Security & Compliance NIS2 – Overview & Solutions

What is NIS2, and who is covered?

NIS2 is an EU directive that, from October 2024, imposes higher requirements for cybersecurity. Companies in sectors such as energy, healthcare, transport, finance, and digital services are particularly affected.

Reporting obligations in the DACH countries

Executive Summary:
Germany (DE) and Austria (AT) are bound by the EU’s common reporting requirements under the NIS2 directive, which include an initial notification within 24 hours. Switzerland (CH) implements similar strict requirements independently through the Information Security Act (ISG) and the NCSC’s reporting obligation. The main differences lie in the responsibilities of the authorities and the specific national requirements.

Country	Authority	Core requirements	Deadline(s)
🇩🇪 Germany	Federal Office for Information Security (BSI)	24h initial notification, 72h detailed report, 1-month final report	24h / 72h / 30 days
🇦🇹 Austria	Federal Ministry of the Interior (BMI) + CERT.at	Reporting via nis.cert.at	24h / 72h
🇨🇭 Switzerland	National Cyber Security Centre (NCSC)	Only 24h initial notification + ongoing updates	24h

👉 In practice: A unified 24h reporting setup with subsequent updates covers all three markets.

Key points:

All three countries require an initial notification within 24 hours in the event of serious incidents.
DE & AT follow the EU requirements (Art. 23 NIS2), while CH has established an independent system (ISG/NCSC) that is equally strict in substance.
For companies in the DACH region, it is advisable to implement a unified internal reporting process (24h + 72h + final report) that covers both EU and Swiss requirements.

Sources:

BSI guideline / NIS2UmsuCG (DE), status 03/2025
Austria’s NIS2 implementation (AT), BMI/CERT.at, status 05/2025
EU Directive 2022/2555 (NIS2), Article 23 – reporting obligation
NCSC Switzerland, reporting obligation under ISG, status 04/2025

Governance & Documentation (Policy section)

Executive Summary
Governance and documentation are central elements of NIS2 compliance. Companies in Denmark covered by NIS2 must establish clear responsibilities, document decision-making processes, and be able at any time to prove that risk management measures are effectively implemented. This section ensures that governance structures are anchored and that documentation is maintained systematically.

Governance

Responsibilities:

Executive management holds overall responsibility for NIS2 compliance.
The CISO (Chief Information Security Officer) is responsible for operational implementation, risk assessment, and managing measures.
The Compliance Officer monitors adherence to legal requirements, prepares reports, and coordinates audits.
All departments are obliged to immediately report security-related incidents.

Decision-making structures:

Establishment of a Cyber Security Steering Committee with representatives from IT, legal, compliance, and business units.
Quarterly meetings with reporting obligations to executive management.
Defined escalation paths documented in a reporting plan.

Documentation

Requirements:

All risk assessments, action plans, and incidents must be documented in a central system with audit-proof records.
Changes to processes must be versioned and traceable.
Preparation for and support of internal and external audits.

Reporting:

Annual governance report to executive management including the status of risks, measures, and incidents.
Evidence of compliance with the 24h reporting obligation.
Use of KRIs (Key Risk Indicators) and KPIs (Key Performance Indicators) to measure effectiveness.

Audit & compliance control:

Preparation for external audits (e.g., ISO 27001, BSI standards).
Integration of “test once, comply to many” principles to reuse documentation across multiple standards.
Retention of documentation for at least 5 years, where legally required.

Sources

EU NIS2 Directive (2022/2555), Articles 21–23 – requirements for governance, risk management, and reporting
BSI guideline on NIS2 implementation, DE, 03/2025 – Chapter 5 Governance & Documentation
KPMG Whitepaper on NIS2 Readiness, 05/2023 – Governance, responsibilities & documentation

Next step: Establish a central documentation system (e.g., ISMS tool) where governance reports, risk assessments, and incident reports are systematically recorded and ready for audits.

Frequently Asked Questions (FAQ) about NIS2

Introduction
The NIS2 Directive (EU 2022/2555) obliges companies in critical and important sectors to raise their cybersecurity standards. From October 2024, the rules will apply to more companies across the EU – including Denmark – as well as partners in the supply chain. Customers therefore want to know how their providers are handling these obligations.

1. What is the NIS2 Directive?
An EU requirement that sets minimum standards for cybersecurity and the reporting of IT security incidents. The aim is to protect critical infrastructure and digital services from cyberattacks.

2. Does NIS2 also apply to our company?
Yes, if you operate in one of the specified sectors (energy, transport, healthcare, finance, digital services) and meet certain size criteria. Suppliers in the value chain may also be covered.

3. What obligations come with it?

Implementation of risk management
Ongoing security and vulnerability analyses
Reporting of significant incidents within 24 hours
Documentation for authorities
Management responsibility and training

4. How does this affect our cooperation?
We implement all relevant NIS2 requirements:

Ensuring service continuity
Transparent communication in the event of incidents
Monitoring our subcontractors for NIS2 compliance

5. What deadlines apply?

Initial notification: 24 hours
Follow-up report: 72 hours
Final report: no later than 1 month

6. What sanctions apply for non-compliance?
Fines of up to EUR 10 million or 2% of global turnover.

7. What role does management play?
Executive management bears direct responsibility. Non-compliance may lead to personal liability for the management.

8. Which authorities are responsible?

🇩🇪 Germany: BSI
🇦🇹 Austria: Federal Chancellery & Ministry of the Interior (via CERT.at)
🇨🇭 Switzerland: NCSC (national system, not EU)
🇩🇰 Denmark: Center for Cyber Security (CFCS)

9. Do small companies also need to comply with NIS2?
Yes, if they act as suppliers to critical sectors or are considered of particular importance. Otherwise, simplified rules apply.

10. How do we prepare together?

Assessment of classification (essential / important / outside scope)
Establishment of internal reporting and escalation processes
Regular security audits
Dialogue with us on interfaces in the supply chain

Sources:

EU Directive 2022/2555 (NIS2), 14.12.2022
EPRS Briefing NIS2, 02/2023
BSI: NIS2 implementation in DE, 05/2025
Federal Chancellery AT: NIS2, 05/2025
NCSC Quick Guide NIS2, 2024
KPMG Whitepaper NIS2, 05/2023

It is recommended to assess your classification under NIS2 and designate clear internal responsibilities. I are happy to support you with further information.

Get your Security & Compliance NIS2 in professional German

Communicate your NIS2 compliance clearly and credibly in German to the DACH market – with governance, documentation, and reporting pathways formulated in a language that authorities, customers, and partners understand.

How I work:

There are two typical scenarios:

You have already prepared your internal NIS2 compliance
– I ensure that the text is communicated professionally in German, ready for customers, partners and authorities in Germany, Austria and Switzerland.

You do not yet have a completed compliance text
– I create a full German Security & Compliance page from scratch, tailored to your industry and responsibilities.

Next step

Contact me directly via e-mail:
📧 [email protected]

Briefly describe your situation (scenario 1 or 2), and I will get back to you with a proposal for process and pricing.

What you get:

Professional German compliance texts with documented sources
Industry-specific adaptation (SaaS, industry, MedTech, etc.)
Clear structure: Governance → Documentation → Reporting obligations → Supplier requirements → FAQ
Options: NDA, SEO optimization, diagrams (DACH reporting chain), CMS implementation
Pricing depends on industry, scope and number of entities.

“The solution not only provides documentation for internal use (compliance & audits), but can also be used externally as a trust page for customers and partners.”

Security & Compliance NIS2 in German – Is your company ready?