![\"Person](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/11\/NIS2_Titelbild_Roadmap.png\" "\\"NIS2_cover_image_roadmap\\"")
<\/span><\/div><\/div><\/div><\/div><\/div>Why NIS2 Affects Everyone<\/h2><\/h2><\/div>The new EU Directive NIS2 marks a turning point in IT security, and the implementation looks different for every company. While previous regulations such as NIS1 or the KRITIS Regulation focused on a few, clearly defined operators of critical infrastructures, the circle of affected companies is now being significantly expanded.<\/p>\n
Specifically, this means:<\/strong> Even medium-sized companies, suppliers, and service providers fall within the scope of the directive \u2013 even if they do not directly belong to the classic “critical infrastructures” (information from the BSI). In Germany, threshold values such as at least 50 employees and 10 million euros in annual turnover or balance sheet total usually apply. Smaller companies are often excluded, but can still be affected if they provide particularly critical services \u2013 for example, in healthcare or digital infrastructure. For internationally active companies, the following also applies: Similar requirements also apply in other EU countries.<\/p>\n<\/div>\nFor companies, this means: The question is no longer “whether” you are affected by NIS2<\/strong>, but how quickly you can prepare for it.<\/strong><\/p>\n<\/blockquote>\n<\/div><\/div><\/div><\/div><\/div>What Does NIS2 Demand in Practice?<\/span><\/span><\/h2><\/h2><\/div>The directive includes a variety of requirements. To make the implementation more tangible, they can be divided into three core areas: governance, technical basic measures, and reporting obligations.<\/p>\n<\/div><\/div><\/div>
1. Governance \u2013 Clarify responsibility and create processes<\/h3><\/h3><\/div>A central element of NIS2 is the assignment of responsibility. Management and IT management must ensure that information security is organizationally anchored. Here is the EU directive<\/a> on this:<\/p>\n<\/div>- <\/i><\/span>Clear roles and responsibilities are defined.<\/div><\/li>
- <\/i><\/span>Policies and guidelines must be documented in a binding manner and known to all employees.<\/div><\/li>
- <\/i><\/span>Management systems that define rules and procedures for information security or emergencies (e.g. ISMS or BCM) are moving into the focus.<\/div><\/li><\/ul>
Practical example<\/h4><\/div>A medium-sized mechanical engineering company defines an “information security officer” person at management level, supplemented by a small internal team. Together with a consultant, this team creates simple guidelines for password management, access rights and emergency processes.<\/p>\n<\/div><\/div><\/div>
2. Technical Basics \u2013 the indispensable Quick Wins<\/h3><\/h3><\/div>NIS2 also requires the implementation of basic technical measures. Many of these have long been considered best practice, but in reality they are often still implemented incompletely. These measures in particular are ideal quick wins. They can be introduced relatively quickly and immediately increase the level of security. These include:<\/p>\n<\/div>
- <\/i><\/span>Multi-factor authentication (MFA): protects sensitive systems from unauthorized access, even if passwords are compromised.<\/div><\/li>
- <\/i><\/span>
The new EU Directive NIS2 marks a turning point in IT security, and the implementation looks different for every company. While previous regulations such as NIS1 or the KRITIS Regulation focused on a few, clearly defined operators of critical infrastructures, the circle of affected companies is now being significantly expanded.<\/p>\n
Specifically, this means:<\/strong> Even medium-sized companies, suppliers, and service providers fall within the scope of the directive \u2013 even if they do not directly belong to the classic “critical infrastructures” (information from the BSI). In Germany, threshold values such as at least 50 employees and 10 million euros in annual turnover or balance sheet total usually apply. Smaller companies are often excluded, but can still be affected if they provide particularly critical services \u2013 for example, in healthcare or digital infrastructure. For internationally active companies, the following also applies: Similar requirements also apply in other EU countries.<\/p>\n<\/div> For companies, this means: The question is no longer “whether” you are affected by NIS2<\/strong>, but how quickly you can prepare for it.<\/strong><\/p>\n<\/blockquote>\n<\/div><\/div><\/div><\/div><\/div> The directive includes a variety of requirements. To make the implementation more tangible, they can be divided into three core areas: governance, technical basic measures, and reporting obligations.<\/p>\n<\/div><\/div><\/div> A central element of NIS2 is the assignment of responsibility. Management and IT management must ensure that information security is organizationally anchored. Here is the EU directive<\/a> on this:<\/p>\n<\/div> A medium-sized mechanical engineering company defines an “information security officer” person at management level, supplemented by a small internal team. Together with a consultant, this team creates simple guidelines for password management, access rights and emergency processes.<\/p>\n<\/div><\/div><\/div> NIS2 also requires the implementation of basic technical measures. Many of these have long been considered best practice, but in reality they are often still implemented incompletely. These measures in particular are ideal quick wins. They can be introduced relatively quickly and immediately increase the level of security. These include:<\/p>\n<\/div>\n
What Does NIS2 Demand in Practice?<\/span><\/span><\/h2><\/h2><\/div>
1. Governance \u2013 Clarify responsibility and create processes<\/h3><\/h3><\/div>
Practical example<\/h4><\/div>
2. Technical Basics \u2013 the indispensable Quick Wins<\/h3><\/h3><\/div>
![\"A](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/10\/Untitled-design-25.png\" "\\"Untitled")
<\/span><\/div><\/div><\/div><\/div><\/div>![\"The](\"https:\/\/netxconsult.de\/wp-content\/uploads\/2025\/10\/Untitled-design-24.png\" "\\"Untitled")
<\/span><\/div><\/div><\/div><\/div><\/div>