Blog
Expert articles on NIS2, cybersecurity and compliance
News
PHP2Shell: What NIS2 Entities Need to Do Now
PHP2Shell (CVSS 9.2) alone does not trigger a reporting obligation. A significant incident does. What § 30 BSIG requires now and what applies to manufacturers under the CRA.
Oct 22, 20265 min.
Guide
CRA for Machinery: Which Connected Products Count?
Which connected machine components fall under the Cyber Resilience Act? PLCs, HMIs, gateways, the Machinery Regulation and smart meter gateways at a glance.
Oct 18, 202610 min.
News
Vienna Data Leak: Does NIS2 Apply to German Municipalities?
Attackers copied 26,000 documents from the City of Vienna. In Germany, core municipal administration is outside NIS2 scope, but municipal enterprises can be covered.
Oct 11, 20265 min.
Tips & Tricks
Am I Affected by the CRA? A Self-Check for Manufacturers
Does the Cyber Resilience Act apply to you? The free CRA Applicability Check uses 20 questions to clarify whether you are a manufacturer, importer or distributor.
Oct 11, 20268 min.
Guide
CRA Reporting: How Art. 14 Differs from Section 32 BSIG
Since 11 September 2026, manufacturers must report under Art. 14 CRA via the ENISA platform. Where it differs from § 32 BSIG, and why one incident can mean two reports.
Oct 5, 202610 min.
Guide
Cyber Resilience Act and NIS2: Do Both Apply to You?
Since 11 September 2026, manufacturers must report exploited vulnerabilities under the CRA. What this means for NIS2 entities, and why most IT managers are only indirectly affected.
Sep 30, 20268 min.
Guide
§65 BSIG: What Fine Tiers Apply to NIS2 Violations?
§65 BSIG tiers NIS2 fines into seven brackets, from EUR 100,000 to EUR 10 million or 2% of turnover. NIS2Compass explains the assessment criteria and real GDPR comparison cases.
Sep 27, 202612 min.
Guide
AI Agents in GRC Tools: Which Vendor Leads in 2026?
No clear leader has emerged among AI agents in GRC tools in 2026. NIS2Compass compares KaitoSec, Kertos, Athereon, Drata, and Vanta on features, NIS2 coverage, and price.
Sep 20, 202615 min.
News
Ransomware Attack on a Hospital: Which NIS2 Duties Apply?
A ransomware attack on Nipigon Hospital (Canada) knocked out lab and diagnostics. Which NIS2 duties (§§30, 32, 65 BSIG) apply to German hospitals.
Sep 17, 20265 min.
Guide
NIS2 Crisis Communication: What Role Does Telfo Play?
NIS2 requires crisis management and secure emergency communication under §30 BSIG: escalation matrix, redundant channels, crisis communication plan — plus where Telfo fits in.
Sep 8, 202610 min.
News
Rhysida Berlin Leak: Is Redistributing the Data a Crime?
Rhysida published Berlin government data after the city refused a ransom. Redistributing it is a crime under §202d StGB and §42 BDSG — the legal analysis, plus NIS2 lessons.
Sep 4, 20264 min.
Case Study
Blossom Health cyberattack: the extortion note landed in patients' inboxes
An extortionist sent his demand directly through Blossom Health's patient messaging. What is reported, what remains open, and which obligations would apply in Germany.
Aug 31, 202612 min.
Guide
Security Incident at a Service Provider: Who Reports to the BSI?
Why every affected NIS2 entity reports a cloud or MSP incident itself, when its own 24-hour deadline starts, and how providers can inform customers in time.
Aug 27, 20269 min.
Guide
Security Incident Logbook: Free Excel Template
Free Excel template: an ongoing register for every security incident in a given year, including non-reportable ones, with automatic §32 BSIG deadline calculation.
Aug 23, 20264 min.
Guide
What Happens After You Report to the BSI?
What happens after a BSI report: acknowledgment of receipt, possible audit, customer notification duty — and why you can't withdraw it.
Aug 20, 20267 min.
Guide
NIS2 Reporting Templates: §32 BSIG Notification Stages
The three §32 BSIG notification stages (early warning, initial notification, final report) with fully worded sample texts for ransomware, data exfiltration, and DDoS, ready to adapt.
Aug 9, 202612 min.
Guide
When Is a Security Incident Reportable? (§ 32 BSIG)
A significant security incident under § 2 no. 11 BSIG: when you have to report to the BSI, and why the 500,000 euro threshold binds only eleven types of digital service provider.
Aug 2, 20269 min.
Tips & Tricks
Management Self-Check under Section 38 BSIG: The Free Excel Template
Free Management Self-Check under Section 38 BSIG as an Excel template: 20 yes/no questions, 5 sections, traffic-light status, no email gate.
Jul 27, 20266 min.
Guide
NIS2 Guide: How 8 Chapters Lead to Compliance
The NIS2Compass NIS2 Guide walks you through 8 chapters, from registration to training, toward NIS2 compliance. What each chapter covers and how templates help.
Jul 26, 202610 min.
Guide
The Best ISMS Tool to Kick Off Strong After the 2026 Summer Lull
A comparison of the six leading ISMS tools for 2026: KaitoSec, Kertos, Vanta, Grasp, Athereon, and HiScout, with guidance on which tool fits which company profile.
Jul 25, 202611 min.
Guide
What Is the NIS2UmsuCG? Germany's NIS2 Law Explained
The NIS2UmsuCG has been in force since December 2025 and obligates more than 29,000 companies. What Germany's law regulates, who it affects, and how it differs from the EU Directive.
Jul 22, 20269 min.
Guide
NIS2 ISO 27001 Mapping: Excel Checklist Download
ISO 27001 covers approximately 70% of NIS2 requirements. The mapping Excel shows at a glance what is already covered — and where the regulatory gap remains.
Jul 1, 20266 min.
Guide
NIS2 BSI Registration: Missed the Deadline — What Now?
The statutory NIS2 registration deadline has expired, but the BSI is granting an extended deadline until 31 July 2026. How to complete your registration in the BSI portal step by step.
Jun 22, 20269 min.
Guide
NIS2 Checklist as an Excel Template: the 10 §30 Obligations
A NIS2 checklist translates the 10 minimum measures from §30 BSIG into trackable tasks. An Excel template is the most pragmatic format for this: structured, filterable, and free of specialised software. NIS2Compass provides this framework along with the templates. Where you stand today and which of the ten obligations are still open is shown in minutes by the free Pre-Check.
Jun 15, 20268 min.
Guide
Implementing NIS2 Without a Consultant: A Guide for SMEs
Implementing NIS2 without a consultant: SMEs handle around 80% of the §30 BSIG duties on their own. The five phases, the realistic effort, and when external help is genuinely needed.
Jun 10, 20268 min.
Guide
NIS2 Management Liability: §38 BSIG Explained
§38 BSIG holds management personally accountable. The three duties, when personal liability applies, and how IT managers can convince the management body.
Jun 3, 20269 min.
Industry Update
NIS2 Risk Zone 2026: Which Sectors Need to Catch Up
ENISA NIS360 2026: 8 NIS2 sectors are in the risk zone – including space, maritime economy, and healthcare. What this means for your organisation.
Jun 1, 20267 min.
Guide
What Does External NIS2 Consulting Really Cost? Costs, Models and Alternatives
What does external NIS2 consulting cost? A consulting day averages 1,300 EUR (BDU), the full implementation about 70,000 EUR per company. NIS2Compass costs a fraction from 29 EUR/month.
May 30, 20269 min.
Guide
Employees as the Biggest NIS2 Risk: BSI Monitor 2026
The BSI Cybersicherheitsmonitor 2026 shows only 14 percent of people inform themselves regularly about cybersecurity. What §30 (2) No. 7 and §38 (3) BSIG mean for SMEs — and how a BSI-compliant awareness program is built.
May 27, 20269 min.
