Lawyer for cybersecurity – NIS-2, incident response & liability
For companies with security obligations – NIS-2 implementation, incident handling and liability issues in cyber attacks.
Cybersecurity and IT security law for companies: incidents, management duties and a robust security organisation
ITMR Rechtsanwälte advises companies on IT security law and cybersecurity regarding security incidents, NIS-2, management duties, supply chain and security contracts.
Cybersecurity becomes a legal and leadership issue as soon as security incidents, NIS-2 pressure, major customers, insurers, supervisory authorities and service providers come together. Then the security organisation must also hold up legally and organisationally. What matters is whether incident paths, management approvals, evidence, supplier obligations and crisis responses work in an emergency.
In Germany, the BSI-Gesetz as amended by the NIS-2 Implementation Act (BSIG 2025) (opens in a new tab) has applied since 06.12.2025. It implements the European NIS-2 Directive (EU) 2022/2555 (opens in a new tab).
Responsible for content: Jean Paul P. Bohne, Fachanwalt für IT-Recht (certified specialist lawyer for IT law), AI Officer (DEKRA), reviewed on 23 October 2026 (German version)
Quick start: what is your situation?
Security incident or data breach
Ransomware, compromised service provider or data leak: first sort out the situation, deadlines and reporting channels.
Check whether NIS-2 applies
The check gives initial guidance on the entity category and registration obligation under BSIG 2025.
Implementing NIS-2 in your company
Set up risk management, the reporting process, registration and management training as an implementation plan.
Cyber Resilience Act for products
Manufacturers of products with digital elements use the CRA check to see whether the regulation applies.
Banking fraud in your company
Unauthorised transfer after phishing or a fake call: review bank liability, authentication and evidence and prepare recovery.
Assessing the risks of digital projects
Record legal risks, prioritise measures and structure evidence for management, audit and supervisory authorities.
Your contact: Dr. Alexander Pleh
Partner and Fachanwalt für IT-Recht (certified specialist lawyer for IT law). Together with Jean Paul P. Bohne, Fachanwalt für IT-Recht.
What happens after your enquiry?
After your enquiry, we get back to you within 24 hours on working days. The first contact is free of charge. You will be informed explicitly before any costs are incurred.
- A short description is enough. Briefly describe the situation, affected systems and service providers as well as known points in time. Incident notes, security annexes to contracts and existing policies are helpful.
- Receipt and initial sorting. We assess the enquiry on the basis of the project described, the documents and the apparent goal. Deadlines and dates should be clearly recognisable.
- Suitable starting point and cost range. We clarify whether an initial consultation, a service package or a specific mandate is the next step. As soon as the scope of the review is clear, we tell you the cost range – before work begins.
In brief
For particularly important and important entities, reporting deadlines of 24 hours, 72 hours and one month apply under § 32 BSIG. Management must implement and monitor risk management and undergo regular training.
Typical cases from our cybersecurity practice
We regularly encounter the following constellations. They are abstracted and simplified. Which obligations apply depends on sector, size, contractual situation and the incident.
NIS-2Major customer demands NIS-2 evidence
- Starting point
- A SaaS provider receives an extensive security questionnaire from a major customer with an audit right and a short response deadline.
- Key difficulty
- The company is not sure whether it itself falls under BSIG 2025. The existing policies are technically good but have not been approved by management.
- Our work
- We review applicability under § 28 BSIG, prepare approvals under § 38 BSIG and align the answers with the contractual situation.
- Work result
- Robust answers to the customer, a management approval record and a clear line on registration.
Simplified example.
ContractCloud contract without audit rights
- Starting point
- A company outsources core processes to a cloud platform. The standard contract contains no audit rights and no deadlines for incident reports.
- Key difficulty
- For its own supply chain security under § 30 BSIG, the company needs information and cooperation rights vis-à-vis the provider.
- Our work
- We prioritise the contractual gaps, draft a security annex and prepare the negotiation.
- Work result
- Security annex with audit rights, reporting deadlines, subcontractor rules and exit support.
Simplified example.
Work sample
Ransomware at the managed service provider
A medium-sized manufacturer discovers that its IT service provider has been compromised. Some of its own systems are encrypted. The real difficulty: it is unclear whether the company is subject to reporting obligations as an important entity and whether there is also a personal data breach. The contract with the service provider only regulates incident reports in general terms. We classify the obligations under § 32 BSIG and Art. 33 GDPR, secure evidence and deadlines and manage communication with the service provider, insurer and customers. Result of our work: a documented situation report, timely reports and a basis for later recourse claims against the service provider.
