FAQs

Q: Does NIS2 also apply to small companies with fewer than 50 employees?

Generally not—but there are exceptions. Companies , that provide critical services (e.g., in healthcare or digital infrastructure) may also be affected below the thresholds. In addition, large companies subject to NIS2 are increasingly requiring compliance evidence from their suppliers.

Q: Can I implement NIS2 as a SME myself or do I need external consultants?

Simple immediate measures like MFA-Activation or setup your back up system can be done internally and immedaitely. For governance structures, principle guidance and supply chain review we recommend external support - especially if no internally dedicated IT security team has been appointed.

Q: What is the first step in implementing NIS2?

The first step is to assess whether you are affected. The BSI provides a free online tool for this: betroffenheitspruefung-nis-2.bsi.de. After that, you should complete the BSI registration, if you have not already done so.

Q: What is NIS2 in simple terms?

NIS2 is an EU directive on cybersecurity that has been in effect in Germany since December 2025. It requires companies with 50 or more employees in 18 sectors to implement specific IT security measures—with personal liability for management.

Does NIS2 also apply to small companies with fewer than 50 employees?

Can I implement NIS2 as a SME myself or do I need external consultants?

What is the first step in implementing NIS2?

What is NIS2 in simple terms?

What MAM Settings Do I Need in Microsoft Intune?

What Steps Does a BCM Consulting Project Include to Improve Business Continuity?

SOCIAL MEDIA

LEGAL

CONTACT