NIS2 compliance in Germany

NIS2 compliance in Germany at a glance

Registration comes first: the BSI asks every entity covered by NIS-2 to register in its portal with an ELSTER organisation certificate, and it notes that the statutory registration deadline has already passed. Germany's implementation act — the Gesetz zur Umsetzung der NIS-2-Richtlinie, published as BGBl. 2025 I Nr. 301 — rewrote the BSI-Gesetz, and § 30 now requires particularly important and important entities to take appropriate, proportionate and effective technical and organisational measures, documented and covering risk analysis, incident handling, business continuity, supply-chain security, cryptography, access control and multi-factor authentication. Operators of critical facilities must also prove implementation to the BSI through security audits, examinations or certifications. There is no NIS-2 certificate, and the BSI is explicit that ISO/IEC 27001 certification covers a large part of the measures but not all of them. Sterling's Frankfurt office runs the applicability check, gap analysis and documentation for the whole regulated entity. German specifics follow.

Who needs NIS2 in Germany, and what happens without it

These are the organisations in Germany that most often need to show NIS2.

• Particularly important and important entities§ 30 BSIG risk-management measures and § 33 BSIG registration apply.
• Operators of critical facilities§ 39 BSIG proof by security audits, examinations or certifications.
• Energy network operatorsExisting IT-Sicherheitskatalog obligations continue until a new catalogue is published.
• Suppliers to NIS-2 entitiesSupply-chain security is one of the required measures.

NIS2 requirements in Germany

Strip away the vocabulary and NIS2 asks essential and important entities to comply in six areas of cyber risk management.

In Germany these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: NIS2 explained →

How to achieve NIS2 compliance in Germany

One team from the Frankfurt office carries the work from scoping to sign-off. All German states (Länder), on-site from Frankfurt; remote delivery for distributed teams.

1. Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
2. Gap assessment against NIS2 and the German requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
3. Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
4. Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
5. Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.

The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.

How long does NIS2 compliance take in Germany?

There is no standard duration: it depends on your scope and on how much of the system already runs. In Germany these are the factors that set the timeline.

• Whether the entity is particularly important, important or a critical-facility operator
• Existing ISMS or IT-Grundschutz implementation
• Management-training and reporting arrangements
• Scope covering the whole regulated entity

Sterling agrees a dated plan with you on the discovery call, once the scope is known.

• Scope and timeline estimator

How much does NIS2 compliance cost in Germany?

The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Germany these factors move both.

• Size and number of entities in scope
• Control remediation across the whole entity
• External audit for critical-facility proof where required

Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.

NIS2 consultants and assessors in Germany

Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.

• Check that the body’s accreditation or approval covers NIS2 and your sector, and that its certificates can be verified online.
• Ask the consultant how the local requirements in Germany are mapped into the same system, so nothing runs twice.
• Ask for client references in your sector; Sterling’s client letters are available on request.
• Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.

NIS2 in Germany: questions clients ask

More on NIS2 for German organisations

• NIS2: the complete guide
• Watch: How to comply with the NIS2 Directive
• Sterling in Frankfurt
• NIS2 compliance in Germany and every other standard Sterling delivers there

Other standards German businesses ask Sterling for

Organisations in Germany often combine NIS2 with one of these, under one management system where the scopes allow.

All 23 standards Sterling delivers in Germany →