Sec. 28 BSIG distinguishes two obligation tiers based on sector, headcount and financial figures. The employee/turnover thresholds apply alternatively (either one), while turnover AND balance sheet total must both be exceeded together for the financial threshold.
The EU directive itself uses the terms "essential" and "important" entities. German law (BSIG) translates these as "particularly important" and "important entities". Same two-tier concept, just different labels. Not sure where you stand? We'll clarify it in a free initial consultation.
Our free NIS2 applicability check walks you through the assessment order of section 28 BSIG - including the complete Annex 1 and Annex 2 sector lists and the KRITIS thresholds. The outcome is a non-binding initial assessment with its reasoning, not legal advice and not a binding classification.
NIS2 covers 18 sectors of the directive. Germany's BSIG groups them into 14: seven in Annex 1 (sectors of high criticality) and seven in Annex 2. Whether you are in scope depends on the combination of sector, type of entity and size.
Art. 21(2) NIS2 (transposed nationally as Sec. 30(2) BSIG) defines ten measure areas (a-j) that every affected entity must implement. A penetration test provides measurable, technical evidence for most of them.
NIS2 requires systematic identification and assessment of risks to network and information systems. Our pentest delivers a realistic, current risk picture based on actual attack vectors instead of paper-only compliance.
Significant security incidents must be reported to the BSI in stages: an early warning within 24 hours, an initial assessment within 72 hours, and, on request, a final report within one month (Art. 23 NIS2). The pentest uncovers the entry points before they turn into a real, reportable incident.
We test whether critical systems and backups are protected against real attacks, including ransomware scenarios, recovery capability and network segmentation as the basis for crisis management and disaster recovery.
Art. 21(2)(d) in conjunction with Art. 21(3) requires risk assessment of direct suppliers and service providers. Social engineering and OSINT show concretely how attackers can enter your organisation via third parties, remote-access channels, or a compromised supplier.
New systems and software must be securely procured, developed and maintained, including vulnerability handling and disclosure. Our web app pentest checks exactly these systems, before and after go-live, for exploitable vulnerabilities.
NIS2 requires procedures to regularly assess the effectiveness of your own risk-management measures. An independent penetration test is exactly that: an objective, technical effectiveness check, not a self-assessment, but a real attack attempt.
Basic hygiene practices and regular staff training are mandatory. Our phishing and vishing simulations provide empirical evidence of how effective your awareness measures really are, with hard numbers instead of guesswork.
Training for staff and management →
Policies on the use of cryptography and encryption for data at rest and in transit are mandatory. We test TLS configurations, deprecated protocols (e.g. IKEv1 on VPNs) and unencrypted backups for real-world attack surface.
Segmentation, privilege models, privileged access and a clean asset inventory: we test whether your Active Directory and network form a real attack barrier or are only secure on paper.
MFA or continuous authentication is mandatory for access to network and information systems (Sec. 30(2) no. 10 BSIG in conjunction with CIR 2024/2690), as is secured voice, video and text communication. We systematically test where single-factor access and weak authentication remain exposed.
The NIS2 Implementation Act (NIS2UmsuCG) was passed by the Bundestag on 13 Nov 2025, approved by the Bundesrat on 21 Nov 2025, and entered into force on 6 Dec 2025 upon publication in the Federal Law Gazette, with no further transition period. The regular BSI registration deadline (6 March 2026) and the grace period the BSI subsequently granted (31 July 2026) have both since passed. Companies that have not yet registered should do so immediately to avoid regulatory consequences.
A significant security incident triggers a three-stage reporting process with the BSI. These deadlines apply regardless of whether you have already run a pentest, but knowing your attack surface gets you through all three stages much faster.
A brief notice on whether the incident is suspected to result from unlawful acts or could have cross-border effects.
Assessment of the severity and impact of the incident and, where available, initial indicators of compromise.
Detailed description of the incident, root cause analysis, mitigation measures taken, and any cross-border impact.
Particularly important entities: fines of up to €10m or 2% of global group annual turnover, whichever is higher
Important entities: fines of up to €7m or 1.4% of global group annual turnover
Lesser violations (e.g. of cooperation or registration duties) are sanctioned on a graduated scale starting at €100,000
From scoping to NIS2-compliant final report: structured, documented, and designed for demonstrability.
We jointly define the test scope and map it to the relevant NIS2 requirement articles. This ensures the report delivers the right compliance evidence from the start.
Information gathering via publicly available sources (OSINT), network scans and attack planning according to the state of the art.
Manual exploitation within the agreed scope: physical, digital or both. We communicate critical findings immediately so you can act.
Every finding is rated by severity, exploitability and business impact, with direct reference to the NIS2 requirements catalogue.
Complete documentation of all findings with recommendations, management summary and NIS2 compliance mapping. Suitable for BSI audits and internal evidence.
NIS2 does not prescribe a specific testing method, but the following modules cover the most relevant requirements and provide the strongest evidence.
Simulated break-in attempt at your company premises. Covers Art. 21(2)(a) risk analysis and physical security measures, often the underestimated attack vector.
Learn moreNetwork segmentation, firewall rules, privileged access, AD hardening. Directly relevant for Art. 21(2)(i) access control & asset management and (j) multi-factor authentication.
Learn morePhishing, vishing, pretexting. Shows how vulnerable your organisation is to the human factor: NIS2 Art. 21(2)(g) cyber hygiene & awareness and (d) supply chain security.
Learn more