NIS2 requirements: measures, reporting obligations, checklist

Who is affected by NIS2

NIS2 distinguishes between essential and important entities in numerous sectors, including energy, transport, health, digital infrastructure, wastewater, public administration, postal services, waste management, chemicals, food and manufacturing. As a rule, size (50 or more employees, or more than EUR 10 million in annual turnover and balance sheet total) and sector are decisive; for some entities, NIS2 applies regardless of size. In Germany, affected companies must register with the BSI (Federal Office for Information Security).

Risk management measures under Art. 21

Art. 21 NIS2 requires appropriate technical, operational and organizational measures, including:

• Policies on risk analysis and information system security
• Incident handling
• Business continuity, backup management and crisis management
• Supply chain security
• Security in acquisition, development and maintenance, including vulnerability handling
• Assessing the effectiveness of the measures
• Cyber hygiene and training, cryptography, access control, multi-factor authentication

Reporting obligations: 24 hours, 72 hours, one month

Significant incidents must be reported in stages: an early warning within 24 hours, an incident notification within 72 hours with an initial assessment and a final report within one month. This only works if incidents are detected quickly and documented properly – the job of XMfortress Detect.

Management responsibility

Management must approve the measures, oversee their implementation and take part in training regularly. Its members can be held liable for breaches of duty. Violations can result in fines of up to EUR 10 million or 2% of worldwide annual turnover (essential entities) or EUR 7 million or 1.4% (important entities).

NIS2 checklist: the first steps

• Check whether you are affected and register with the BSI
• Appoint responsible persons, train management
• Build an asset inventory and keep it up to date
• Carry out a risk analysis, define a vulnerability process with deadlines
• Set up and rehearse incident detection and reporting channels
• Regularly test and document the effectiveness of measures
• Include suppliers and service providers in the assessment

XMfortress supports the technical implementation and provides evidence. Responsibility for compliance remains with the company; the platform does not replace a legal review.