NIS2 and small businesses: checking whether it applies, preparing IT measures

Whether a business falls directly under NIS2 cannot be decided by headcount alone. Sector, company structure and certain activities matter too. In Germany, the NIS2 implementation act has applied since 6 December 2025. I set out the questions a small business should clarify and show which technical measures I can help with.

Who falls under NIS2

Two questions decide. First: does your company belong to one of the types of entity listed in Annexes 1 and 2 of the BSIG? Annex 1 includes energy, transport, finance, health, water and digital infrastructure. Annex 2 adds postal and courier services, waste management, chemicals, food in wholesale and industry, and parts of manufacturing such as mechanical engineering, electrical equipment and vehicles. Second: does it reach the size thresholds?

The count follows the EU definition of small and medium-sized enterprises. Partner and linked enterprises can therefore count too, unless the company’s IT is independent of them. If your company belongs to a group, it is worth looking more closely.

A first orientation comes from the BSI’s NIS2 applicability check (in German), an anonymous questionnaire that follows the act. The BSI itself points out that the result is not legally binding. It does not replace your own assessment.

What companies in scope have to do

The act sets out three central obligations:

• Register: in the BSI portal, no later than three months after a company first counts as an important or particularly important entity. This first needs an account with “Mein Unternehmenskonto”. The portal has been open since 6 January 2026. For companies that were in scope when the act came into force, the BSI says the deadline has passed.
• Report: significant security incidents within 24 hours as an early warning, within 72 hours with an initial assessment, and a final report no later than one month after that.
• Manage risk: implement and document appropriate technical and organisational measures. The act names, among others, risk analysis, incident handling, backup and recovery, supply chain security, training, encryption, access control and multi-factor authentication.

Management must implement these measures, oversee their implementation and take part in training regularly. If it breaches these duties, it is liable under the rules of company law.

Why NIS2 still reaches small businesses

The biggest misunderstanding I come across is the sentence “NIS2 doesn’t concern us, we’re a small business anyway”. Directly, that is often true. But companies in scope have to ensure the security of their supply chain. That includes their relationships with direct suppliers and service providers. The BSI states explicitly that the act can indirectly affect companies outside its scope through such business relationships. As examples, the explanatory memorandum to the act names contractual agreements on risk management, incident handling and patching.

For a small business this means: a larger customer that falls under NIS2 can write requirements on IT security, documentation and risk management into the contract. The BSI suggests that suppliers in this position measure their own measures against the requirements of the act. Some companies already have the basics in place: multi-factor authentication, tested backups, regular updates and current documentation. They can usually answer such requirements without a large project. If you use Microsoft 365, you may already have some of the tools in your plan, as I describe in the article on unused security features in Business Premium.

How I help, and where I don’t

Clients have already asked me about NIS2, and in my assessment the act applies to one of my clients. The supply chain is also a topic for my clients. I am not a lawyer. Whether a company is in scope and which obligations apply in detail is a legal question for suitably qualified advisers. I help with the technical assessment and with implementing the security measures that have been agreed.

In these cases I bring in NIS2 specialists and lawyers. Their requirements shape a concept, and I implement the measures from it that concern IT security: securing access, backup and recovery, updates, network and documentation. That way everyone sticks to what they do best. A technical audit is not an NIS2 certification.

Frequently asked questions

From how many employees does NIS2 apply?

As a rule from 50 employees, or with annual turnover and balance sheet total of more than 10 million euros each. It also only applies if the company belongs to one of the types of entity in Annexes 1 and 2 of the BSIG. Some types, such as DNS service providers or trust service providers, are covered regardless of size.

Do I have to register with the BSI as a supplier to a company in scope?

No, the registration duty only applies to companies that are themselves important or particularly important entities. As a supplier, however, you can be contractually obliged to meet requirements on IT security, documentation and risk management.

How do I find out whether my company is affected?

The BSI’s NIS2 applicability check, an anonymous questionnaire, gives a first assessment. It is not legally binding. In cases of doubt, for example in groups of companies or at the edges of a sector, you should have the question clarified legally.

Sources

• The act: Federal Law Gazette 2025 I No. 301 – Act implementing the NIS2 Directive (in German), promulgated on 5 December 2025
• Entry into force and obligations: BSI – NIS-2-Umsetzungsgesetz ab morgen in Kraft (in German, 5 December 2025)
• Thresholds and types of entity: Section 28 BSIG, Annex 1 and Annex 2 BSIG (in German)
• Risk management, reporting, registration, management duties: Section 30, Section 32, Section 33 and Section 38 BSIG (in German)
• BSI portal: BSI – BSI-Portal ab sofort freigeschaltet (in German, 6 January 2026), BSI – NIS-2-regulierte Unternehmen (in German, note on the expired registration deadline)
• Supply chain and groups of companies: BSI – Allgemeine FAQ zu NIS-2 (in German)
• Self-assessment: BSI – NIS-2-Betroffenheitsprüfung (in German)
• All information as of 25 September 2026.