NIS2 Compliance Guide: What Tech Teams Need to Do Now

NIS2 isn't a distant future – the EU Cybersecurity Directive is reality. And it affects far more companies than its predecessor: An estimated 30,000 companies in Germany alone must adapt.

This guide explains what NIS2 means, who is affected, and what concrete steps you need to take NOW.

What Is NIS2?

NIS2 (Network and Information Security Directive 2) is the revised EU directive on cybersecurity. It replaces NIS1 from 2016 and significantly tightens requirements.

The key changes:

Are You Affected?

The Sectors

NIS2 distinguishes between "essential" and "important" entities:

Essential Entities:

• Energy (electricity, gas, oil, hydrogen)
• Transport (air, rail, water, road)
• Banking
• Financial market infrastructure
• Healthcare
• Drinking water
• Wastewater
• Digital infrastructure
• ICT service management
• Public administration
• Space

Important Entities:

• Postal and courier services
• Waste management
• Chemicals
• Food
• Manufacturing (medical devices, computers, electronics, machinery, vehicles)
• Digital services (online marketplaces, search engines, social networks)
• Research

The Size Criteria

You are affected if your company is:

Medium-sized enterprise:

• 50-250 employees OR
• €10-50M annual revenue AND < €43M balance sheet total

Large enterprise:

• 250 employees OR

• €50M annual revenue OR > €43M balance sheet total

Exception: Some sectors are affected regardless of size (e.g., DNS providers, TLD registries, critical infrastructure).

Quick Check

The 10 Core Requirements

1. Risk Management

What NIS2 requires:

• Systematic risk analysis
• Documented risk assessments
• Regular review

Concrete measures:

1. Create asset inventory (all IT systems, data)
2. Conduct risk assessment
3. Maintain risk register
4. Quarterly review

2. Incident Handling

What NIS2 requires:

• Detection of security incidents
• Analysis and response
• Recovery processes

Concrete measures:

1. Implement Security Information & Event Management (SIEM)
2. Create incident response plan
3. Runbooks for common incidents
4. Regular exercises

3. Business Continuity

What NIS2 requires:

• Backup management
• Disaster recovery
• Crisis management

Concrete measures:

1. Conduct business impact analysis
2. Define backup strategy (3-2-1 rule)
3. Create disaster recovery plan
4. Conduct DR tests

4. Supply Chain Security

What NIS2 requires:

• Supplier security
• Risk assessment of service providers
• Contractual requirements

Concrete measures:

1. Create supplier inventory
2. Conduct security assessments
3. Add security clauses to contracts
4. Regular review

5. Network Security

What NIS2 requires:

• Secure procurement and development
• Vulnerability management
• Network segmentation

Concrete measures:

1. Implement secure development lifecycle
2. Introduce vulnerability scanning
3. Conduct penetration tests
4. Set up network segments

6. Cyber Hygiene

What NIS2 requires:

• Basic security measures
• Training
• Awareness programs

Concrete measures:

1. Security awareness training for all employees
2. Phishing simulations
3. Password policies
4. Regular updates

7. Cryptography

What NIS2 requires:

• Data encryption
• Crypto policies
• Key management

Concrete measures:

1. Encryption at-rest and in-transit
2. Create cryptography policy
3. Implement key management
4. Maintain crypto inventory

8. Access Controls

What NIS2 requires:

• Human resources security
• Access control policies
• Asset management

Concrete measures:

1. Implement Identity & Access Management (IAM)
2. Least privilege principle
3. Multi-factor authentication
4. Regular access reviews

9. Secure Communication

What NIS2 requires:

• Multi-factor authentication
• Secure voice, video, and text communication
• Secure emergency communication

Concrete measures:

1. MFA for all systems
2. End-to-end encryption
3. Secure collaboration tools
4. Emergency communication plan

10. Reporting Obligations

What NIS2 requires:

• Early warning within 24 hours
• Incident notification within 72 hours
• Final report within 1 month

Concrete measures:

1. Define reporting processes
2. Clarify responsibilities
3. Create templates
4. Test communication channels

Personal Liability of Management

This is new: Managing directors are personally liable for compliance.

What this means:

• Obligation to approve cybersecurity measures
• Obligation to monitor implementation
• Obligation to participate in training
• Personal liability for violations

Recommendation:

1. Establish board-level cybersecurity reporting
2. Regular security briefings for management
3. Documentation of all decisions
4. Review D&O insurance

The NIS2 Checklist

Immediate Measures (Priority: High)

• Check if affected (sector + size)
• Appoint responsible person (CISO or equivalent)
• Create asset inventory
• Conduct risk assessment
• Create incident response plan

Short-term (1-3 months)

• Gap analysis against NIS2 requirements
• Business impact analysis
• Supplier assessment
• Start security awareness training
• Define reporting processes

Medium-term (3-6 months)

• Implement technical measures
  • Deploy SIEM
  • Roll out MFA
  • Network segmentation
  • Implement backup strategy
• Document policies and processes
• Establish training program
• Update supplier contracts

Long-term (6-12 months)

• Continuous improvement
• Regular audits
• Penetration tests
• Exercises (incident response, DR)
• Pursue certifications (ISO 27001)

Costs and Resources

Typical Cost Factors

Personnel Requirements

Minimum for medium-sized company:

• 1 FTE for security (CISO/Security Manager)
• 0.5 FTE for compliance/documentation
• Training time for all employees

Penalties and Consequences

For essential entities:

• Up to €10 million OR
• 2% of global annual revenue

For important entities:

• Up to €7 million OR
• 1.4% of global annual revenue

Additionally:

• Personal liability of management
• Temporary professional ban for managers possible
• Reputational damage
• Possible operational prohibition

Next Steps

Week 1: Clarify Applicability

1. Check sector affiliation
2. Analyze size criteria
3. Obtain legal advice
4. Inform management

Week 2-4: Assess Status Quo

1. Create asset inventory
2. Document existing measures
3. Conduct gap analysis
4. Prioritize risks

Month 2-3: Implement Quick Wins

1. Create incident response plan
2. Define reporting processes
3. Start awareness training
4. Close critical gaps

Month 4-12: Systematic Implementation

1. Implement technical measures
2. Establish processes
3. Complete documentation
4. Conduct audits

Conclusion

NIS2 is not optional – it's mandatory. The good news: Many requirements already correspond to IT security best practices. Those who proceed systematically can achieve compliance while genuinely improving security.

The most important step: Start now. Don't wait.

Need support with NIS2 implementation? We help with gap analyses, roadmap creation, and technical implementation. Get in touch. Related: Zero Trust Security.