NIS-2 Requirements in Information Security – What Has Applied to Companies Since December 2025

With the introduction of NIS-2, companies must comply with new cybersecurity standards. Those who fail to act now put their own security and competitiveness at risk and do not meet the legal requirements either. Use this opportunity to strengthen your systems and secure the trust of customers and partners. In this article, we explain in detail the new requirements, the extended scope and who is affected by the new NIS-2 requirements.

Table of contents:

• Since December 2025, the requirements of the NIS-2 Directive have applied to IT security
• New requirements for affected companies in the automotive industry
• Particularly important requirements that are new compared to ISO 27001
• The NIS-2 requirements bring new responsibilities for management and specific measures per sector

Since December 2025, the requirements of the NIS-2 Directive have applied in Germany

The NIS-2 Directive was adopted by the European Parliament in 2022; in Germany it has been in force since 6 December 2025 through the NIS-2 Implementation Act (NIS2UmsuCG). The competent supervisory authority is the Federal Office for Information Security (BSI): it receives registrations and incident reports and monitors compliance with the obligations under the new BSI Act (BSIG).

Affected companies must take a number of measures to meet the requirements of the directive. With NIS-2, these requirements apply to a broader range of sectors and represent extended obligations in the field of cybersecurity.

Who is affected?

• Essential entities: 250 or more employees, or more than €50 million annual turnover and more than €43 million balance sheet total.
• Important entities: 50 or more employees, or more than €10 million annual turnover and balance sheet total.

Both apply to companies in the sectors listed in Annexes 1 and 2 of the BSIG. You can check whether your company is affected with our NIS-2 checklist (in German).

Transposition into national law since December 2025

• Transposition deadline: The EU deadline for transposition expired on 17 October 2024. Germany transposed the directive into national law with the NIS-2 Implementation Act (NIS2UmsuCG) as of 6 December 2025. Since then, affected companies have had to comply with the stricter cybersecurity requirements – there is no grace period!
• Validity of the new rules: Since 6 December 2025, the security requirements have been binding in Germany for companies that fall within the scope of NIS-2 – including companies that were not affected by the original NIS Directive. Around 29,500 companies and institutions are affected. They must register with the BSI within three months of falling under NIS-2 (Sec. 33 BSIG; for most, this means by 6 March 2026). The BSI granted an extension until 31 July 2026; anyone who has not yet registered should do so immediately – violations can be fined up to €500,000 (Sec. 65 BSIG).

1) New requirements for affected companies in the automotive industry:

Extended reporting obligations for security incidents under the NIS-2 Directive:

Companies in the automotive industry must ensure that they report cyber incidents to the BSI quickly and effectively in order to ensure the effectiveness of their security strategies.

The BSI receives these reports, assesses them and, where necessary, coordinates the response to the security incident. It ensures that incidents are handled quickly and effectively to prevent greater damage.

The NIS-2 Directive requires incidents to be reported to the competent authorities within 24 hours of becoming aware of them. This covers not only the reporting of security incidents but also an initial assessment of the situation.

Within 72 hours, the actual incident notification follows with an initial assessment (severity, impact, indicators of compromise where applicable). A final report with the root cause, remedial measures taken and any cross-border impact is due no later than one month after that. This strict timeline ensures that threats can be detected and countered early to avoid greater damage.

Stricter information security requirements in the automotive industry

The NIS-2 Directive extends the security focus to all IT and OT (operational technology) systems used in the automotive sector.

This means that not only classic IT systems such as servers, networks and end devices must be protected, but also production systems. NIS-2 covers all IT and OT systems the company uses to provide its services – including production and control systems. The cybersecurity of the vehicles themselves, by contrast, is governed by UN Regulations R155/R156. You must ensure that all systems are checked for vulnerabilities and that regular security updates are carried out.

Supply chain management for critical infrastructure:

A central element of the NIS-2 Directive is securing the entire supply chain. Companies in the automotive industry work with numerous suppliers and service providers who may have access to sensitive data or critical infrastructure.

The directive requires companies to actively monitor the security of their supply chain and to ensure that all partners involved implement appropriate security measures. This can be done through contracts, audits and regular security assessments to improve cyber hygiene. A weak point at one supplier can potentially jeopardize the entire supply chain, which is why this topic is particularly important.