The scenario is anonymised and simplified; it describes how we work, not the outcome of any specific proceedings.
The basic matrix in IT security law
Robust cybersecurity arises where incident, management, contract and evidence fit together. If one of these levels remains unclear, a security problem quickly becomes a supervisory, liability, customer or insurance problem.
Cybersecurity is therefore more than technology and not a catch-all term for everything digital. The focus is on incident management, IT security law, management duties, NIS-2, supply chain, security contracts, documentation and the question of how a company keeps security risks commercially manageable.
1. What is the specific situation?
Security incident
Ransomware, system failure, compromised service provider, conspicuous log data or a disruption whose security dimension is still unclear.
Supervision / audit
NIS-2 applicability, customer questionnaire, insurer, due diligence or registration and evidence questions.
Contract / supply chain
Cloud, hosting, SaaS, platform or outsourcing contracts do not reflect security requirements in an operationally enforceable way.
Governance
Management duties, approvals, training, reporting lines and documentation lag behind the company's risk profile.
2. Where are the typical legal and project risks?
Obligations
Reporting channels, information obligations, customer communication, insurers, supervisory authorities and contractual escalation.
Management
Resources, approvals, responsibilities, reporting lines, monitoring, training and proximity to liability.
Contracts
Audit rights, response deadlines, incident obligations, subcontractor logic, exit and access to evidence.
Evidence
Whether measures have been approved, implemented, monitored, trained and documented. The evidence must also hold up for third parties.
Practical consequence: A good technical level of security is important. On its own, however, it does not answer the decisive legal questions. What matters is whether incident paths, management decisions, supplier obligations and evidence come together robustly in a conflict, in an audit and vis-à-vis third parties.
The three main case axes
Cybersecurity rarely becomes relevant for a mandate in companies because of a definition. The decisive factor is usually a situation in which technical uncertainty turns into a question of leadership, supervision, contract or liability.
Acute security incident
A system disruption, ransomware, a compromised service provider or an event that has not yet been cleanly separated internally into security incident, contractual disruption and personal data breach. What counts here is legal triage, deadlines, securing evidence and the right order of communication.
Supervision and evidence
NIS-2 applicability, audit preparation, customer questionnaires, insurers or registration questions show whether measures have been approved, trained, monitored and documented. Our NIS-2 applicability check provides an initial assessment of applicability and the registration obligation.
Contract and supply chain
Security requirements often remain soft because contracts, security annexes, audit rights, incident reports, subcontractors and exit rules do not fit together. Good technology without an enforceable contractual position often falls short in a crisis.
Can be checked by management immediately
- Who decides in an incident and who speaks externally?
- Which reporting and information channels can already be started?
- Which service providers, contracts and third-party components are affected?
- Which decisions must later remain traceable vis-à-vis supervisory authorities, customers, insurers or shareholders?
What counts in the first 72 hours
In a security incident, the order is decisive. The cleanest situation report protects better later against liability, contradictions and avoidable escalation than the fastest external statement.
Secure immediately
- identify affected systems, processes, data and service providers
- fix internal responsibilities and approval paths
- document the incident, points in time, logs, communication status and initial measures
- bring in the contractual situation, insurers and possible regulatory interfaces
Do not act hastily
- no hasty assignments of blame or binding external commitments
- no isolated technical communication without legal triage
- do not base reporting or customer communication on unclear facts
- do not weaken the evidence through disorderly clean-up or documentation gaps
Clarify legally first
- which obligations actually apply
- whether data protection, cybersecurity, contract or supervision is the focus
- which deadlines and escalation paths may become relevant
- which contracts, security annexes and service providers must be considered immediately
Then decide strategically
- which line of communication holds internally and externally
- how the BSI (Federal Office for Information Security), customers, insurers, investors or contractual partners are addressed
- which follow-up should later enable recourse, defence or contract restructuring
- which management decisions must be prepared so that they are properly documented
Recurring mistake: The situation usually becomes expensive through the combination of unclear responsibility, weak documentation, a contractual gap and late involvement of management. These architectural errors drive follow-up costs and liability pressure more than the individual technical defect.
