OT Governance Radar

NIS2 obligations in Germany (NIS2UmsuCG)

transposed Last verified 28 Oct 2026 · secondary source · regulator sources added

StatusTransposed
Adopted5 Dec 2025
In force6 Dec 2025
National lawGesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung (NIS2UmsuCG) —...
Registration portalBSI-Portal (via Mein Unternehmenskonto)
CommissionReasoned opinion, 7 May 2025

BSI: law promulgated 5 Dec 2025, in force 6 Dec 2025. Source

Competent authority & CSIRT Legal ref: § 1

  • Federal Office for Information Security (BSI) is the supervisory authority; around 29,500 "particularly important" and "important" entities fall under BSI supervision (previously ~4,500 regulated organisations). bsi.bund.de · 28 Oct 2026 · source-checked
  • Federal Office for Information Security. BSI (Bundesamt für Sicherheit in der Informationstechnik). ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: § 28, Annex 1, 2

  • Entities must self-assess whether they are in scope based on sector plus statutory thresholds for employees, turnover and balance sheet. bsi.bund.de · 28 Oct 2026 · source-checked
  • The law introduces changes in sectors and subsectors. ecs-org.eu · 28 Oct 2026 · secondary source
  • Sectors of particularly important (essential) and critical entities (ICT service management and federal administration excluded): ecs-org.eu · 28 Oct 2026 · secondary source
  • Hydrogen, part of the gas supply subsector. ecs-org.eu · 28 Oct 2026 · secondary source
  • Banking and financial market infrastructure as subsectors under the finance sector. ecs-org.eu · 28 Oct 2026 · secondary source
  • Drinking and wastewater as subsectors under the water sector. ecs-org.eu · 28 Oct 2026 · secondary source
  • Sectors of important entities: ecs-org.eu · 28 Oct 2026 · secondary source
  • Transport and traffic sector, with postal and courier services as a subsector. ecs-org.eu · 28 Oct 2026 · secondary source
  • The threshold for companies is lower as the criteria of company size count individually in terms of employees and turnover (companies with less than 50 employees are also potentially affected). ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: § 33

  • Two-step registration: (1) "Mein Unternehmenskonto" (MUK), using an ELSTER organisation certificate; (2) registration in the BSI-Portal. bsi.bund.de · 28 Oct 2026 · source-checked
  • Register no later than three months after first (or renewed) falling in scope; changes must be reported without delay, at the latest within two weeks, via the BSI-Portal. Separate registration duties may apply to KRITIS operators and digital services/infrastructure. bsi.bund.de · 28 Oct 2026 · source-checked
  • For entities in scope at entry into force (6 Dec 2025), the three-month window implies a deadline of 6 Mar 2026 (derived; BSI states the three-month rule). bsi.bund.de · 28 Oct 2026 · needs verification
  • Entities are requested to provide the following information to the Federal Office no later than 3 months after they are classified as important or essential: ecs-org.eu · 28 Oct 2026 · secondary source
  • Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
  • Address and contact details. ecs-org.eu · 28 Oct 2026 · secondary source
  • IP address. ecs-org.eu · 28 Oct 2026 · secondary source
  • Sector and industry classification. ecs-org.eu · 28 Oct 2026 · secondary source
  • List of member states where the entity provides services (if applicable). ecs-org.eu · 28 Oct 2026 · secondary source
  • Responsible authorities. ecs-org.eu · 28 Oct 2026 · secondary source
  • The information is submitted via a registration facility set up jointly by the Federal Office and the Federal Office for Civil Protection and Disaster Assistance. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: § 32

  • Significant incidents are reported to the BSI via the BSI-Portal ("Sicherheitsvorfall melden"): early warning without undue delay and at the latest within 24 hours; follow-up notification within 72 hours (assessment, severity, impact, IoCs where available); final report after one month (§ 32 BSIG). bsi.bund.de · 28 Oct 2026 · source-checked
  • The BSI-Portal went live on 6 Jan 2026 as the reporting point; entities not yet registered report via an online form; KRITIS operators and federal bodies temporarily keep their existing reporting channels. bsi.bund.de · 28 Oct 2026 · source-checked
  • Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
  • Early warning within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
  • Incident report within 72 hours. ecs-org.eu · 28 Oct 2026 · secondary source
  • Interim report with up-to-date information at the request of the Federal Office for Information Security. ecs-org.eu · 28 Oct 2026 · secondary source
  • Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
  • Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report after it has been processed by the relevant entity. ecs-org.eu · 28 Oct 2026 · secondary source
  • Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

  • Management of particularly important and important entities must implement the § 30 risk-management measures and monitor their implementation (§ 38(1) BSIG). gesetze-im-internet.de · 28 Oct 2026 · source-checked
  • Managers who culpably breach these duties are liable to the entity under the applicable company-law rules (§ 38(2) BSIG). gesetze-im-internet.de · 28 Oct 2026 · source-checked
  • Management must attend training regularly to identify and assess IT-security risks and risk-management practices (§ 38(3) BSIG); BSI publishes a non-binding training guide and sample curriculum. bsi.bund.de · 28 Oct 2026 · source-checked

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: § 65

  • Major non-compliance offence: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 10 000 000 EUR or 2% of global annual turnover for particularly important (essential) entities. ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 7 000 000 EUR or 1.4% of global annual turnover for important entities. ecs-org.eu · 28 Oct 2026 · secondary source
  • Failure to notify authorities: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 5 000 000 EUR for all. ecs-org.eu · 28 Oct 2026 · secondary source
  • Non-compliance with orders: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 2 000 000 EUR for all entities. ecs-org.eu · 28 Oct 2026 · secondary source
  • Failure to provide proof: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 1 000 000 EUR for all entities. ecs-org.eu · 28 Oct 2026 · secondary source
  • Other offences: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 500 000 for all. ecs-org.eu · 28 Oct 2026 · secondary source
  • Lesser offences: ecs-org.eu · 28 Oct 2026 · secondary source
  • Up to 100 000 for all ecs-org.eu · 28 Oct 2026 · secondary source
  • Turnover-based fines are applicable to large entities (over 500 000 000 EUR global turnover) ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

Supervisory guidance

Key dates

  • Germany: registration deadline for entities in scope at entry into force (3 months, derived)
    bsi.bund.de needs verification

What changed recently

  1. BSI-Portal live for registration and incident reporting bsi.bund.de source-checked
  2. NIS2UmsuCG / revised BSIG in force bsi.bund.de source-checked

Sections marked secondary source come from the ECSO NIS2 Transposition Tracker (updated 10 Sep 2026), which simplifies law extracts; source-checked items were read on the regulator's or official gazette's site. Data: data/nis2/. Not legal advice — always check the official text.