Guide
BSI IT-Grundschutz and NIS2: Which Modules Help?
BSI IT-Grundschutz covers about 80% of §30 BSIG requirements — from the same institution. But registration, reporting and §38 liability remain open.
May 26, 20269 min.
Guide
Do I Need an ISMS for NIS2? Mandatory or Optional
NIS2 does not require an ISMS or ISO 27001 certification. What the BSI actually demands, which structures §30 BSIG requires, and what SMEs need to know.
May 11, 20269 min.
Guide
NIS2 Advisor or Digital Platform: Which Fits Your SME?
NIS2 compliance: digital platform or external consultant? An honest comparison with costs, scenarios, and a clear decision guide for SMEs.
May 4, 20268 min.
Guide
NIS2 Incident Reporting: When, What, and to Whom?
Three-stage NIS2 reporting: early warning (24h), initial notification (72h), final report (1 month). Who reports what to whom — and what fines apply for violations?
Apr 27, 20269 min.
Guide
NIS2 Compliance: What Does Implementation Really Cost?
NIS2 compliance costs SMEs EUR 20,000 to 80,000 in year one. What you'll spend on staff, consulting, and technology — three realistic scenarios for mid-market companies.
Apr 21, 202610 min.
Guide
NIS2 with Vanta or Drata: What ISMS Tools Don't Cover
Vanta, Drata, and others offer NIS2 modules — but the German NIS2UmsuCG requires more. Learn which gaps remain and how NIS2Compass bridges them.
Apr 13, 20268 min.
Guide
NIS2 Simply Explained: What IT Managers Need to Know
NIS2 without legal jargon: what the directive means, who it affects, what obligations apply, and how IT managers can get started.
Apr 10, 20269 min.
Guide
Is ISO 27001 Enough for NIS2 Compliance?
No, says the BSI. ISO 27001 is a solid foundation, but scope freedom, risk acceptance, and §32/§38 BSIG duties remain open. How to close the gaps.
Apr 8, 202610 min.
Guide
Getting Started with NIS2: How to Begin Quickly and Correctly
The NIS2UmsuCG has been in force since December 2025. Check your scope, entity class, and BSI registration obligation — a practical entry guide for SMEs.
Apr 4, 20269 min.
Guide
NIS2 Compliance: A Step-by-Step Guide
Implement NIS2 compliance in 8 structured steps: From impact assessment through risk management and technical measures to security culture.
Apr 1, 20268 min.
Guide
NIS2 vs. ISO 27001: What Is the Difference?
ISO 27001 covers about 70% of NIS2 requirements — but not all. Where the gaps are, what §30 BSIG requires, and how companies can combine both.
Mar 26, 202610 min.
Guide
Am I Affected by NIS2? How to Check
Whether your company falls under NIS2 depends on sector and company size. 14 sectors, size thresholds and special cases — explained step by step.
Mar 25, 202610 min.
Guide
NIS2 Consultant or DIY? A Cost Comparison
An NIS2 consulting project costs SMEs EUR 50,000–150,000. Which parts you can handle yourself, where a consultant pays off, and how the hybrid approach works — with concrete numbers.
Mar 21, 20269 min.
Guide
NIS2 in Germany: What Do Companies Need to Know in 2026?
The NIS2 Implementation Act has been in force since December 2025. Around 29,500 companies in Germany must now comply with registration, reporting, and risk management obligations. Duties, deadlines, fines, and implementation — the complete overview.
Mar 19, 202610 min.
Guide
NIS2 and ISMS: What Your Existing System Doesn't Cover
ISMS tools manage controls and audits — but they don't provide a NIS2 implementation path. Why ISMS vendors upsell consulting, where the guidance gap lies, and how NIS2Compass fills it.
Mar 17, 20269 min.
Guide
NIS2 Fines: What Penalties Apply for Non-Compliance?
NIS2 violations can cost companies up to EUR 10 million or 2% of global annual turnover. Learn about fines for different violations, personal management liability, and what two practical scenarios reveal.
Mar 16, 20269 min.