The Network and Information Systems Security Directive (NIS 2 Directive for short) aims to improve cyber security in various sectors such as energy, transport, health and digital infrastructure. It places higher security requirements on companies, addresses supply chain security and holds di e managers accountable for breaches.
In addition to the critical sectors previously covered by the first NIS Directive (energy, transport, water, health, digital infrastructure and finance), providers of public electronic communication services and digital services, social media operators, manufacturers of critical products (e.g. medical devices) as well as postal and courier services must now also review and, if necessary, adapt their IT security measures. In addition, individual regulations also affect domain registrars as well as manufacturers of certain IT products requiring certification.
The risk management measures to be taken by the companies and operators concerned include the following:
The EU NIS2 Directive came into force in January 2023. Member states were required to transpose the regulations into national law by October 17, 2024.
This has now been done in most member states. The German NIS2 Implementation Act came into force on December 6, 2025, with a comprehensive reform of the BSI Act [BSIG - unofficial table of contents]. Since that date, all affected companies have been obliged to implement the requirements for a secure IT infrastructure that apply to them and are liable to fines for implementation gaps and errors.
The BSI's NIS2 portal has been online since January 6, 2026 [Login | BSI Portal], and affected companies must register there by March 6, 2026. Relevant security incidents must now be reported to the BSI via this portal within 24 hours of becoming aware of the incident.
SKW Schwarz is ideally positioned to support companies in the implementation of the security requirements and the corresponding measures. Our expertise spans the entire breadth of the challenges posed by the new law. Our consulting services include:
