NIS2 Glossary

All key terms around NIS2 and the BSIG, explained concisely — from KRITIS to MTPD.

This glossary explains 46 core NIS2 and BSIG terms in plain language, each with a reference to the relevant legal section or applicable standard (ISO 27001, ISO 22301, BSI IT-Grundschutz, DORA). Every entry includes a short definition for quick orientation and an in-depth explanation with implementation context. Terms can be filtered by six categories (Laws, Roles, Sectors, Technical, Processes, Metrics).

Written and reviewed by the NIS2Compass team · Last updated: April 2026

Filter by category

Filter by letter

62 terms

A

B

C

D

E

G

I

K

L

M

N

P

R

S

T

V

NIS2 Glossary

All key terms around NIS2 and the BSIG, explained concisely — from KRITIS to MTPD.

Written and reviewed by the NIS2Compass team · Last updated: April 2026

Filter by category

Filter by letter

62 terms

NIS2 Glossary

A

Annex 1 BSIGAnnex 1 BSIG lists the sectors of high criticality, including energy, transport, health, and digital infrastructure.

Annex 2 BSIGAnnex 2 BSIG lists other critical sectors such as postal services, waste management, chemicals, food, and digital providers.

APTAn advanced persistent threat (APT) is a sophisticated, long-running cyberattack, often carried out by state-sponsored actors.

Asset ManagementAsset management is the inventory and maintenance of all IT assets of an organisation. Section 30(2)(1) BSIG requires it as the foundation of NIS2 implementation.

B

3-2-1 Backup RuleThe 3-2-1 rule is a backup standard: three copies of the data, on two different media, with one stored offsite.

BCMBusiness continuity management (BCM) is the holistic process for maintaining critical business processes during disruptions.

BCPA business continuity plan (BCP) is the documented procedure for maintaining critical processes during a disruption.

BIAA Business Impact Analysis evaluates the impact of disruptions on business processes. It is the basis for BCM metrics such as RTO, RPO, and MTPD.

BSIThe BSI is Germany's federal cybersecurity authority. Under NIS2, it acts simultaneously as supervisory authority, reporting body, and CSIRT.

BSI C5BSI C5 is the BSI's assessment catalogue for cloud providers with 121 requirements and the de facto German standard for cloud supplier audits.

BSI IT-GrundschutzBSI IT-Grundschutz is the BSI's methodical framework with around 100 modules and a recognized NIS2 implementation method in Germany.

BSIGThe BSI Act (BSIG) governs the tasks and powers of the BSI. Since the NIS2 transposition it also contains the cybersecurity obligations for companies.

C

Chain of CustodyChain of custody is the gapless, court-admissible documentation of the collection, storage, and handover of digital evidence.

CISOThe CISO is the most senior executive in charge of information security in an organization and carries strategic responsibility.

Cold StorageCold storage refers to backups kept physically or logically separated from the network, such as an air-gapped copy.

Concentration RiskConcentration risk describes the dependency on a single supplier or service whose failure would have catastrophic consequences.

CRAThe Cyber Resilience Act is an EU regulation on cybersecurity obligations for manufacturers of digital products. It complements NIS2 on the product side.

CSIRTA CSIRT is a specialised team handling security incidents. The BSI is the national CSIRT for Germany.

CVSS ScoreThe CVSS score rates vulnerabilities on a standardized scale from 0.0 to 10.0 and forms the basis for patch prioritization.

D

DDoS AttackA DDoS attack is a distributed overload attack that knocks out services with massive request volumes from many sources.

DORADORA is the EU regulation on digital operational resilience for the financial sector and partially supersedes NIS2 for banks and insurers.

DPOThe data protection officer (DPO) is the role under Article 37 GDPR. In the NIS2 context, the DPO coordinates the dual reporting obligation with the ISB.

E

EDREndpoint detection and response (EDR) detects suspicious behavior on endpoints and enables a rapid response.

EncryptionEncryption protects data with cryptographic methods from unauthorised access. Section 30(2)(8) BSIG requires appropriate concepts and procedures.

ENISAENISA is the EU's cybersecurity agency. It publishes guidelines for interpreting the NIS2 Directive and supports national authorities.

Essential EntityAn essential entity (BWE) is a large organization in the highly critical NIS2 sectors subject to particularly strict supervision.

EU Implementing Regulation 2024/2690EU Implementing Regulation 2024/2690 specifies NIS2 for digital service providers and defines thresholds for significant incidents.

