NIS2 Check

Does your business fall under NIS2?

This interactive NIS2 check helps businesses, SaaS/cloud providers, IT service providers, platforms, critical suppliers and digital business models make an initial editorial classification of applicability, risk level and registration, management, reporting and evidence obligations. This lets you see early on whether your business falls under NIS2.

Start the check

NIS2 / BSIG Cybersecurity Incident response Supply chain

What NIS2 is about in practice

In Germany, NIS2 has been anchored in the BSIG (Act on the Federal Office for Information Security) through the implementation act since 06.12.2025. What matters is not only the sector and size, but also the type of entity, group structure, critical supply chains, IT dependencies, incident processes and the responsibility of management.

Provisional classification as an important or essential entity
Review of registration, risk management, management duties and reporting channels
Alignment with GDPR, DORA, CRA, KRITIS, cloud/SaaS and supply chain requirements

Interactive NIS2 command centre

Scope, readiness and reporting clock at a glance

This module changes while you fill in the questionnaire. It shows whether a NIS2 scope is likely, which entity category needs to be reviewed, how robust the existing measures appear and whether an incident reporting clock needs to be activated.

Scopestill open

Categorystill open

Readiness0 %

Reporting pressurepreventive

Scope scanner

The bars show which scope signals are already apparent.

Sector

Size / role

Criticality

Review pressure

Incident reporting clock

preventive no reporting clock active

24h Check early warning 72h Check notification 1 month Check final report

Readiness barometer

The more robust building blocks are in place, the more the barometer fills up.

ISMS Management Incident BCM Supply chain IAM Monitoring

Orientation

How the check works

Determine the sector

Mapping to NIS2/BSIG sectors, digital services, public administration, critical infrastructure or supply chain role.

Check size and special role

Thresholds, special cases, group structure, public body, KRITIS or special regulation are taken into account.

Assess criticality

Consequences of an outage, sensitive data, cross-border services, cloud/MSP dependencies and DORA/CRA/GDPR interfaces are taken into account.

Classify readiness

The check asks about governance, risk analysis, incident response, BCM, supply chain, access protection, monitoring, training and evidence.

Derive the priority

At the end you receive a provisional editorial risk level, reasons, review points, a list of documents and a copyable short overview for your inquiry.

Classification

What this check does

The check does not replace an individual review. It structures the typical questions that become relevant for NIS2/BSIG applicability, registration, cybersecurity risk management, management responsibility, supply chain management and incident reporting.

Which businesses may be affected?

Applicability may be relevant in particular for energy, transport, banking, financial markets, health, drinking water, waste water, digital infrastructure, managed services, cloud, data centres, public administration, space, manufacturing, chemicals, food, waste, postal/courier services, research and certain digital providers. Size, role, special cases and affiliated companies must be reviewed separately.

Which obligations are typically at the centre?

Typical are risk analysis, security concept, incident response, business continuity, supply chain security, secure development and procurement, access protection, cryptography, training, management oversight, registration, evidence and reporting processes for significant security incidents.

What applies to security incidents?

Significant security incidents require a time-critical assessment. Under Section 32 BSIG: an early warning no later than 24 hours and a notification no later than 72 hours after becoming aware, a final report no later than one month after the 72-hour notification (if the incident is ongoing, a progress report first). Reports go to the joint reporting office of the BSI and BBK via the BSI portal. National portals, detailed requirements and parallel GDPR, DORA, CRA or customer obligations must be aligned in the individual case.

Where are the limits of the initial orientation?

The check cannot replace the specific legal classification, technical review, group attribution, communication with authorities, evidence and contract analysis. An in-depth review is required especially for KRITIS, DORA, cloud/MSP roles, public contracting authorities, international groups and acute incidents.

Interactive questionnaire

Provisionally check NIS2 applicability

Please answer the questions as specifically as possible. The NIS2 command centre below the questionnaire continuously shows how your answers affect scope, category, readiness and reporting pressure.

1 of 5 steps

1. Which sector best describes your business?

Choose the focus that best describes your main service or your regulatory role.

Energy, transport, finance, health, water or critical supplyTypical sectors with high relevance for essential or important entities. Digital infrastructure, cloud, data centre, DNS, TLD, CDN or trust servicesDigital infrastructure and certain services are regularly particularly sensitive under NIS2. Managed IT, MSP, MSSP, IT outsourcing or B2B IT operationsIT service providers can be affected both directly and through customer requirements. Public administration, public body or space/satellitePublic and state-related functions need a separate classification. Manufacturing, chemicals, food, waste, postal/courier or researchOther sectors can be relevant as important entities or in supply chains. Online marketplace, search engine, social platform or digital servicePlatform and digital service models can combine NIS2, DSA, data protection and security issues. Supplier to regulated customers or critical projectsEven without clear direct applicability, contractual and practical cyber obligations can arise. Other or still unclear sectorNo clear mapping; indirect applicability remains possible.