NIS-2 and BSIG 2025: deadlines and obligations at a glance
Under § 28 BSIG (opens in a new tab), BSIG 2025 distinguishes between particularly important entities and important entities. Sector, number of employees as well as turnover and balance sheet total are decisive. Risk management, reporting obligations, registration and management duties apply to both groups.
| Step | Deadline | Content |
|---|---|---|
| Early warning | without undue delay, at the latest 24 hours after becoming aware | Suspicion of an unlawful or malicious act, possible cross-border impact |
| Incident notification | without undue delay, at the latest 72 hours after becoming aware | Confirmation or update, initial assessment of severity and impact |
| Intermediate report | at the request of the BSI | relevant status updates |
| Final report | at the latest one month after the notification | detailed description, cause, remedial measures. If the incident is ongoing, a progress report first |
In addition to the reports, § 30 BSIG (opens in a new tab) requires appropriate, proportionate and effective technical and organisational measures. Under § 33 BSIG (opens in a new tab), affected entities must register with the BSI at the latest three months after becoming subject to the law. Personal data also triggers separate obligations under Art. 33 GDPR. This European notification to the data protection supervisory authority runs separately from the report to the BSI.
In brief
The BSIG report to the BSI and the GDPR notification to the data protection supervisory authority are two separate channels with their own deadlines. Both should be fed from a common situation report.
When technology is not enough without restructuring contracts
Whenever security requirements do not end within your own organisation. With cloud, SaaS, hosting, platform, support and outsourcing models, the contract often decides whether security really remains enforceable in an emergency.
Must be clearly regulated
- audit rights and robust information rights
- incident reports, response deadlines and support services
- subcontractor logic and flow-down obligations
- access to evidence, log access and cooperation obligations
- exit support and crisis cooperation
Typical contractual gaps
- general security promises without operational rights
- missing escalation mechanism in an incident
- unclear responsibility for managed services and white-label structures
- subcontractors without real control or step-in logic
- missing access to evidence and logs
Particularly in need of review
- critical cloud and hosting models
- SaaS and platform operations with high outage or incident pressure
- support and emergency logic in outsourced structures
- supply chains with open source and third-party components
- contracts that merely declare security rather than making it manageable
In depth: IT contract / software contract · Contract management · Open source law · Open source compliance
Management duties, approvals and evidence
At the latest when security risks reach management level, cybersecurity becomes a question of leadership and liability. In addition to the measures, approvals, responsibilities, training, reporting lines, budget decisions and documented security decisions are also relevant.
For particularly important and important entities, § 38 BSIG (opens in a new tab) expressly regulates these duties. Management must implement the risk management measures and monitor their implementation. In the event of a culpable breach of duty, it is liable to the entity under the company law of the respective legal form. It must also regularly participate in training.
What management bodies should be able to demonstrate robustly
- that significant risks were addressed and not ignored
- that adequate resources, approvals and reporting lines existed
- that measures were trained, monitored and followed up
- that decisions were also documented organisationally
Where proximity to liability typically arises
- when the risk profile and security organisation visibly diverge
- when there is no escalation despite warning signs
- with formal policies without sound implementation
- in audit and supervisory situations without robust evidence
Management-level checkpoint: What matters is whether the company can later show that protective measures were approved, implemented, monitored and documented. That is exactly where security often becomes an organisational problem.
The key distinctions and interfaces
Cybersecurity independently covers questions relating to security incidents, NIS-2, management duties, supply chain, security contracts and evidence logic. Depending on the focus, neighbouring specialist areas come into play in more depth.
Data protection law and data breaches
If personal data, supervisory authorities, data subject rights or specific GDPR notification obligations are the focus, data protection law and help with data breaches lead closer to the actual core.
IT compliance and legal register
If the case is shaped by overarching management of digital obligations, policies, audit programmes and role models, the focus is regularly on IT compliance & legal register.
IT law and contract architecture
If the main question lies in the individual software, cloud, platform or outsourcing contract, IT law and IT contract / software contract take it further.
Data law and interoperability
If data access, interoperability, cloud switching and the commercial handling of usage or product data carry the case, data law and implementing the Data Act are the closer focal points.
Practically relevant delimitation: This page focuses on security-related mandates involving incident pressure, management proximity, NIS-2, supply chain, contract architecture and evidence. It is deliberately not a general collection page for data protection, data or compliance.
Constellations in which cybersecurity immediately becomes commercially relevant
Situations in which the security situation, management, evidence and contractual reality all have to hold up at the same time are particularly delicate.
Security incident, ransomware or compromised service provider
Technically, the incident has been detected, but it remains unclear which legal obligations, contracts, reporting channels and lines of communication must run in parallel immediately.
