NIS2 Glossary

Annex 1 BSIG transposes Annex I of the NIS2 Directive into German law and covers seven sectors: energy (including electricity, district heating, fuels, gas), transport (air, rail, water, road), finance (banking, financial market infrastructures), health, water (drinking water, wastewater), digital infrastructure (including cloud computing, data centres, telecommunications, managed service providers) and space. Companies in these sectors are essential entities from 250 employees or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total (Section 28(1) BSIG), and important entities from 50 employees or more than EUR 10 million in both turnover and balance sheet total (Section 28(2) BSIG).

Annex 2 BSIG transposes Annex II of the NIS2 Directive and covers seven sectors: postal and courier services, waste management, manufacture and distribution of chemicals, production, processing and distribution of food, manufacturing (medical devices, computer and electronic products, electrical equipment, machinery, motor vehicles and parts, other transport equipment), digital providers (online marketplaces, online search engines, social networks) and research. Companies in these sectors are important entities from 50 employees or more than EUR 10 million in both annual turnover and balance sheet total (Section 28(2) BSIG). Section 28(1) BSIG provides for size-based classification as an essential entity only for Annex 1 sectors.

APTs are characterized by high technical maturity, targeted victim selection, and very long dwell times in the network, often months or years. Attackers rely on stealth (living off the land, legitimate tools), gradual privilege escalation, and targeted data exfiltration. Typical targets are critical infrastructures, government agencies, and companies with valuable intellectual property. The BSI IT Security Report documents APT activities regularly and names known actors such as APT28 or APT29. Detection requires modern capabilities (EDR, SIEM, threat hunting); classic antivirus is insufficient. For NIS2-regulated entities, APTs are the driving reason to invest in attack detection.

Asset management in the NIS2 context covers the complete inventory of all assets relevant to information security: hardware (servers, endpoints, network devices), software (applications, libraries, licenses), data (databases, files, backups), cloud services, and supplier relationships. Each asset is assigned an owner, a protection-needs classification, and ideally a link to business processes. Section 30(2)(1) BSIG explicitly names asset management as a mandatory measure. Without an up-to-date asset inventory, risk analysis (Section 30(1)) and vulnerability management (Section 30(2)(3)) cannot be performed reliably, because you can only protect what you know about. Tools range from Excel inventories to dedicated CMDBs.

The 3-2-1 rule sets a minimum requirement for effective data backup. Three copies include the original and two backups. Two different media reduce the risk of a single storage system failing technically. One copy is kept offsite or offline, ideally as cold storage or an air-gapped backup. This protects against ransomware attacks and site outages. BSI module CON.3 and EU Implementing Regulation 2024/2690 demand correspondingly robust backup strategies. Modern extensions such as 3-2-1-1-0 add an immutable copy and zero errors in restore tests.

BCM identifies critical business processes through a business impact analysis (BIA), evaluates outage scenarios, and establishes strategies for prevention, response, and recovery. It encompasses emergency planning, crisis management, IT service continuity, and supply chain resilience. ISO 22301 is the leading BCM standard. Section 30(2)(3) BSIG explicitly requires backup and crisis management. BCM is broader than IT emergency planning alone because it includes organizational dependencies, alternative sites, and crisis communication. Regular exercises are indispensable.

The BCP is the central output document of BCM and specifies which processes are maintained or restored, with which resources, and within what time. It contains roles and responsibilities, escalation paths, RTO/RPO/MTPD per process, and integration with the IT emergency manual and crisis communication. The BCP is approved by executive management and reviewed at least annually. Unlike a pure IR plan (which addresses specific cyberattacks), the BCP is business-process oriented rather than attack oriented.

The BIA is the structured method from Business Continuity Management (BCM) for determining which business processes are critical, how quickly they must be restored (RTO), how much data loss is tolerable (RPO), and from when a disruption becomes existential (MTPD). It is carried out via interviews with business units, process documentation, and damage projection. Section 30(2)(3) BSIG mandates appropriate backup and recovery procedures, which cannot be planned without a BIA basis. A BIA is not a one-time document: it is updated annually or on demand, for example after major process changes or new IT systems. ISO 22301 and BSI Standard 200-4 describe the methodology in detail.

