Ist unser Stadtwerk von NIS2 betroffen?

Sehr wahrscheinlich. Unter NIS2 fallen Unternehmen der Energie- und Wasserwirtschaft ab 50 Beschäftigten oder mehr als 10 Mio. € Umsatz und Bilanzsumme. Für Betreiber von Strom- und Gasnetzen gelten die IT-Sicherheitspflichten nach § 5c EnWG sogar unabhängig von der Unternehmensgröße. Ob Sie als wichtige oder besonders wichtige Einrichtung gelten, hängt von Größe und Sparten ab - unser kostenloser NIS2-Check gibt eine erste Einschätzung.

Gilt für uns das BSI-Gesetz oder das Energiewirtschaftsgesetz?

Oft beides, je nach Sparte. Für Energieversorgungsnetze und bestimmte Energieanlagen regeln die §§ 5c bis 5e EnWG die IT-Sicherheit, Melde- und Schulungspflichten. Für andere Tätigkeiten wie Wasser, Abwasser oder Fernwärme gilt in der Regel das BSI-Gesetz. Die genaue Abgrenzung ist im Einzelfall zu prüfen. Die Grundpflichten - Risikoanalyse, Schutzmaßnahmen, Meldungen, Schulung der Geschäftsleitung - sind in beiden Fällen ähnlich.

Was sollten wir als Erstes tun?

Vier Schritte: Registrierung beim BSI, falls noch nicht erfolgt (Frist: drei Monate nach Eintritt der Pflicht). Eine Risikoanalyse, die zeigt, wo Sie am verwundbarsten sind. Ein Meldeprozess, damit die 24-Stunden-Frühwarnung im Ernstfall klappt. Und eine Schulung der Geschäftsleitung. Im kostenlosen Risk Assessment gehen wir diese Punkte mit Ihnen durch.

Muss sich die Geschäftsführung wirklich selbst schulen lassen?

Ja. Sowohl das BSI-Gesetz (§ 38) als auch das Energiewirtschaftsgesetz (§ 5e) verpflichten die Geschäftsleitung, die Sicherheitsmaßnahmen umzusetzen, ihre Umsetzung zu überwachen und regelmäßig an Schulungen teilzunehmen. Bei Pflichtverletzungen haftet sie nach den gesellschaftsrechtlichen Regeln. Unser Awareness-Training enthält ein eigenes Modul für die Geschäftsleitung.

Ersetzen Sie unser ISMS oder die Zertifizierung?

Nein. Wir sind keine Zertifizierungsstelle und bauen auch kein ISMS für Sie auf. Wir liefern die operativen Bausteine, die Ihr ISMS braucht - Risikobewertung, Awareness-Training, Phishing-Simulation, Vulnerability Management und Incident Response - und die Nachweise dazu, die Sie in Audits und Zertifizierungen verwenden können.

Betreuen Sie auch die Leittechnik?

Nein. Unser Fokus ist die Büro- und Verwaltungs-IT, die Mitarbeitenden und der Ernstfall. Leittechnik, Netzleitsysteme und Systeme zur Angriffserkennung im Netzbetrieb gehören nicht zu unserem Angebot. Dort stimmen wir uns mit Ihren bestehenden Partnern ab - etwa wenn ein Vorfall in der Büro-IT beginnt und die Grenze zur Leittechnik betrifft.

Was kostet das für ein Stadtwerk?

Das hängt von Größe, Anzahl der Standorte und der gewünschten Service-Tiefe ab. Sie können einzelne Services buchen oder alle vier kombinieren. Ein konkretes Angebot erhalten Sie nach dem kostenlosen Risk Assessment - in der Regel liegt das jährliche Investment deutlich unter den Kosten eines einzigen Ausfalls von Abrechnung und Kundenservice.

Wo werden unsere Daten gespeichert?

Projekt- und Falldaten speichern wir in Deutschland, auf unserer eigenen Infrastruktur bei der Hetzner Online GmbH. Vor Beginn schließen wir einen Auftragsverarbeitungsvertrag nach Art. 28 DSGVO. Welche Daten je Service anfallen, wo sie liegen und wie lange wir sie aufbewahren, beschreiben wir transparent auf unserer Seite Sicherheit & Datenverarbeitung.

Industries

Municipal Utilities and Energy Suppliers

NIS2 + EnWG + KRITIS · Obligations by Sector

Cybersecurity for Municipal Utilities and Energy Providers

Electricity, gas, heat, and often water: municipal utilities face obligations under NIS2, the Energy Industry Act (EnWG), and—depending on their size—critical infrastructure (KRITIS) regulations. We provide the building blocks to meet them: phishing simulation, awareness training, vulnerability management, and incident response—tailored for utilities without their own dedicated security team.

Free Risk Assessment

THE REALITY

Most of the time it doesn't affect the care itself — but everything around it.

Attacks on German municipal utilities follow a recurring pattern: office IT, billing, customer portals, and internal communications go down, while the utility supply itself continues uninterrupted. Nevertheless, this is a serious emergency for management and IT leadership—involving reporting obligations, liability issues, and customers who no longer receive bills.

67%

of companies in Germany were proven to have been affected by data theft, espionage, or sabotage in 2026, according to Bitkom—a further 29% suspect they were.

24 hrs

remain for the early warning to the BSI following a significant security incident – notification after 72 hours, final report after one month.

€10 million

Fine framework for essential entities in the event of breaches of security and reporting obligations.

Sources: Bitkom Economic Protection 2026 · Section 5d EnWG, Section 32 BSIG (reporting deadlines) · Section 95 EnWG, Section 65 BSIG (fines).

THE REALITY

Most of the time it doesn't affect the care itself — but everything around it.

67%

of companies in Germany were proven to have been affected by data theft, espionage, or sabotage in 2026, according to Bitkom—a further 29% suspect they were.

24 hrs

remain for the early warning to the BSI following a significant security incident – notification after 72 hours, final report after one month.

€10 million

Fine framework for essential entities in the event of breaches of security and reporting obligations.

Sources: Bitkom Economic Protection 2026 · Section 5d EnWG, Section 32 BSIG (reporting deadlines) · Section 95 EnWG, Section 65 BSIG (fines).

Regulatory context

Two laws, one public utility – which obligation applies depends on the division.

For electricity and gas networks, the IT security obligations of the Energy Industry Act apply, while for other sectors such as water, wastewater, or district heating, the BSI Act generally applies. The exact distinction must be reviewed on a case-by-case basis—the basic requirements are similar in both cases.

01 · NIS2 / BSIG

Important or particularly important facility

Municipal utilities with 50 or more employees, or with over €10 million in revenue and balance sheet total, fall under NIS2; those with 250 or more employees, or over €50 million in revenue and a balance sheet total of €43 million, are classified as essential entities. Obligations include: registration with the BSI, risk management in accordance with Section 30 of the BSIG, reporting within 24 hours, 72 hours, and one month, as well as implementation and oversight by executive management (Section 38 BSIG).

02 · EnWG (Energy Industry Act)

Energy Supply Networks and Energy Systems

For operators of electricity and gas networks, the obligations under Section 5c of the Energy Industry Act (EnWG) apply regardless of company size. The Federal Network Agency specifies these in the IT Security Catalogue, a revised version of which is currently being prepared. Incident reports must also be submitted to the BSI (Section 5d EnWG), and management is required to monitor implementation and undergo regular training (Section 5e EnWG).

03 · Critical Infrastructure

Critical Systems

Anyone operating facilities above the critical infrastructure (KRITIS) thresholds—the standard threshold is 500,000 people served—is subject to additional registration and verification obligations. For physical security, the KRITIS Umbrella Act also applies.

Legal sources: Energy Industry Act (Sections 5c–5e, 95 EnWG) · Federal Office for Information Security Act (Sections 28, 30, 32, 33, 38, 65 BSIG) · BSI Critical Infrastructure Ordinance (BSI-KritisV) · Critical Infrastructure Umbrella Act (KRITIS-Dachgesetz).

Regulatory context

Two laws, one public utility – which obligation applies depends on the division.

01 · NIS2 / BSIG

Important or particularly important facility

02 · EnWG (Energy Industry Act)

Energy Supply Networks and Energy Systems

03 · Critical Infrastructure

Critical Systems

TYPICAL ATTACK SCENARIOS

The attacks hitting municipal utilities today.

The entry routes are well-known and recurring. Those who understand them can set the right priorities—rather than investing a little bit everywhere.

Ransomware via phishing

The most common entry point: an email to customer service or administration, disguised as a meter reading submission, grid connection request, invoice, or job application. Following the click: propagation across the network, data exfiltration, and encryption—bringing billing and the customer portal to a complete standstill.

Attack via an IT service provider

Many municipal utilities share local data centers, billing systems, or service providers. If one of them is compromised, it affects multiple providers at the same time—often leading to data leaks before anyone even notices the attack.

Unpatched remote access

VPN gateways, firewalls, and remote maintenance access points with known, unpatched vulnerabilities. Attackers scan specifically for these—a single forgotten system is enough to gain access.

Payment Fraud and CEO Fraud

Fake payment instructions from executive management, manipulated supplier invoices, altered bank details. No technical intrusion, just well-crafted deception—and direct financial loss.

OUR SOLUTIONS

Four services that together make up your security program.

We take care of your office and administrative IT, your employees, and emergencies. Control systems and network intrusion detection are not part of our services—we collaborate with your existing partners in those areas.

Continuous training

Phishing simulation

Regular campaigns using everyday utility lures—meter reading submissions, grid connection requests, supplier invoices. Measurable click and report rates, ready to use as direct proof of mandatory training compliance.

Service

Employee Resilience

Awareness Training

Core course taking around 20 minutes a year plus short spotlights—for administration, customer service, technical staff, and on-call teams. Includes executive management training as required by NIS2 and the German Energy Industry Act (EnWG).

Service

Know the attack surface

Vulnerability Management

Continuous detection and assessment of vulnerabilities in your office and administrative IT, prioritized by risk rather than CVSS noise, with remediation tracking and audit-ready reports.

Service

IMMEDIATE HELP IN AN EMERGENCY

Incident Response

If it happens anyway: Initial assessment via the incident hotline, containment, analysis, recovery, and drafts for notifications to the BSI. Mon-Fri 9 am-5 pm, initial consultation is free of charge.

Service

WHY ENTROPY CS

Security tailored for municipal utilities - not for mega-corporations.

Most municipal utilities don't have their own security team and don't have time for 100-point action plans. They need clear priorities, reliable proof, and a partner who is there for them in an emergency.

Priorities instead of catalogues

We start where the risk is greatest—usually with phishing, unpatched access points, and the lack of an incident response plan. Step by step, alongside your existing team.

One proof for multiple obligations

Each of our services generates evidence that you can use for NIS2, EnWG, and ISO 27001. A one-time effort for multiple uses—including for regulators, the supervisory board, and auditors.

Supply has priority

Every measure—scan windows, training schedules, containment in an emergency—is coordinated to keep your operations running smoothly. Cybersecurity is a means to an end, not an end in itself.

Answers for municipal utilities and energy providers.

Questions frequently asked by managing directors and IT heads of municipal utilities. We address further questions in our free Risk Assessment.

Is our municipal utility affected by NIS2?

Does the BSI Act or the Energy Industry Act apply to us?

What should we do first?

Does executive management really need to undergo training themselves?

Do you replace our ISMS or certification?

Do you also support control systems?

How much does that cost for a municipal utility?

Where is our data stored?

FREE RISK ASSESSMENT

30 minutes. An honest picture of your security posture.

Every conversation starts with a free risk assessment – 30 minutes, no obligation. Afterwards, you will receive a written report outlining your cybersecurity maturity level, risk areas, and immediate actions.

Book assessment now

Call: +49 30 863283641

FREE RISK ASSESSMENT

30 minutes. An honest picture of your security posture.

Book assessment now

Call: +49 30 863283641