NIS-2, audit or supervisory pressure suddenly increases
Customers, group requirements, insurers or regulation demand a robust security organisation, although roles, approvals and evidence are not yet soundly structured.
Cloud, SaaS, hosting or outsourcing contracts do not support security
Audit rights, incident reports, response deadlines, support services, subcontractor logic and exit obligations are legally too weak or practically unenforceable.
Management must take responsibility for security decisions
Reporting lines, budget approvals, training, responsibilities and documented lines of decision are not sufficient to set up management and the organisation robustly.
Supply chain, third-party software or managed services create pressure
Third-party components, open source modules, managed services and subcontractors are technically integrated, but not properly integrated into evidence, liability and security logic.
Data protection, compliance and security interlock in a disorderly way
It is unclear whether the case is primarily driven by security, data protection, compliance or contract, and which regulatory or commercial focus really carries it now.
How we support companies in cybersecurity
In practice, security situations rarely fail because of a single measure. It becomes critical when an incident is classified incorrectly from a legal perspective, contracts do not take effect or management does not properly approve decisions. Our focal points are security incidents and incident response, management duties and proximity to directors' liability, NIS-2, audit and supervision, contracts and supply chain, evidence and documentation logic as well as governance at the security interface.
| Service | Concrete result | Next step |
|---|---|---|
| Incident support | Situation report, deadline plan and coordinated reports | Briefly describe the incident and give the points in time |
| NIS-2 applicability | Classification under § 28 BSIG and a line on registration | Submit sector, number of employees and turnover |
| NIS-2 implementation | Action plan under § 30 BSIG with roles and evidence | Send existing policies |
| Management approvals and training | Approval record and training concept under § 38 BSIG | Arrange an appointment with management |
| Security contracts | Security annex with audit rights and reporting deadlines | Send service provider contracts for review |
| Product security under the CRA | Classification of products with digital elements | Submit a product list |
Key terms in IT security law
- Particularly important entity
- Entity category under § 28(1) BSIG, for example operators of critical facilities or large companies in certain sectors.
- Important entity
- Entity category under § 28(2) BSIG with risk management, reporting and registration obligations.
- Significant security incident
- A security incident that triggers the reporting obligations under § 32 BSIG.
- Early warning
- First report to the joint reporting office at the latest 24 hours after becoming aware (§ 32(1) No. 1 BSIG).
- Risk management measures
- Appropriate, proportionate and effective technical and organisational measures under § 30 BSIG.
- Registration obligation
- Obligation to register with the BSI at the latest three months after becoming subject to the law (§ 33 BSIG).
- Incident response
- An orderly process for detecting, containing, documenting and following up on a security incident.
- Supply chain security
- Security in relationships with service providers and suppliers as part of risk management.
The terms follow the BSI-Gesetz as amended by the NIS-2 Implementation Act. In individual cases, sector, size and service are decisive.
Provisions and sources
German law (DE) and EU law (EU) are marked separately. For companies in Germany, BSIG 2025 applies directly; the NIS-2 Directive is addressed to the Member States.
| Provision | Content | Practical significance |
|---|---|---|
| § 28 BSIG (opens in a new tab) | Particularly important and important entities | DE. Determines who is subject to the obligations. |
| § 30 BSIG (opens in a new tab) | Risk management measures | DE. Technical and organisational measures including the supply chain. |
| § 32 BSIG (opens in a new tab) | Reporting obligations | DE. 24 hours, 72 hours and one month. |
| § 33 BSIG (opens in a new tab) | Registration obligation | DE. At the latest three months after becoming subject to the law. |
| § 35 BSIG (opens in a new tab) | Obligations to inform | DE. Informing affected recipients in certain sectors. |
| § 38 BSIG (opens in a new tab) | Duties of management | DE. Implementation, monitoring, liability and training. |
| § 65 BSIG (opens in a new tab) | Provisions on fines | DE. Sanctions for breaches of obligations. |
| Directive (EU) 2022/2555 (NIS-2) (opens in a new tab) | Minimum harmonisation of cybersecurity | EU. Addressed to the Member States. |
| Art. 33 GDPR (opens in a new tab) | Notification of personal data breaches | EU. Applies in parallel for personal data. |
| Cyber Resilience Act (opens in a new tab) | Cybersecurity of products with digital elements | EU. Regulation with staggered dates of application. |
Source for the situation graphic: Bundeskriminalamt (Federal Criminal Police Office): statistics and situation reports (opens in a new tab).
