NIS2 for Municipal Utilities and Energy Providers

For the operation of energy supply networks and energy plants subject to §§5c–5e EnWG, §§30, 31, 32, 35, 36, 38 and 39 BSIG do not apply (§28 (5) BSIG). They are replaced by the BNetzA IT security catalog (§5c EnWG), documentation and incident notification (§5d EnWG) and the duties of the management body (§5e EnWG). Registration with the BSI under §33 BSIG still applies. If your utility runs further lines of business listed in Annex 1 or 2 BSIG, such as drinking water or wastewater, the BSIG applies to those activities. Document in writing which systems fall under which regime, especially where several lines of business share IT.

The central technical obligation for municipal utilities. The historical separation between office IT and OT control systems is not sufficient: NIS2 requires documented zones, default-deny policies and firewall rule sets for SCADA and meter networks. Note: under §28 (5) BSIG, the operation of energy supply networks and energy plants is governed by the BNetzA IT security catalog (§5c EnWG) instead of §30 BSIG. For other lines of business such as water or wastewater, §30 BSIG remains decisive.

24-hour early warning, 72-hour full notification, 1-month final report to the BSI. On order of the BSI, §35 BSIG may additionally require you to inform the recipients of your services. For network and plant operation, §5d (3) EnWG applies instead: same deadlines, notification to the BSI reporting office.

Management and supervisory boards must approve risk management measures, monitor implementation and participate in training. Personal liability for failure to supervise. For network and plant operation, §5e EnWG sets out the implementation, monitoring and training duties of the management body.

Network and plant operators document how they comply with the IT security catalog (§5d (1) EnWG). Network operators, and plant operators that are essential entities, submit this documentation to the BNetzA without undue delay after it is prepared. The BNetzA can demand a remediation plan, set deadlines for fixing security deficiencies and enter business and operating premises for inspection. Network operators that are neither important nor essential entities also had to register with the BSI by 6 March 2026 (§5d (4) EnWG).

Under §5c (1) sentence 2 EnWG, adequate protection must already be ensured when procuring plant equipment and services. For municipal utilities this means: security requirements belong in tenders, specifications and framework contracts for control and telecontrol systems and for maintenance service providers. Because such systems usually stay in operation for many years, gaps in procurement have long-lasting effects. Review ongoing tenders and upcoming contract renewals first.

If your utility operates a critical facility outside the energy sector, for example in drinking water supply, you demonstrate the measures for that facility to the BSI every three years through security audits, inspections or certifications (§39 (1) BSIG). The BSI sets the first date. Under §28 (5) BSIG, §39 BSIG does not apply to network and plant operation in the energy sector. There, the BNetzA reviews compliance on the basis of §5d EnWG.