FAQ

NIS2 (Network and Information Security Directive 2) is an EU directive that sets cybersecurity requirements for organizations in critical sectors. In Germany, it has been in force since December 6, 2025 as the NIS2UmsuCG, affecting over 29,000 companies. NIS2Compass guides you through all requirements as a structured companion.

The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) is the German transposition of the EU NIS2 Directive. It was passed by the German Parliament on November 13, 2025 and entered into force on December 6, 2025 — without any transition period.

NIS2 covers 18 critical sectors, divided into essential (Annex I) and important entities (Annex II). These include energy, health, drinking water, digital infrastructure, banking, transport, public administration, postal and courier services, waste management, chemicals, food, manufacturing, and research. The specific obligations depend on sector and organization size.

NIS2 thresholds apply from 50+ employees or €10M+ annual revenue in one of the 18 critical sectors. The NIS2Compass Vor-Check provides an initial applicability assessment in under 5 minutes — showing whether you qualify as an essential or important entity and which obligations apply.

KRITIS is the German regulation for critical infrastructures, while NIS2 is the EU-wide cybersecurity directive. With the KRITIS-Dachgesetz and the NIS2UmsuCG, both frameworks have been consolidated since December 2025. Companies previously covered by KRITIS remain affected — but the scope of NIS2 covers a significantly broader range of organizations (around 29,000 in Germany).

ISO 27001 is a voluntary international standard for information security management systems. NIS2 is a legal obligation with specific reporting duties and penalties. An ISO 27001 certification covers approximately 60–70% of NIS2 requirements — the NIS2Compass Guide shows you exactly which gaps remain.

BSI IT-Grundschutz is a well-established German standard for information security. An existing IT-Grundschutz implementation covers a large portion of NIS2 requirements — particularly in risk management, access control, and business continuity. NIS2Compass maps each §30 BSIG obligation to the relevant BSI building blocks, so existing work doesn't have to be duplicated.

DORA (Digital Operational Resilience Act) applies to financial entities such as banks, insurance companies and payment service providers. The German BSIG covers 14 sectors in two annexes, including the financial sector. For financial entities within the scope of DORA, Section 28(6) BSIG disapplies Sections 30, 31, 32, 35, 36, 38 and 39 BSIG, including risk management, incident reporting and management body obligations: here DORA takes precedence. Other BSIG obligations such as registration with the BSI still apply. IT service providers that are not financial entities themselves are not covered by this exemption and can be subject to NIS2 in their own right.

GDPR protects personal data, while NIS2 protects the availability and integrity of critical services. Both apply in parallel — a cyber incident involving a data breach triggers reporting obligations under both: 72 hours to the data protection authority (GDPR Art. 33) and 24/72 hours to the BSI (§32 BSIG). Existing GDPR compliance facilitates NIS2 but does not replace it.

Yes. NIS2Compass was designed specifically for SMBs with 30–250 employees — as a structured alternative to expensive consultants and complex enterprise tools. The Pro plan at €29/month provides everything you need for NIS2 compliance.

For significant security incidents, affected companies must submit an initial notification to the BSI within 24 hours, followed by a full report within 72 hours. The NIS2Compass Knowledge Hub explains the reporting process step by step.

Yes, all companies affected by NIS2 must register with the BSI. The BSI portal has been available since January 6, 2026, and the registration deadline expired on March 6, 2026. Companies that missed the deadline should register immediately.

Both. Companies face fines of up to €10 million. Additionally, management can be held personally liable if they neglect their supervisory duties. Under § 38 BSIG, executives must actively oversee the implementation of cybersecurity measures.

Essential entities face fines of up to €10 million or 2% of global annual turnover. Important entities can be fined up to €7 million or 1.4%. Additionally, management can be held personally liable. The NIS2Compass Knowledge Hub explains all penalty provisions in detail.

§30 BSIG defines 10 minimum measures: risk management, incident handling, business continuity, supply chain security, cyber hygiene and training, encryption, access control, multi-factor authentication, and vulnerability and patch management. The NIS2Compass Template Library provides Word and Excel templates for each area.

NIS2 does not mandate a formal ISMS, but requires measures across 10 areas — from risk management to incident handling to supply chain security — that effectively correspond to one. NIS2Compass guides you through all required measures as a structured companion, even without an existing ISMS.

Self-implementation is possible — and often the more cost-effective choice for SMBs. According to the BDU fee study 2025, external consultants charge an average of €1,300 per day (around €700–1,600 depending on seniority). NIS2Compass offers the same expertise, ready-made templates, and a structured implementation path for €29/month. Companies with internal resources looking for clear guidance rather than hourly consulting reach compliance faster with NIS2Compass.

According to the BDU fee study 2025, external consultants charge an average of €1,300 per day (around €700–1,600 depending on seniority) — a full project ranges from €10,000–30,000. NIS2Compass offers the Pro plan at €29/month as a structured alternative with all articles, templates, and the NIS2 Guide.

Implementation timelines depend on organization size and current security maturity and typically range from 6 to 18 months. NIS2Compass guides you through NIS2 step by step via a clear roadmap with 8 chapters — from applicability assessment to incident management.

The Vor-Check is a free gap analysis that assesses your current compliance status in under 5 minutes. Based on 16 questions about your existing security measures, it shows you which NIS2 requirements are already met and where action is needed.

Yes, you can cancel your subscription at any time from your account settings. You will retain access until the end of your current billing period.