Mein Unternehmenskonto and the BSI portal. For everyone in scope since 06.12.2025 the deadline ended on 06.03.2026. Report changes to your data at the latest two weeks after you learn of them.

Measures must be suitable, proportionate and effective, judged by risk exposure, size, implementation cost and the possible consequences of incidents. And: implementation must be documented (§30(1)). At minimum the measures cover:

1. Policies on risk analysis and information system security.
2. Incident handling.
3. Business continuity: backup management, disaster recovery, crisis management.
4. Supply chain security, including relationships with direct suppliers and service providers.
5. Security in acquisition, development and maintenance of IT systems, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of the measures.
7. Basic cyber hygiene training and awareness.
8. Policies and processes for cryptography and encryption.
9. Personnel security, access control and management of IT systems and assets.
10. Multi-factor or continuous authentication, secured communications and, where appropriate, secured emergency communications.

For cloud providers, data centres, CDNs, managed service providers, managed security service providers, online marketplaces, search engines, social networks, trust service providers, DNS service providers and TLD registries, Implementing Regulation (EU) 2024/2690 takes precedence (§30(3)). It makes the measures concrete, including secure development (no. 6.2), security testing (no. 6.5), patch management (no. 6.6) and vulnerability handling (no. 6.10).

• Within 24 hours of becoming aware: early warning to the joint reporting office of BSI and BBK.
• Within 72 hours: incident notification with an initial assessment.
• Within one month of that notification: final report, or a progress report if the incident is still ongoing. Interim reports on BSI request.

Whether an incident is "significant" depends on its impact. The entity types of the implementing regulation have concrete thresholds. For cloud services, for example, a complete outage of more than 30 minutes is enough. So the reporting chain must be in place before anything happens: who detects, who assesses, who reports, weekends included.

• Management must implement the §30 measures and oversee their implementation.
• A culpable breach makes management liable to the entity for the damage, under the applicable company law.
• Management must attend training regularly to be able to assess risks and risk management. According to the legislative explanation at least every three years; the BSI advises shorter intervals when management changes or the risk situation shifts.

• Operators of critical facilities: evidence every three years (§39 BSIG).
• Essential entities: the BSI may order individual entities to undergo audits and checks. It may request evidence from every essential entity without cause from 06.12.2028 (§61(3)); for hospitals, 06.12.2030 is foreseen.
• Important entities: supervision only on cause, for example after indications or incidents.

That evidence comes later for most entities does not change the fact that the duties have applied since 06.12.2025. The documentation under §30(1) is what you will then present.

For breaches of §30 and §32: essential entities up to €10 million, important entities up to €7 million. If total worldwide turnover exceeds €500 million, the cap can instead be 2% or 1.4% of it. Breaches of the registration duty up to €500,000. No proceedings have been publicly documented to date. Pressure currently comes mostly from customer contracts, supplier questionnaires and insurers.

• Scope checked and documented, including group view.
• Registration in the BSI portal done, owners for change notifications named.
• Risk analysis and security concept in place.
• Incident process with a 24-hour, 72-hour and one-month reporting chain, including out-of-hours availability.
• Backup, recovery and crisis management planned and tested.
• Supplier register with classification and security requirements in contracts.
• Secure development, patch and vulnerability management defined and evidenced.
• Effectiveness of measures assessed regularly.
• Training for staff and management delivered and documented.
• Cryptography concept, access control, asset management and MFA implemented.
• For entity types under Regulation 2024/2690: its requirements checked against your own position.
• All of the above documented, with dates and owners.

A certificate. "NIS2 certified" or a private NIS2 seal is not legal evidence. ISO 27001 certification helps as a structure and covers many measures, but it replaces neither the reporting chain under §32 nor the management duties under §38.