Frequently asked questions from companies
The following answers provide sound initial guidance. For the exact line in an individual case, the business model, sector, contractual situation, incident, technical architecture and state of documentation remain decisive.
When does IT security become a directors' liability issue?
The issue moves close to directors' liability when known security risks are not addressed, warning signs are ignored or adequate resources are not provided. The same applies if obligations under security laws or contracts are not implemented in a structured way or significant decisions are not documented. The situation is particularly sensitive when the security organisation, management approvals and reporting lines visibly lag behind the risk profile. ITMR Rechtsanwälte prepares approvals and documentation for management.
When is technology not enough without restructuring contracts?
Whenever security requirements do not end within your own organisation. With cloud, SaaS, hosting, support and outsourcing models, the contract often decides whether audit rights, incident reports, response deadlines and support obligations are enforceable. The same applies to subcontractor control, exit support and robust evidence. ITMR Rechtsanwälte reviews and negotiates these security annexes.
When is IT compliance more relevant than cybersecurity?
When the overarching management of digital obligations within the company is the focus rather than the specific security or incident situation. Typical signals are legal registers, policy landscapes, audit programmes, role models and training matrices. Added to this is the question of how data protection, security, artificial intelligence and contracts are brought together organisationally. ITMR Rechtsanwälte classifies the focus in the initial conversation.
Is cybersecurity the same as data protection?
No. Data protection is an important sub-area as soon as personal data is affected. Cybersecurity goes beyond this and also covers availability, resilience, system integrity, supply chain security, securing evidence, incident management and management duties. The focus should therefore not be narrowed hastily to data protection. ITMR Rechtsanwälte combines both reviews.
What must be in place first after a significant security incident?
First, the company needs a robust set of facts. Affected systems, processes, data, service providers, contracts, running deadlines and possible reporting or information obligations must be clarified. For entities subject to reporting obligations, the early warning under § 32 BSIG is due at the latest 24 hours after becoming aware. Only on this basis should contacts with authorities, communication with contractual partners, insurance questions and recourse steps be coordinated. ITMR Rechtsanwälte supports this triage at short notice on working days.
Does every company have to go into the same depth immediately because of NIS-2?
No. First, it must be determined whether and why the company is affected. It may be directly affected by virtue of sector and size under § 28 BSIG, indirectly via group requirements or contractually via customer requirements. The right depth only results from this applicability. Leaving the topic until the first audit or incident almost never makes sense. ITMR Rechtsanwälte clarifies applicability with you.
What duties does management have under BSIG 2025?
Under § 38 BSIG, the management of particularly important and important entities must implement the risk management measures and monitor their implementation. In the event of a culpable breach of duty, it is liable to the entity under company law. In addition, it must regularly participate in training. ITMR Rechtsanwälte prepares approvals and training for management.
Respond urgently or set up a robust security organisation as a precaution
Would you like to speak directly with a specialist IT lawyer? Whether an acute incident or prevention, we classify the incident, audit pressure, obligations and contractual situation and set up management duties, evidence and supply chain logic so that later audit, supervisory or incident situations do not only become visible in crisis mode.
Cybersecurity often requires advice at several interfaces at once: IT security law, contract architecture, governance, data protection, supply chain and security organisation. You can use the CRA check to assess in advance whether your product with digital elements falls under the Cyber Resilience Act.
Dr. Alexander Pleh
Partner and Fachanwalt für IT-Recht (certified specialist lawyer for IT law). The obvious choice for cybersecurity, IT security law, NIS-2, security incidents, contract architecture and technically shaped IT mandates.
Jean Paul P. Bohne, LL.M., MM
Partner and Fachanwalt für IT-Recht (certified specialist lawyer for IT law). The obvious choice when cybersecurity strongly overlaps with governance, legal registers, data protection compliance or company-wide organisational issues.
Useful in-depth pages at ITMR
Legal status: 23 October 2026. This overview provides initial orientation and does not replace a review of the specific case.
Responsible lawyer for cybersecurity at ITMR
Dr. Alexander Pleh
Rechtsanwalt (attorney) | Partner
- Fachanwalt für IT-Recht (certified specialist lawyer for IT law)
- AI Officer (KI-Beauftragter) [DEKRA]
- External data protection officer
Cybersecurity expert at ITMR
T: +49 211 737547-70
E: pleh@itmr-legal.de