The Federal Office for Information Security, headquartered in Bonn, is the central cybersecurity authority in Germany. The NIS2UmsuCG significantly expanded its tasks: supervision of around 29,000 essential and important entities, operation of the registration portal, receipt of reports under Section 32 BSIG, and issuing fines up to EUR 10 million under Section 65 BSIG. The BSI also acts as the national CSIRT and provides technical support as well as situation reports. Important distinction: BSI is the authority, BSIG is the law.

The Cloud Computing Compliance Criteria Catalogue (BSI C5) was published in 2016 and substantially revised in 2020. It defines 121 requirements in 17 topic areas, including information security organization, identity and access management, cryptography, security testing, and encrypted communication. Cloud providers typically demonstrate compliance through ISAE 3000 or IDW PS 951 assurance reports. In the NIS2 context, C5 is the most practically important tool for supplier audits of cloud providers. A valid C5 report substantially eases compliance with the obligations under Section 30(2)(4) BSIG (supply chain security) but does not replace an entity's own risk assessment of cloud use.

BSI IT-Grundschutz is a systematic approach to information security comprising BSI Standards 200-1 (ISMS), 200-2 (methodology), 200-3 (risk analysis), and the IT-Grundschutz Compendium with around 100 modules. Modules cover topics such as applications (APP), industrial IT (IND), infrastructure (INF), networks (NET), operations (OPS), organization (ORP), and concepts (CON). Concrete examples include CON.3 (backup concept), OPS.1.1.5 (logging), or NET.1.1 (network architecture). The methodology is compatible with ISO/IEC 27001 and is widely established in Germany. A Grundschutz certification is recognized as proof under Section 39 BSIG.

The BSI Act is the central legal basis for the German Federal Office for Information Security. It defines supervisory, advisory, and enforcement powers and was significantly expanded by the NIS2UmsuCG. Since 6 December 2025, the BSIG contains the obligation catalogues for essential and important entities, including registration, risk management (Section 30), and reporting duties (Section 32). The BSIG therefore forms the German legal framework for the NIS2 transposition.

Chain of custody records, for each piece of evidence, who received, stored, or handed it over, when, and under what conditions. It is a prerequisite for digital evidence to be accepted in court or by insurers. Content includes evidence ID, timestamps, responsible persons, storage location, and checksums (hashes). BSI module CON.6 and the international standard ISO/IEC 27037 describe the requirements in detail. In the NIS2 context, chain of custody is a central element of the forensic phase in the IR plan and of post-incident documentation.

The Chief Information Security Officer manages the information security program at a strategic level and typically reports to the board or executive management. While the German "ISB" tends to be a more operational role, the CISO has explicit management and budget responsibility. In larger companies, ISO and CISO may exist in parallel; in SMEs, the roles are often combined. Under NIS2, executive management remains personally liable (Section 38 BSIG) regardless of whether a CISO is appointed.

Cold storage is the consistent implementation of the offsite element of the 3-2-1 rule. Backups are not permanently online but are held on tape, external disks, WORM storage, or dedicated cloud tiers. This particularly protects against ransomware attacks that would also encrypt online-accessible backups. BSI module CON.3.A4 and EU Implementing Regulation 2024/2690 require recovery capabilities even when the production environment is compromised. Crucially, restore tests must be performed regularly: cold storage without verified restore capability is not effective protection. Immutable storage and object lock are modern variants.

Concentration risks arise when critical business processes depend on a single provider, cloud region, or service. If that one fails, no rapid alternative exists. Section 30(2)(4) BSIG mandates supply chain security and implicitly requires active management of such risks. EU Implementing Regulation 2024/2690 explicitly recognizes concentration risks as a relevant factor for digital infrastructure providers. Mitigation includes multi-vendor strategies, documented exit plans, multi-cloud architectures, and contractual availability commitments with fallback scenarios.

The Cyber Resilience Act (EU Regulation 2024/2847) was adopted in November 2024 and applies with transition periods from 2027. Where NIS2 regulates the cybersecurity of entities, the CRA regulates the cybersecurity of products themselves: software providers and manufacturers of connected devices must demonstrate security-by-design, report vulnerabilities within 24 hours of disclosure, and deliver security updates throughout the product lifecycle. Particularly relevant for NIS2-regulated entities: CRA-compliant products ease supply chain security under Section 30(2)(4) BSIG, because they verifiably meet minimum requirements.

Computer Security Incident Response Teams are organisational units that coordinate the technical and operational response to cybersecurity incidents. Under NIS2, each member state must designate at least one national CSIRT. In Germany this is the BSI (Section 5 BSIG). Sectoral CSIRTs exist alongside, including CERT-Bund (public administration), DFN-CERT (academia), and BSI-CERT (critical infrastructure). For NIS2-regulated entities, the CSIRT is relevant on two paths: first, as recipient of the Section 32 reports (24-hour early warning, 72-hour full report); second, as a provider of threat intelligence, warnings, and recommended actions.

The Common Vulnerability Scoring System is an industry standard from FIRST.org for rating the criticality of vulnerabilities. Scores are divided into four classes: low (0.1-3.9), medium (4.0-6.9), high (7.0-8.9), and critical (9.0-10.0). The rating is based on factors such as attack vector, complexity, and impact on confidentiality, integrity, and availability. Current versions are CVSS v3.1 and v4.0. Section 30(2)(5) BSIG demands appropriate vulnerability handling; CVSS scores are the standard input for SLA-driven patch processes. CVE databases such as the NVD typically publish scores within days of disclosure.

DDoS attacks deliberately flood servers, applications, or network components with traffic so that legitimate requests can no longer be processed. Sources are often botnets of compromised devices. Types include volumetric attacks (bandwidth floods), protocol attacks (e.g. SYN flood), and application-layer attacks (e.g. HTTP flood). Mitigation relies on specialized anti-DDoS providers, rate limiting, anycast networks, and web application firewalls. Depending on impact, a DDoS incident may be reportable under Section 32 BSIG if it causes serious operational disruption. For digital infrastructure providers and KRITIS operators, DDoS protection is part of baseline defense.

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied directly in all member states since 17 January 2025. DORA addresses banks, insurers, investment firms, and other financial actors as well as their critical ICT providers. Its scope covers ICT risk management, incident reporting, digital resilience testing (including TLPT), and third-party risk management. For actors in scope, DORA acts as lex specialis and partially supersedes the NIS2 obligations. In case of doubt, careful assessment is required, because many financial firms still provide NIS2-relevant services. DORA is an EU regulation, not a directive.

The data protection officer must be designated under Article 37 GDPR when data processing is core-business and large-scale, or special data categories are involved. In the NIS2 context, an important interface with the information security officer (ISB) emerges: for incidents that are both data breaches (Article 33 GDPR) and significant security incidents (Section 32 BSIG), the DPO and ISB coordinate the dual report to the data protection authority and the BSI. The two roles can be staffed by the same person but must be functionally separated: the DPO focuses on data protection, the ISB on information security. In larger organisations they are typically staffed separately.

EDR solutions continuously monitor endpoints (servers, clients, mobile devices), record telemetry, and detect anomalies using behavior-based analytics. Compared to classic antivirus, EDR focuses on detection, investigation, and response to active attacks. EDR is a central building block of modern attack detection and supports the obligations under Section 30(2)(2) BSIG (incident handling). XDR solutions extend EDR with telemetry from network, email, and cloud. For KRITIS operators, the use of attack detection systems may be legally mandatory.

Encryption covers symmetric (e.g., AES-256) and asymmetric (e.g., RSA, ECC) methods for ensuring data confidentiality. Section 30(2)(8) BSIG mandates cryptographic concepts and procedures, including key management. Relevant application areas are disk encryption (e.g., BitLocker, LUKS), communication (TLS, VPN), backups (especially in cold storage), and particularly sensitive databases. ENISA and the BSI publish annually updated recommendations on minimally secure algorithms and key lengths. Important in the NIS2 context: encryption does not replace access control but supplements it as a second line of defence.

The European Union Agency for Cybersecurity, headquartered in Athens and Heraklion, is the EU's central cybersecurity agency. It is named repeatedly in the NIS2 Directive (EU 2022/2555) and plays a coordinating role between national supervisory authorities including the BSI. ENISA publishes threat landscape reports, guidelines on interpreting NIS2 terms such as "significant incident", and technical recommendations on minimum measures. For NIS2-regulated entities, ENISA documents are an important source because they reflect the EU-wide interpretation of the Directive before it flows into national supervisory practice.

Essential entities are defined in Section 28(1) BSIG. They include operators of critical installations, qualified trust service providers, top-level domain name registries and DNS service providers (each regardless of size), providers of public telecommunications networks or services with at least 50 employees or more than EUR 10 million in both turnover and balance sheet total, and companies in the sectors of Annex 1 BSIG with at least 250 employees or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total. Size is determined according to SME Recommendation 2003/361/EC (Section 28(4) BSIG). The BSI may order essential entities to undergo audits, inspections or certifications by independent bodies (Section 61 BSIG). Fines for breaches of Section 30 or 32 reach up to EUR 10 million, or up to 2% of worldwide turnover for companies with a total turnover above EUR 500 million (Section 65 BSIG).

EU Implementing Regulation 2024/2690 was adopted by the European Commission on 17 October 2024 and applies directly in all member states. It specifies NIS2 requirements for digital service providers, in particular DNS service providers, TLD name registries, cloud providers, data centres, content delivery networks, managed service providers, and online marketplaces. The regulation defines concrete thresholds (e.g. user counts, outage durations) above which an incident counts as significant and must be reported. Because it is a regulation rather than a directive, it applies directly and required no German transposition. It is supplemented by Section 32 BSIG for sectors outside digital infrastructure.

The GDPR has applied since 25 May 2018 and protects personal data. Three interfaces with NIS2 matter: first, the dual reporting duty when data breaches are also significant security incidents (Article 33 GDPR to the data protection authority within 72 hours and Section 32 BSIG to the BSI within 24 hours); second, the role distinction between data protection officer (DPO) under Article 37 GDPR and information security officer (ISB) under BSIG; third, the parallel fine regimes (GDPR up to EUR 20 million or 4% of turnover, NIS2 up to EUR 10 million or 2%). For combined violations, both sanctions can accumulate.

Important entities are defined in Section 28(2) BSIG: companies in the sectors of Annexes 1 and 2 BSIG with at least 50 employees or more than EUR 10 million in both annual turnover and balance sheet total, unless they already qualify as essential entities, plus trust service providers and smaller telecommunications providers. The risk management measures under Section 30, the reporting duty under Section 32, registration under Section 33 and the management duties under Section 38 BSIG apply as they do to essential entities. The differences lie in supervision and fines: the BSI inspects important entities when facts justify the assumption of a breach (Section 62 BSIG). Fines for breaches of Section 30 or 32 reach up to EUR 7 million, or up to 1.4% of worldwide turnover for companies with a total turnover above EUR 500 million (Section 65 BSIG).

The term does not appear in the law but describes a common situation. Entities covered by NIS2 must ensure supply chain security under Section 30(2) no. 4 BSIG, including their relationships with direct suppliers and service providers. This leads to security questionnaires, evidence requests and contract clauses for suppliers, even if they have no registration or reporting obligation under the BSIG themselves. The statutory obligations rest with the customer; what the supplier commits to is determined by the respective contract.

Insider threats arise from people who already have legitimate access to systems or data. Causes range from intentional data theft to negligence to extortion. Privileged accounts, departing employees, and external service providers are particularly critical. BSI module ORP.2 and Section 30(2)(7) BSIG (awareness and personnel security) address this risk area. Effective mitigation combines technical, organizational, and personnel measures: least privilege, regular access reviews, consistent offboarding, awareness training, segregation of duties, and where appropriate monitoring of privileged activity. Background checks for security-sensitive positions are also reasonable.

