The study "Cybersecurity in Figures" by G Data, Statista and Brand Eins found that 25 percent of German companies are still at the beginning.

Current surveys paint a worrying picture of the implementation status of NIS2. The study "Cybersicherheit in Zahlen" by G Data, Statista and Brand Eins found that 25 percent of German companies are still at the beginning. It is likely that the real number will be even higher, because, in the words of Bernd Stromberg, the answer "Joa, läuft" is a response often given when asked for more details.

On 13 November 2025, the Bundestag approved the implementation of the directive into German law. Once the Bundesrat has also given its approval, NIS2 will come into force. The directive will therefore catch many affected companies off guard. This is largely due to the fact that resources are severely limited in SMEs and no one sends letters with content such as "Attention, you are subject to NIS2". Companies must find this out for themselves. To this end, the Federal Office for Information Security (BSI) has published a useful affected party check. (LINK)

If you know you are subject to NIS2, have limited resources but want to act strategically and avoid starting from scratch, you can take six steps based on the "Doing is better than waiting" principle.

You need to be aware that NIS2 includes a major proactive, self-organisational component. NIS2 obliges companies to significantly strengthen their (IT) security, report incidents and make protective measures verifiable. In other words, NIS2 does not ask whether you have everything in place, but whether you can prove it.

A key aspect of the directive is to force companies to stop treating security as a purely IT issue. In practice, much of the responsibility will fall on IT departments, but as potential sanctions include personal liability for management, NIS2 is literally a matter for the boss.

So if there is one thing you need to start doing now, it is to think about the process organisation for implementation. Ultimately, you need to establish risk management, introduce business continuity and be able to report security incidents at lightning speed.

This article shows you a pragmatic way to get started in six steps without any detours.

The six steps: Compact and practical

1) Clarify affected scope

Check again on the BSI website to confirm whether you truly fall within the scope. This ensures everyone understands why NIS2 is a priority. If the result is “yes,” the next step is to raise awareness among the necessary committees.

2) Who needs to be involved?

The executive management must definitely be involved. If you have a Chief Information Security Officer – Head of Information Security (CISO) or a similar role, this person must also be included. You should also raise awareness among IT/OT teams. If someone is already responsible for Business Continuity Management (BCM), include them as well. Finally, involve the legal department. This setup must be capable of steering the NIS2 implementation.

3) Reporting incidents

Authorities will not tolerate any delays when it comes to incident reporting: incidents must be reported immediately within 24 hours as an early warning. After 72 hours, an incident report must be submitted, and a final report is due after 30 days. Registering in the reporting portal is the lesser challenge. The real task is to coordinate and create templates and approval processes.

What you should set up now:

• Incident Standard Operating Procedure – Standard Operating Procedure (SOP) (one-pager per level), contact list, BSI reporting procedure.

• Tabletop Exercise – scenario-based tabletop exercise (60–90 min) to identify gaps before they become critical.

4) Start risk management & business continuity (BCM)

Risk management: What does it mean?

You identify and assess risks (likelihood × impact), define treatments (avoid, reduce, transfer, accept) and consolidate everything in the risk register with owners and deadlines. Aggregation highlights priorities. Monitoring checks effectiveness. Reports inform management and specialist departments.

BCM: What does it mean?

You determine critical processes and dependencies, define Recovery Time Objective – maximum tolerable downtime (RTO)/Recovery Point Objective – maximum tolerable data loss (RPO), create Business Continuity Plan – emergency/contingency plan (BCP) and IT Disaster Recovery – IT restart after disruption (IT-DR) with clear roles and communication channels. Tabletop exercises and recovery tests identify gaps. Findings are fed back into the risk register. Continuous improvement keeps BCM effective.

5) Establish key performance indicator (KPI)