NIS2

With NIS2, the EU has extended cybersecurity obligations to many thousands of companies. In Germany, the requirements have applied since December 2025. The directive concerns not only firewalls and emergency plans, but also the handling of hardware across its entire lifecycle. As of: 10/2026.

What does NIS2 regulate?

NIS2 replaces the first NIS Directive of 2016 and has applied since January 2023. Member states had to transpose it into national law by October 2024. Germany did so with the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). It was promulgated on December 5, 2025 and entered into force on December 6, 2025. The core obligations are in the recast BSI Act (BSIG).

Area	What NIS2 requires (simplified)
Scope	Entities in specified sectors, generally from 50 employees or more than EUR 10 million in turnover and balance sheet total; "particularly important" generally from 250 employees or more than EUR 50 million in turnover and EUR 43 million in balance sheet total
Registration	Registration with the BSI; the deadline for initial registration ended on March 6, 2026
Risk management	Technical, operational and organizational measures, including on access control, asset management, supply chain and cryptography
Reporting obligations	Significant security incidents: initial report within 24 hours, report within 72 hours, final report after one month
Management	Approves and oversees the measures, must attend training and is liable for breaches of duty
Sanctions	Fines of up to EUR 10 million or 2% of turnover (particularly important) or up to EUR 7 million or 1.4% (important)

Whether your company is affected depends on sector, size and activity. The BSI offers an applicability check for this. Operators of critical facilities (KRITIS) are subject to additional obligations. This entry does not replace legal advice.

What NIS2 means for decommissioned IT

The risk management measures expressly include asset management, that is, IT inventories. Anyone who knows which devices and data carriers exist and where they are can also steer them securely through to the end. A structured IT Asset Management is the basis for this.

At the end of a device's life, three points matter most:

• Data and access: Old devices often hold access credentials, certificates, VPN profiles or configurations. They must be securely erased, otherwise an entry point arises.
• Supply chain: Service providers for transport, erasure and destruction are part of the supply chain. You should check their security measures and record them contractually.
• Evidence: Auditors expect documented processes. Erasure and destruction certificates per device prove that the process works.

What to look for when selecting a service provider is shown by the guide Choosing an ITAD provider.

NIS2, ISMS and ISO/IEC 27001

NIS2 does not prescribe a particular management system. Many companies, however, implement the obligations with an ISMS , often in accordance with ISO/IEC 27001. Its catalog of measures already contains requirements for the secure disposal or reuse of devices and for the erasure of information. A certification does not replace the statutory obligations, but makes proof easier.

NIS2 and Second IT

Second IT is certified to ISO/IEC 27001 and works with documented processes: its own secure logistics with sealing and GPS monitoring, serial number registration at goods receipt, access control and video surveillance, erasure with Blancco including a certificate per device and destruction in-house according to DIN 66399 (up to H-5 and E-5). More about Data security at Second IT.

Frequently asked questions about NIS2

Since when has NIS2 applied in Germany?

The NIS2 Implementation Act entered into force on December 6, 2025. There is no general transition period for the obligations. Initial registration with the BSI was scheduled by March 6, 2026 (as of: 10/2026).

Does NIS2 expressly require certified data erasure?

No, NIS2 does not name any specific erasure methods. The obligation to take appropriate risk management measures does, however, also include the secure handling of data carriers through to disposal. Documented erasure per device is a practicable proof.

Does NIS2 also apply to service providers of small companies?

A service provider does not automatically fall under NIS2 just because it works for affected companies. Affected entities must, however, take the security of their supply chain into account and therefore often pass requirements on contractually.

Which companies are affected by NIS2?

Affected are entities in specified sectors, generally from 50 employees. There are "important" and "particularly important" entities. Whether your company belongs depends on sector, size and activity. The BSI offers an applicability check for this.

Which reporting deadlines apply to a security incident under NIS2?

For a significant security incident, an initial report within 24 hours is necessary. A further report follows within 72 hours, the final report after one month. The reports go to the BSI. Management must approve and oversee the measures.