The IR plan structures incident handling typically in six phases: preparation, detection, containment, eradication, recovery, and post-incident review. It contains roles, escalation chains with response times, an internal and external communication plan, and integration with the reporting process under Section 32 BSIG. Section 30(2)(2) BSIG mandates appropriate incident handling, for which a documented and exercised IR plan is considered an essential component. Tabletop exercises, lessons-learned reviews, and regular updates are vital.

An information security management system defines the roles, processes, policies, and controls used to manage and continuously improve information security. It follows a PDCA cycle (plan-do-check-act) and rests on structured risk management. ISO/IEC 27001 is the leading international standard, while BSI IT-Grundschutz is the German alternative. NIS2 does not require a certified ISMS, but Section 30 BSIG can in practice only be fulfilled through an ISMS-like approach. Existing ISO 27001 or IT-Grundschutz structures map well onto Section 30.

The ISO plans, coordinates, and oversees the implementation of information security, reporting directly to executive management. In the context of Section 30 BSIG, a clearly designated security responsibility is effectively mandatory, even though the BSIG does not explicitly use the term "ISO". BSI IT-Grundschutz describes the role in detail in module ISMS.1. The ISO must be free of conflicts of interest with operational IT responsibility and requires adequate resources.

ISO 22301:2019 defines requirements for a business continuity management system. It covers the phases of planning, implementation, operation, evaluation, and improvement according to the PDCA cycle. Core elements are business impact analysis (BIA), risk assessment, strategies for maintaining critical processes, emergency plans, exercises, and continuous improvement. ISO 22301 is closely tied to RTO, RPO, and MTPD. In the NIS2 context, ISO 22301 provides the methodological framework for the obligation under Section 30(2)(3) BSIG (backup and crisis management). Certification is not mandatory but considerably eases proof to customers and supervisors.

ISO/IEC 27001:2022 is the world-leading standard for ISMS and defines requirements for setup, operation, and continuous improvement. Annex A lists 93 controls across four themes: organizational, people, physical, and technological. Certification is performed by accredited bodies and is valid for three years, with annual surveillance audits. In the NIS2 context, ISO 27001 covers an estimated 60-70 percent of the requirements in Section 30 BSIG. Topics such as sector-specific reporting duties, NIS2-style supply chain risks, and executive training must be added. An existing certification is recognized as proof under Section 39 BSIG.

The term "Critical Infrastructures" originates from German IT security law and denotes installations of major importance for the functioning of society. With the NIS2UmsuCG, the existing KRITIS concept was integrated into the new NIS2 taxonomy (essential/important entities). Critical infrastructure operators in the narrow sense are now operators of critical installations under Section 28(1-5) BSIG and face additional obligations, including the use of attack detection systems. Thresholds continue to follow the KRITIS Regulation.

Least privilege is a fundamental principle of information security and complements the need-to-know principle. Users, services, and processes receive only the minimum permissions required. This limits the damage from compromised accounts and hinders lateral movement. Privileged accounts require additional safeguards such as just-in-time access, dedicated admin accounts, and MFA. Section 30 BSIG demands appropriate access controls and therefore implicitly least privilege. Effective implementation relies on RBAC, regular permission reviews, and consistent offboarding.

MFA combines factors from at least two of the three categories: knowledge (password), possession (smartphone, token), and inherence (biometrics). It significantly reduces the risk from stolen or guessed passwords. Section 30(2)(9) BSIG explicitly requires the use of MFA for access to important systems. In practice, FIDO2/passkeys, hardware tokens, and authenticator apps are preferable to SMS codes, as SMS is vulnerable to SIM swapping. Privileged accounts and remote access should always be protected by MFA.

The MTPD is a strategic BCM metric that marks the absolute breaking point of a business process. It is determined during the business impact analysis and by definition exceeds the RTO. The MTPD considers financial, regulatory, contractual, and reputational impacts over time. It is often equated with the maximum acceptable outage (MAO). Important: if an incident exceeds the MTPD, irreversible damage threatens, such as customer loss or insolvency. The gap between RTO and MTPD acts as a safety buffer for unexpected complications.

Several industries in Annex 2 BSIG are defined by NACE divisions, such as computer, electronic and optical products (26), electrical equipment (27), machinery (28), motor vehicles and parts (29) and other transport equipment (30). According to the BSI, at the division level used in the BSIG the NACE code is identical to the WZ number of the German classification of economic activities, 2008 edition (WZ 2008), which companies know from statistical reporting. What counts is the actual business activity; activities that are negligible in relation to the overall business may be disregarded under Section 28(3) BSIG.

Network segmentation divides networks into zones, for example office, production, server, and DMZ. Traffic between zones is controlled through firewalls or access control lists. Microsegmentation goes further and isolates individual workloads from each other. Section 30(2)(9) BSIG requires appropriate network security measures; BSI module NET.1.1 describes the requirements in detail. Segmentation is a core pillar of modern zero-trust architectures because it limits the damage from a successful initial breach. It is particularly important in OT environments, where production systems must be strictly separated from office networks.

The NIS2 Directive was adopted by the European Parliament and Council on 14 December 2022 and replaces the predecessor NIS1 Directive. It obliges all member states to introduce uniform cybersecurity requirements for important sectors and defines obligations for risk management, incident reporting, and supervision. The transposition deadline expired on 17 October 2024. Germany transposed the directive late through the NIS2UmsuCG, which has been in force since 6 December 2025. It is an EU directive, not a directly applicable regulation.

The NIS2 Implementation and Cybersecurity Strengthening Act was passed by the Bundestag on 13 November 2025 and published in the Federal Law Gazette on 5 December 2025. It transposes EU Directive 2022/2555 into German law, primarily by amending the BSI Act (BSIG). Around 29,000 to 30,000 companies in Germany now fall under cybersecurity regulation for the first time. The law distinguishes between essential entities, important entities, and operators of critical installations. The BSI registration deadline expired on 6 March 2026.

Patch management covers system inventory, vulnerability monitoring, risk assessment, testing, and controlled rollout. Defined service-level agreements specify the timeframes within which critical, high, and medium vulnerabilities must be remediated. Section 30(2)(5) BSIG requires appropriate measures for vulnerability handling and maintenance. BSI IT-Grundschutz describes patch management in detail in module OPS.1.1.3. In practice, out-of-band patches for zero-day vulnerabilities, an emergency patch process, and handling of OT/legacy systems are particularly challenging.

In RBAC, permissions are assigned to roles, and users gain access through their role memberships. The model simplifies administration in medium and large organizations and supports the least-privilege principle. RBAC also facilitates regular permission reviews (user access reviews), which Section 30 BSIG implicitly expects through the access control requirement. Clear role definitions, segregation of duties, and a documented onboarding/offboarding process are essential. More complex environments supplement RBAC with attribute-based models (ABAC).

The registration obligation under Section 33(1) BSIG applies to essential and important entities. No later than three months after an entity first or again qualifies as such, it submits to the BSI, among other things, its name and legal form, contact details including public IP address ranges, its sector under Annex 1 or 2 BSIG, the member states in which it provides services, and the competent supervisory authorities. Operators of critical installations provide additional information (Section 33(2)). Since the NIS2UmsuCG entered into force on 6 December 2025, the deadline for companies already in scope expired on 6 March 2026. If an entity fails to register, the BSI may register it itself (Section 33(3)).

Risk management in the sense of the NIS2 Directive and Section 30 BSIG denotes a continuous cycle of identifying, analysing, assessing, treating, and monitoring risks to the confidentiality, integrity, and availability of information and systems. Section 30(1) BSIG requires appropriate, proportionate technical, operational, and organisational measures that reflect the actual level of risk exposure. The ten mandatory areas under Section 30(2) are operational concretisations of this umbrella concept. Methodologically, risk management draws on ISO 27005, BSI Standard 200-3, or NIST SP 800-30. Documentation is critical: without traceable risk assessment, the measures are not audit-grade.

RCA goes beyond immediate symptoms and identifies the underlying technical, organizational, or human factors of an incident. Common methods include 5-why analysis, the Ishikawa (fishbone) diagram, and fault tree analysis. Section 32 BSIG requires the final report within one month to describe causes, mitigations, and potential cross-border impacts in detail. A thorough RCA is therefore a mandatory part of post-incident handling. It also provides the basis for lessons-learned reviews and continuous improvement of the ISMS.

