Adopted in 2022, the NIS-2 Directive (Directive (EU) 2022/2555) intends to oblige companies to strengthen their cybersecurity. NIS-2 is expected to be transposed into German law shortly by means of the NIS-2UmsuC-Act, adopted by the German government on July 30, 2025.¹ The key provisions for German companies will then mainly result from the new version of the Act on the Federal Office for Information Security, which is currently in draft form as part of the NIS-2UmsuC Act (BSIG-E).

Compared with the current legal situation, BSIG-E will apply to a significantly larger number of companies than the previous regulations on cybersecurity in the current version of the BSIG. In addition, the legal obligation to secure supply chains may also result in contractual obligations to adapt and strengthen cybersecurity for companies that do not fall directly in the law’s scope. The BSIG-E does not yet provide for an implementation phase/deadline after its entry into force, and no such deadline is expected in the ongoing legislative process, as Germany is already behind schedule with implementation of the NIS 2 Directive. This means that the new law will come into force immediately after its promulgation.

Below, we provide you with an overview of when and to what extent companies will be affected by the new cybersecurity law.

What needs to be done?

Early implementation of necessary measures is crucial in order to avoid sanctions and ensure security of the company. In order to determine legal obligations, an applicability test is necessary:

• Direct applicability of the law to your company: Check whether your company falls directly within the scope of the new cybersecurity law (Is your company directly in scope of the new cybersecurity law?)
• Indirect applicability to your company: If there is no direct applicability, cybersecurity requirements may exist indirectly in the future if your company works with a company regulated under cybersecurity law (Contractual cybersecurity obligations: Is your business indirectly in scope of the new cybersecurity law?).

Is your company directly in scope of the new cybersecurity law?

The answer to this question depends on whether the company is active in a particular sector and reaches a certain size (measured by number of employees and turnover). The law distinguishes between essential entities (“besonders wichtige Einrichtungen”) and important entities (“wichtige Einrichtungen”).

Essential entities – special regulations, sectors and thresholds

• Explicit designation as an essential entity: Operators of critical facilities (under current law, known as KRITIS operators), qualified trust service providers, top-level domain name registries, DNS service providers, regardless of company size.
• Qualification by sector and company size: Companies that are active in the energy, transport and traffic, finance, healthcare, water, digital infrastructure or aerospace sectors and that employ at least 250 people or have an annual turnover of more than €50 million and an annual balance sheet total of more than €43 million are considered “essential entities”.² Please note: If the thresholds for essential entities are not met, the company may still qualify as an essential entity (see below). 
• Special regulation for the telecommunications sector: Lower thresholds apply to providers of telecommunications services or networks. A minimum of 50 employees or an annual balance sheet and an annual turnover of more than €10 million are sufficient.³ Regardless whether these thresholds are reached, the provider is considered an “important entity”.⁴

Important entities – special regulations, sectors and thresholds

• Explicit designation as an important entity: Trust service providers (even without qualification); regardless of company size.
• Qualification by sector and company size: Companies that are active in transportation and traffic, waste management, production, manufacture and trade in chemical substances, production, processing and distribution of foodstuffs, manufacturing/production of goods, digital services or research and that employ at least 50 people or have an annual balance sheet and annual turnover of more than €10 million are also considered important entities.⁵
• Special regulation for the telecommunications sector: As explained above, providers of publicly accessible telecommunications services or operators of public telecommunications networks are considered to be important entities even if they employ fewer than 50 people and have an annual turnover or an annual balance sheet total of €10 million or less.

Special regulations for the financial sector

• If your company operates in the financial sector, the special cybersecurity provisions of the Digital Operations Resilience Act (DORA) apply. We have highlighted the requirements under DORA in a separate article here.

Contractual cybersecurity obligations: Is your company indirectly in scope of the new cybersecurity law?

Not only the “big players,” but suppliers in the supply chain are also attractive targets for cyber attacks. The BSIG-E will oblige regulated companies to establish sufficient cybersecurity in their supply chain.⁶ Regulated companies will implement this legal obligation through contractual cybersecurity obligations with their suppliers in accordance with the risk management measures of the BSIG-E. Consequently, companies that do not fall directly within the scope of the law will also be confronted with new (contractual) cybersecurity obligations.

Obligations for companies

If there is clarity about the applicability, the necessary measures can be taken to implement the legal or contractual requirements. The adopted draft law provides for a wide range of extensive new obligations for companies that fall within the scope of the law, including, for example: 

• The obligation to register with the Federal Office for Information Security (BSI)⁷
• Introduction of documented risk management measures⁸
• Obligatory cybersecurity training for management⁹
• Management must ensure that appropriate, proportionate and effective technical and organizational cybersecurity measures are taken¹⁰
• Monitoring of the measures taken¹¹
• Stricter reporting obligations for cybersecurity incidents, such as hacker attacks: In the event of serious security incidents, affected companies must report within 24 hours.¹²

In the event of non-compliance with the requirements of the BSIG-E, companies face not only administrative measures (including the ordering of audits, inspections or certifications) but also severe fines¹³ and management faces personal liability in the internal relationship.¹⁴

In summary

If a company is considered an essential or important entity, it falls directly within the scope of the BSIG E and must comply with the statutory obligations. The management is explicitly and directly held accountable by the law through regulations on liability and the obligation to provide further training.

If a company does not fall within the scope of the law itself, it should be checked whether cybersecurity requirements may arise in the form of contractual obligations from customer contracts. If this is the case, a negotiating position should be defined.

Should you have any questions regarding the applicability of the BSIG-E on your company or obligations for your company, feel free to reach out to us.

1. https://www.bmi.bund.de/SharedDocs/pressemitteilungen/DE/2025/07/NIS2-kabinett.html.↩
2. § Section 28 para. 1 no. 4 BSIG-E..↩
3. § Section 28 para. 1 no. 3 BSIG-E.↩
4. § Section 28 para. 2 no. 2 BSIG-E.↩
5. § Section 28 para. 2 no. 3 BSIG-E.↩
6. § Section 30 (2) no. 4 BSIG-E.↩
7. § SECTION 33 BSIG-E.↩
8. § Section 30 (1) BSIG-E.↩
9. § Section 38 para. 3 BSIG-E.↩
10. § Section 38 (1) BSIG-E.↩
11. § Section 38 (1) BSIG.↩
12. § Section 32 para. 1 no. 1 BSIG-E.↩
13. § SECTION 65 BSIG-E.↩
14. § SECTION 38 BSIG-E.↩