Risk management under Sec. 30 BSIG - NIS-2 requires constant monitoring in the automotive industry

As a company, you are obliged to implement and document appropriate, proportionate and effective risk management measures under Sec. 30 BSIG – tailored to the threats in the automotive sector.

Risks in the supply chain must be continuously monitored and managed to prevent security incidents. This means that risks to all IT and OT systems essential for operations and production must be regularly identified, assessed and mitigated.

This risk management must be dynamic and adapt to the constantly changing threat landscape. Companies are expected to develop processes that allow them to respond quickly to new risks. Their systems must be robust enough to fend off cyberattacks.

Clear accountability: management is liable, a specialist role steers implementation

By law, responsibility for implementing and monitoring the measures lies with management (Sec. 38 BSIG); it cannot delegate this. In practice, management appoints an operational role – such as a Chief Information Security Officer (CISO) or Information Security Officer (ISO) – who steers implementation and serves as a reachable contact for the BSI. Experienced consultants can also support this role.

This role also monitors compliance with the new requirements and is the contact person for the competent authorities. This person carries considerable responsibility, as violations of the directive can lead to substantial penalties.

Sanctions for non-compliance with NIS-2 requirements:

The NIS-2 Directive introduces stricter sanctions to ensure compliance with the security rules. For violations of the risk management, reporting or evidence obligations, essential entities face fines of up to €10 million or up to 2% of global annual turnover, and important entities up to €7 million or up to 1.4% (the percentage cap applies from €500 million turnover, Sec. 65 BSIG). Most automotive suppliers are important entities.

These high penalties are intended to motivate companies to take the requirements seriously and to take proactive measures to protect their systems. In addition, breaches of security standards can lead to reputational damage that could have serious long-term effects on the business, especially in a highly regulated sector.

2) Particularly important requirements that are new compared to ISO 27001

What NIS-2 actually requires beyond ISO 27001:

Threat analysis (threat intelligence) is already required by ISO/IEC 27001:2022 (Annex A 5.7). The real differences from ISO 27001 are: statutory reporting obligations (24 h/72 h/1 month), the obligation to register with the BSI, personal duties and mandatory training for management (Sec. 38 BSIG), no freely selectable scope, and official supervision with fines.

Obligations towards the BSI and voluntary information sharing

Registration, incident reports to the BSI and cooperation with supervisory measures are mandatory. Sharing threat information with other companies (e.g. via the Alliance for Cyber Security or UP KRITIS), by contrast, is voluntary.

Protection of critical services and systems:

The NIS-2 Directive requires companies to give special protection to critical services and systems and important entities that are of national interest. In the automotive sector, these could be, for example, systems required for the production of safety-relevant components or for the operation of autonomous vehicles, which should be protected by hardening measures such as multi-factor authentication.

These systems must be specially secured and monitored so that their integrity and availability are not jeopardized by cyberattacks. This often requires additional security measures that go beyond the basic requirements of ISO 27001.

Mandatory awareness training for employees and management

The NIS-2 Directive emphasizes the importance of regular and specific training for all employees. NIS-2 requires basic cybersecurity training and awareness measures (Sec. 30 (2) No. 7 BSIG) and additionally obliges management to attend regular training (Sec. 38 (3) BSIG). Sector-specific content is useful but not a legal requirement.

Employees must be informed not only about basic security principles but also about current threats and the correct response mechanisms in the event of incidents. This training must be updated regularly to reflect the latest developments in the cybersecurity landscape.

Documentation and evidence obligations towards the BSI

In addition to reporting significant incidents, you must document the implementation of your measures and demonstrate it to the BSI on request. Operators of critical facilities must additionally provide this evidence every three years without being asked (Sec. 39 BSIG).

Extended due diligence through reviewing suppliers' cybersecurity measures

The NIS-2 Directive introduces extended due diligence that goes beyond the requirements of ISO 27001. Companies are obliged to check not only their own systems but also those of their suppliers and service providers for security risks.

This requires close cooperation with everyone involved in the supply chain and the implementation of security standards at all levels. Companies are required to ensure that their partners implement similar security measures and that these measures are reviewed regularly. Our ISO 27001 consultants will be happy to help.

These detailed requirements show how NIS-2 is changing and strengthening the cybersecurity landscape for companies, especially in the automotive sector. Thorough implementation of this directive is essential to counter the growing threats in the connected world effectively. How to turn these obligations into a working program is shown in Implementing NIS-2 – step by step (in German).

The NIS-2 requirements bring new responsibilities for management and specific measures per sector

1. Extended scope and sector-specific requirements

• Extension to new sectors: The NIS-2 Directive extends the scope to more sectors than before. Newly affected are, for example, postal and courier services, waste management, chemicals, food, manufacturing (including manufacturers of medical devices, machinery and motor vehicles), digital service providers, research and the space sector.
• Sector-specific requirements: Every sector has its own specific cybersecurity challenges. Companies must develop sector-specific security measures tailored to their individual risks and threats.

2. Accountability at management level

• Management liability and responsibility: Senior management bears full responsibility for compliance with cybersecurity regulations. Executives must ensure that all requirements of the NIS-2 Directive are implemented in the company. Management must implement the risk management measures, monitor their implementation and regularly attend training (Sec. 38 BSIG). If it culpably breaches these duties, it is liable to the entity for the resulting damage.
• Introduction of governance structures: By introducing clear governance structures, companies define responsibilities for cybersecurity. This includes setting up cybersecurity committees and appointing persons responsible for implementing and monitoring the security measures.

3. Measures to increase resilience

• Resilience strategies: Companies are required to develop resilience strategies that go beyond protecting IT systems. These strategies must be designed so that the company remains able to act even after a cyberattack and can quickly return to normal operations.
• Business Continuity Management (BCM): Companies and organizations must develop plans to ensure that critical business processes can continue not only in the event of IT failures but in the event of all failures (electrical or other exceptional situations).

4. Technical and organizational measures

• Data encryption: Strong encryption technologies should be used to protect sensitive data both at rest and in transit. All critical data stored or transmitted in their systems must be secured with suitable encryption methods. This significantly reduces the risk of data loss or theft in the event of cyberattacks.
• Technical protective measures: Sec. 30 (2) BSIG sets out minimum measures; attack detection systems are only explicitly required for operators of critical facilities. The minimum measures include:
  • Risk analysis and security policies
  • Incident handling
  • Business continuity, backup management and crisis management
  • Supply chain security
  • Security in acquisition and development, including vulnerability management
  • Assessment of the effectiveness of the measures
  • Training and cyber hygiene
  • Cryptography and encryption
  • Human resources security, access control and asset management
  • Multi-factor authentication and secured communication
• Organizational measures: Organizational structures must be geared towards rapid response and effective handling of security incidents. This includes setting up incident response teams and conducting regular emergency drills.

5. International cooperation and information sharing

• Cooperation at EU level: Cooperation between EU member states (CSIRT network, Cooperation Group) concerns the authorities; what matters most for companies is that any cross-border impact of an incident must be stated in the incident report.

6. Extended documentation and evidence obligations

• Extended evidence obligations: Affected companies must maintain comprehensive documentation proving compliance with the NIS-2 requirements. This documentation must be updated regularly and submitted to the competent authorities when required.

7. Security requirements for cloud services and third-party providers

• Cloud security: There are clear requirements for the security of cloud services. The cloud solutions used must meet the highest security standards and be checked regularly for vulnerabilities.
• Third-party obligations: The security of the entire supply chain is crucial. Check regularly whether your third-party providers have also implemented the strict security measures.

8. New requirements for reporting and communication channels

• Procedures for reporting security incidents: Affected companies and organizations must establish clear and effective procedures for reporting security incidents. These procedures must be organized so that security incidents are reported quickly and completely to enable a timely response.
• Evidence on request: At the BSI's request, you must be able to demonstrate the implementation of your measures.

9. Alignment and integration with other security standards

• Integration with existing standards: Companies must adapt their security measures so that they meet the requirements of the NIS-2 Directive as well as other relevant standards such as ISO 27001 or TISAX®. This requires careful analysis and adaptation of existing processes. Use our NIS-2 checklist (in German).
• Harmonization of security processes: Companies should harmonize their cybersecurity processes to avoid redundancies and make it easier to comply with different standards. This leads to more efficient security operations and better compliance.

Book a free initial consultation