NIS2 affects around 29,500 companies. The deadlines have passed.
If the BSIG as amended by the NIS2UmsuCG applies to you, you must register with the BSI and prove risk management under Art. 21 NIS2. We deliver the technical part: a pentest with a report that follows the requirements catalogue.
Report mapped to Art. 21(2)
Usable for BSI evidence and internal audits
Free initial consultation
Where do you stand? The thresholds of section 28 BSIG
What counts is sector, headcount and financial figures. Headcount OR the financial figures are enough; for the financial figures, turnover AND balance sheet total must both be exceeded.
fewer than 50 employees
Not affected
Less than €10m annual turnover AND balance sheet total
Exception: trust service providers, DNS and other special cases are covered even as micro-enterprises
50 employees or more
Important entity
Or more than €10m turnover AND more than €10m balance sheet total
Active in one of the 14 sectors of Annex 1 or Annex 2 BSIG
Supervision tends to be reactive, triggered by an occasion
250 employees or more
Particularly important entity
Or over €50m turnover AND over €43m balance sheet total
In one of the 7 sectors of high criticality (Annex 1), such as energy, health, finance
Supervision is proactive: the BSI checks on its own initiative
Micro-enterprise50 employees250 employees
Qualified trust service providers, TLD registries and certain telecom providers are covered regardless of size.
Where implementation stands
6 Dec 2025NIS2UmsuCG in force, with no transition period
6 Mar 2026Regular BSI registration deadline, now passed
31 Jul 2026BSI forbearance period, also passed
around 60%As of 30 Jun 2026: 17,729 registered, against around 29,500 entities expected
What we deliver and what we don't
From us
Pentest within the agreed scope: physical, infrastructure, Active Directory, web app, social engineering
Report with Art. 21 mapping, management summary and a prioritised remediation plan
Re-test once you have fixed the findings
Not from us
Registration with the BSI: nobody can do that for you
The legal classification of your entity: that is legal advice
A certification. We test and document, we do not issue a seal
Reporting deadlines under Art. 23 NIS2
A significant security incident triggers a three-stage reporting process with the BSI.
24 hours
Early warning
A brief notice on whether the incident is suspected to result from unlawful acts or has cross-border effects.
72 hours
Incident notification
Assessment of severity and impact, plus initial indicators of compromise.
1 month
Final report
Description of the incident, root cause analysis and the countermeasures taken.
The Art. 21(2) catalogue and what a pentest covers of it
Art. 21(2) NIS2, transposed nationally as section 30(2) BSIG, names ten areas of measures. Letter f requires a procedure for assessing how effective your measures are. That is exactly what an independent test is.
aRisk analysis and security conceptPhysical, infra, AD
bIncident handlingall modules
cBusiness continuity and backupInfrastructure
dSupply chain securitySocial engineering, OSINT
eAcquisition, development and maintenanceWeb app
fEffectiveness assessmentall modules
gCyber hygiene and awarenessSocial engineering
hCryptography and encryptionInfrastructure, web app
iHR security, access control and asset managementInfrastructure, AD
jMulti-factor authenticationAD, web app
How a finding becomes evidence
Server room without access controlArt. 21(2)(a)
Active Directory: Kerberoasting, four accounts taken overArt. 21(2)(i)
Phishing simulation: high click rate during the test periodArt. 21(2)(g)
VPN with a deprecated protocol (IKEv1)Art. 21(2)(h)
Example findings. Every finding gets its place in the catalogue (a to j), together with severity and a remediation measure.
What non-compliance can cost
Particularly important entities: up to €10m or 2% of global group turnover, whichever is higher
Important entities: up to €7m or 1.4% of global group turnover
Personal liability of management under Art. 20 NIS2 and section 38 BSIG, which cannot be excluded by contract
Frequently asked questions
Is a penetration test mandatory for NIS2?
NIS2 does not prescribe a testing method, but it does require demonstrable technical measures. The pentest is the recognised instrument for that. Without regular tests, if something happens, the burden is on you to show that you did enough.
How often do we have to test?
NIS2 sets no testing interval. A full test at regular intervals makes sense, plus one after significant IT changes such as new systems, restructuring or incidents.
Ready for your NIS2 evidence?
In a free 30-minute initial consultation we clarify the scope. After that you receive a fixed-price offer.