The RPO defines the maximum age of data at the time of recovery and therefore drives backup frequency and replication strategy. A 15-minute RPO, for example, requires synchronous replication or high-frequency snapshots. It is set per critical process during the business impact analysis. The RPO is closely linked to the backup concept and the 3-2-1 principle (three copies, two media, one offsite). Section 30(2)(3) BSIG requires appropriate backup and recovery procedures, which cannot be reliably planned without clear RPO targets.

The RTO is defined per critical process during the business impact analysis. It drives investment decisions, for example regarding hot standby, cluster architectures, or cloud failover. A four-hour RTO generally requires more expensive solutions than a 24-hour RTO. Regular testing through emergency exercises is essential because theoretical RTO values can deviate from measured reality. RTO, RPO, and MTPD together form the core metrics of business continuity management.

Software Bills of Materials answer the question "What is in our software?". They list all direct and transitive dependencies with versions, licenses, and ideally hash sums. Standard formats are CycloneDX (OWASP) and SPDX (Linux Foundation). In the NIS2 context, SBOMs matter in two directions: first, for supply chain security under Section 30(2)(4) BSIG, because they make it possible to check immediately when a vulnerability is disclosed (e.g., Log4Shell, XZ backdoor) whether the organisation is affected; second, the Cyber Resilience Act (EU 2024/2847) explicitly mandates an SBOM for manufacturers of digital products. Tools for automated SBOM generation include Syft, CycloneDX-CLI, and Snyk.

Section 30 BSIG requires essential and important entities to implement appropriate and proportionate technical, operational, and organizational risk management measures. The provision lists ten mandatory areas, including risk management, incident handling, backups, supply chain security, vulnerability disclosure, cryptography, access control, and awareness training. The measures must follow the current state of the art and reflect the entity's actual risk exposure. Section 30 BSIG has been in force since 6 December 2025, with no transition period.

Section 32 BSIG requires essential and important entities to report significant security incidents (major incidents) via the BSI reporting portal. The reporting cascade is three-tiered: an early warning within 24 hours, a detailed initial report within 72 hours, and a final report within one month. Content includes the timing, impacts, suspected causes, mitigations taken, and potential cross-border effects. The deadline starts when the entity becomes aware during business hours. Failure to comply may result in fines. In practice, Section 32 BSIG requires a prepared reporting process, integrated into the IR plan.

Section 38 BSIG transfers cybersecurity responsibility directly to executive management. Board members and managing directors must approve the measures under Section 30 BSIG, oversee their implementation, and regularly train themselves on cybersecurity topics. The training obligation applies to executive management itself, not only to subordinate staff. Violations may lead to personal liability, for example for damages caused by inadequate oversight. The duty is non-delegable: appointing a CISO or ISO does not relieve management of ultimate responsibility. Section 38 is therefore a driver of boardroom engagement in cybersecurity.

Section 39 BSIG requires operators of critical installations to formally demonstrate the effectiveness of their security measures on a regular basis. The proof must be provided to the BSI at least every three years, for example through audits, certifications (e.g. ISO 27001), or equivalent assessment procedures. The duty primarily applies to KRITIS operators in the narrow sense. Essential and important entities without KRITIS status face comparable requirements, although under reactive supervision. In practice, Section 39 BSIG creates a permanent audit and documentation routine that must be tightly integrated with the ISMS.

Section 65 BSIG is the central penalty provision of the NIS2UmsuCG. For essential entities, fines reach up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher). For important entities, the cap is EUR 7 million or 1.4% of turnover. Sanctioned offences include failure to register, breach of the reporting obligations under Section 32 BSIG, and inadequate risk management measures under Section 30. Additional facts cover formal duty violations. The supervisory authority is the BSI. Management bodies can be personally liable in addition under Section 38 BSIG.