2. Which size or special role applies?

The classification often depends on size, type of entity and special cases.

Special role: DNS, TLD, trust service, public electronic communications or KRITISKRITIS, DNS/TLD and qualified trust services are essential regardless of size; telecoms providers depending on size; other trust services important. The precise mapping is done by the precision check below. Large companyAt least 250 employees, or annual turnover above €50 million and at the same time a balance sheet total above €43 million (Section 28(1) no. 4 BSIG; figures of partner and affiliated companies generally included under SME Recommendation 2003/361/EC). Medium-sized companyAt least 50 employees, or annual turnover and balance sheet total each above €10 million (Section 28(2) no. 3 BSIG; check group attribution under Section 28(4) BSIG). Smaller company, but critical supplier or IT service providerBelow the thresholds, but with security requirements from customers, the group, insurers or clients. Public administration or public-law structureAuthority, municipal body, corporation under public law, outsourced public function or state-related IT. Unclear: group structure, thresholds or attribution openEmployees, turnover, balance sheet total or affiliated companies still need to be clarified.

3. Which criticality and risk signals apply?

Multiple selection is possible.

An outage would have significant consequences for customers, supply, patients, citizens or operationsThe service is essential for business processes, supply or public processes. Active EU-wide, across borders or group-wideServices, users, locations, customers or data flows involve several countries. Sensitive data, trade secrets, access credentials or infrastructure dataThe need for protection is higher because of the type of data, customer base or system access. Critical supply chain, cloud, MSP, SaaS or outsourcing dependencyOther regulated entities depend on your service or your service providers. Interface with DORA, CRA, KRITIS, GDPR, TKG or special supervisionSeveral cyber, data protection, product or resilience regimes may apply in parallel. No particular criticality apparentIn your assessment, the service has only limited external impact.

4. Which security and governance building blocks are robustly implemented?

Please only select what is documented, assigned and usable in practice.

ISMS, risk analysis, security concept or BSI/ISO-based control systemRisks, controls, responsibilities and evidence are documented. Management governance, reporting lines and trainingManagement body, CISO/IT, legal/compliance and escalations are defined. Incident response process with reporting and communication channelsRoles, 24h/72h/1-month logic, forensics, crisis team and customer communication are prepared. Business continuity, backup, restore tests and recoveryBCM, emergency plans, RTO/RPO, fallback processes and tests are in place. Supply chain, cloud, MSP and SaaS managementSecurity annex, reporting obligations, audit rights, subcontractors, exit and evidence are defined. IAM, MFA, authorisation concept, admin protection and joiner/mover/leaverAccess rights are role-based, reviewed and technically secured. Logging, monitoring, vulnerability, patch and asset managementDetection, prioritisation, treatment and evidence of security risks are established. No structured NIS2/cyber readiness status yetIndividual measures may exist, but there is no robust overall picture.

5. Is there acute or short-term pressure to act?

Multiple selection is possible.

Current security incident, ransomware, outage, data exfiltration or supply chain incidentA significant disruption or an attack is currently being investigated. Became aware less than 24 hours agoAn early warning and triage can be time-critical. Became aware 24 to 72 hours ago or longerThe 72-hour notification logic and the final report should be reviewed. Registration, self-classification or point of contact still unresolvedApplicability, category, reporting channels and contact with authorities are not documented. Customer, group, insurer, auditor or tender requires evidenceA questionnaire, contract clauses, security annex or audit is pending. Go-live, product launch, migration, outsourcing or contract signing is imminentCybersecurity and evidence are relevant to decisions in the short term. Preventive review without an acute incidentApplicability, gaps and next steps are to be clarified in a structured way.

Precision check under Section 28 BSIG

Classification with thresholds, group attribution and special cases

The precision check follows the structure of Section 28 BSIG and the BSI applicability check. It adds exact thresholds and exceptions to the check above. Your details stay in your browser.

Do you operate a critical facility (KRITIS)?Yes, we operate a critical facility within the meaning of Section 2 no. 22 BSIG.

Which type of entity applies most closely?What matters is the type of entity, not the name of the industry.

Do you offer this service for remuneration, and is it more than a minor activity?Relevant for types of entity under Annexes 1 and 2.We offer the service to other persons for remuneration.The activity is negligible in relation to the overall business activity (Section 28(3) BSIG).