G

GDPRThe General Data Protection Regulation is the EU regulation protecting personal data. It interfaces with NIS2, especially regarding reporting obligations.

I

Important EntityAn important entity (WE) is a medium-sized organization in the NIS2 sectors subject to reactive supervision.

Insider ThreatAn insider threat is a security risk caused by current or former employees, or by external parties with legitimate access.

IR PlanAn incident response plan (IR plan) describes the structured procedure before, during, and after a security incident.

ISMSAn ISMS is a systematic framework for managing information security, for example according to ISO 27001 or BSI IT-Grundschutz.

ISOThe Information Security Officer (ISO) is the central role responsible for governing information security in an organization.

ISO 22301ISO 22301 is the international standard for business continuity management systems (BCMS) and complements NIS2 in the BCM/BCP area.

ISO 27001ISO 27001 is the international standard for information security management systems and covers about 60-70 percent of NIS2 requirements.

K

KRITISKRITIS refers to installations whose failure would jeopardize public services. Under NIS2, additional stricter obligations apply.

L

Least PrivilegeThe least-privilege principle grants only those permissions that are strictly required for a task, and no more.

M

Major IncidentA major incident is a reportable cyberattack or disruption with significant impact on services.

MFAMulti-factor authentication (MFA) requires at least two independent factors to grant access to a system.

MTPDThe maximum tolerable period of disruption (MTPD) is the longest time a disruption may last without existentially threatening the organization.

N

Network SegmentationNetwork segmentation is the logical and physical separation of networks to contain attacks and limit lateral movement.

NIS2 DirectiveThe NIS2 Directive (EU 2022/2555) is the EU framework for raising cybersecurity levels. It is transposed into German law by the NIS2UmsuCG.

NIS2UmsuCGThe NIS2UmsuCG is the German law transposing the EU NIS2 Directive. It entered into force on 6 December 2025 and amends the BSI Act.

P

Patch ManagementPatch management is the structured process for promptly identifying, assessing, and deploying security updates.

R

RBACRole-based access control (RBAC) assigns permissions through defined roles instead of directly to individual users.

Risk ManagementRisk management is the systematic identification, assessment, and handling of information security risks. It is the umbrella concept of Section 30 BSIG.

Root Cause AnalysisRoot cause analysis (RCA) is a structured method for determining the underlying cause of a security incident.

RPOThe recovery point objective (RPO) is the maximum amount of data loss that is acceptable in the event of a disruption.

RTOThe recovery time objective (RTO) is the maximum acceptable time within which a process or system must be available again after a disruption.

S

SBOMAn SBOM is a machine-readable list of all components in a software product, including open source libraries and their versions.

Section 30 BSIGSection 30 BSIG is the central provision defining the cybersecurity minimum measures that essential and important entities must implement under NIS2.

Section 32 BSIGSection 32 BSIG governs the reporting duties for significant security incidents with a three-step deadline: 24 hours, 72 hours, and one month.

Section 38 BSIGSection 38 BSIG establishes executive duties: approval of measures, training obligations, and personal liability for violations.

Section 39 BSIGSection 39 BSIG obliges operators of critical installations to demonstrate the effectiveness of their cybersecurity measures every three years.

Section 65 BSIGSection 65 BSIG sets out the fines for NIS2 violations. Essential entities can face fines of up to EUR 10 million or 2% of annual turnover.

Security Awareness TrainingAwareness training sensitises employees to cyber risks. Section 30(2)(7) BSIG mandates it as a required measure.

SIEMA SIEM collects log data from IT systems, correlates them, and alerts on suspicious patterns. It is the technical foundation for effective incident detection.

SOCA SOC is the organisational unit that monitors security alerts around the clock and responds to incidents. Together with the SIEM, it forms an organisation's detection capability.

Supply Chain SecuritySupply chain security is the management of cybersecurity risks arising from suppliers, service providers, and software dependencies.

T

TLD Name RegistryA TLD name registry operates the registration and management of a top-level domain (e.g. .de) and falls under NIS2 obligations.

TLPTThreat-led penetration testing (TLPT) consists of realistic red-team exercises based on current threat scenarios.

V

Vulnerability ManagementVulnerability management is the continuous process of identifying, assessing, treating, and verifying technical vulnerabilities. Section 30(2)(3) BSIG requires it.

NIS2 Glossary