Awareness training in the NIS2 context consists of structured programmes to sensitise the workforce to phishing, social engineering, secure password use, removable media handling, reporting obligations for suspicious cases, and behaviour while working from home. Section 30(2)(7) BSIG explicitly mandates this. Training must be regular (at least annual), role-tailored (management differs from clerks), and complemented by practical elements such as phishing simulations. Vendors include KnowBe4, SoSafe, perseus, or G Data; in-house material is also possible. Evidence must be audit-grade: attendance lists, content, repetition dates. Management training under Section 38 BSIG is a separate, distinctly documented track.

Security Information and Event Management denotes platforms that centralise logs from servers, network devices, endpoints, and applications and search them with correlation rules. Common products include Splunk, Microsoft Sentinel, Elastic SIEM, and IBM QRadar; open source: Wazuh and Graylog. Section 30(2)(3) BSIG requires the handling of security incidents, which is hardly achievable without centralised log analysis. EU Implementing Regulation 2024/2690 specifies this for certain sectors. A SIEM is not an end in itself: it becomes effective only with a SOC or at least an on-call team that reviews the alerts and responds to Section 32-relevant incidents.

The definition is set out in Section 2 no. 11 BSIG: an incident is significant if it has caused or can cause severe operational disruption of the services or financial loss for the entity, or if it has affected or can affect other natural or legal persons by causing considerable material or non-material damage. For certain digital entity types (such as cloud providers, data centre services and managed service providers), Implementing Regulation (EU) 2024/2690 specifies the criteria. A significant incident triggers the reporting cascade under Section 32 BSIG: early initial report no later than 24 hours after becoming aware, an incident report with a first assessment no later than 72 hours, and a final report one month after that report. Reports go to the joint reporting office of the BSI and the BBK.

A Security Operations Center combines people, processes, and technology for continuous IT security monitoring. Core tasks include triaging SIEM alerts, classifying security incidents, initial containment, and handover to the incident response team. Models range from fully in-house through co-managed to fully managed SOC (MSSP). For SMEs subject to NIS2, a managed SOC is usually realistic, because building 24/7 staffing requires an investment beyond what a 3-8-person IT team can deliver. Section 30 BSIG does not explicitly mandate a SOC, yet without a SOC-like function the requirements on detection and handling are barely achievable.

Supply chain security covers identification of critical suppliers, risk-based assessment, contractual security requirements, monitoring during the contract term, and defined offboarding. Section 30(2) no. 4 BSIG requires essential and important entities to ensure supply chain security, including security-related aspects of the relationships with their direct suppliers or service providers. Under Article 21(3) of the NIS2 Directive, entities must take into account the specific vulnerabilities of each supplier and the overall quality of their products and cybersecurity practices. Suppliers that are not themselves covered by NIS2 therefore feel the obligation indirectly through questionnaires and contract clauses from their customers.

TLD name registries are organizations that administer top-level domains and coordinate domain registrations. In Germany, DENIC operates the .de domain. NIS2 explicitly assigns TLD name registries to the digital infrastructure sector (Annex 1) and treats them as essential entities regardless of company size. The reason is the central importance of DNS infrastructure for the internet. DNS service providers and qualified trust service providers are similarly covered regardless of size thresholds.

TLPT simulates attacks aligned with specific observed threat actors and uses current threat intelligence to test detection and response capabilities on production systems. TLPT goes beyond classic penetration testing because it addresses people, processes, and technology holistically. In the financial sector, TLPT is mandatory for certain actors under the EU DORA Regulation (TIBER-DE framework). In the NIS2 context, TLPT is not generally mandatory, but it can be useful as part of an appropriate effectiveness review of security measures, particularly for essential entities.

Vulnerability management under Section 30(2)(3) BSIG typically follows four phases: detection (through CVE monitoring, automated scans such as Nessus, OpenVAS, Qualys, and SBOM matching), assessment (with CVSS score and contextual risk), treatment (patching, workaround, documented risk acceptance), and verification (rescan after patching). Documented patch SLAs are essential: critical vulnerabilities typically within 7-14 days, high within 30 days, medium within 90 days. EU Implementing Regulation 2024/2690 specifies this for relevant sectors. Closely interlinked with asset management (you can only scan what is in inventory) and patch management (operational treatment).