Size of the entityEmployees alone are sufficient; for turnover and balance sheet, both figures must exceed the threshold.

EmployeesAnnual turnover in € millionBalance sheet total in € million

Do you belong to a group of companies?Attribution under Section 28(4) BSIG and Recommendation 2003/361/EC.

Are you a financial entity within the meaning of DORA?Yes, we are subject to Regulation (EU) 2022/2554 (DORA).

Deadlines and risks

Typical NIS2/cybersecurity review points

Review point	Typical trigger	Measure	Priority
Applicability review	NIS2/BSIG sector, size criterion, special role, group structure or critical supply chain	Document sector, type of entity, size, affiliated companies and customer requirements	Immediately
Registration and points of contact	Direct applicability as an important or essential entity	Register in the BSI portal no later than three months after becoming subject to the obligations (Section 33 BSIG; for entities already covered on 06.12.2025 this expired on 06.03.2026), define contact details, IP address ranges, internal responsibilities and reporting channels; report changes within two weeks	Immediately, if still open
Management	NIS2/BSIG management duties	Implement risk management measures and monitor their implementation (Section 38(1) BSIG), document regular management training (Section 38(3) BSIG) and establish reporting lines	Immediately to 30 days
Range of fines	Breach of risk management or reporting obligations (Sections 30, 32 BSIG) or of the registration obligation (Section 33 BSIG)	Essential entities up to €10 million or 2%, important entities up to €7 million or 1.4% of worldwide annual turnover (the percentage applies if turnover exceeds €500 million); failure to register up to €500,000 (Section 65 BSIG). Section 65 BSIG does not apply to the federal administration.	For the risk assessment
Incident reporting	Significant security incident or suspected significant impact	Early warning within 24 hours, notification within 72 hours, intermediate report on request, final or progress report after one month (Section 32 BSIG), review forensics and preservation of evidence	Acute
Supply chain and outsourcing	Cloud, MSP, SaaS, subcontractors or critical IT service provider	Review the security annex, reporting obligations, audit rights, exit, subcontractors and evidence	30 to 90 days
Interfaces	GDPR data breach, DORA, CRA, KRITIS, TKG, product safety or customer audit	Synchronise parallel obligations, reporting deadlines, evidence documentation and communication	Depends on the individual case

After the classification: registration and reporting obligations in detail

Two articles (in German) continue where the check ends, with statutory text, deadlines and practical examples.

Missed the NIS2 registration? Deadline, range of fines and catching up Why the three-month deadline under Section 33 BSIG ended for existing entities on 06.03.2026, what 31.07.2026 meant and how to document the self-classification under Section 28 BSIG.Read the article on registration (in German)Reporting a cyber incident: NIS2, CRA, GDPR and DORA deadlines compared 24-hour early warning, 72-hour notification and final report under Section 32 BSIG, compared with Art. 33 GDPR, DORA reporting and the CRA reporting platform.Read the article on reporting obligations (in German)

Sensible next steps

Related ITMR checkers and follow-up reviews

CRA CheckChecks whether software, hardware or connected products trigger additional product cybersecurity and reporting obligations. Data Breach Risk Check Helps with GDPR breach triage, the 72-hour deadline, informing data subjects and preserving evidence. Interactive risk matrix / Risk CockpitPrioritises cyber, compliance and business risks by extent of damage, likelihood, proximity of deadlines and effort. Regulatory timeline Places NIS2, CRA, Data Act, AI Act, BFSG and other digital obligations on a timeline. Document Dossier BuilderStructures evidence, policies, incident documents, contracts and audit documents for your inquiry. DPA Check Checks data protection and data processing interfaces for cloud, SaaS, MSP and IT outsourcing.

Clarify NIS2 applicability in a legally and technically structured way

If your business operates in a NIS2 sector, runs critical IT services, faces customer or audit pressure or has a security incident, the classification should be documented promptly. Helpful are a sector description, size data, a list of service providers, security documentation, incident runbooks, customer questionnaires and existing contracts.

Prepare an inquiry to ITMR

Legal orientation note

This NIS2 check provides a structured initial orientation and does not replace legal advice in the individual case. Whether an important or essential entity exists, which registration, management, reporting, evidence and security measures specifically apply and how national detailed requirements are to be implemented must be reviewed on the basis of the specific organisation, services, customers, group structure, technical systems and current authority practice. How we implement the requirements in the organisation and supply chain is described on our page Implementing NIS2; further topics can be found in the section Cybersecurity.