NIS2 Risk Management: The Ten Mandatory Areas under Section 30 BSIG

The NIS2 Implementation Act (NIS2UmsuCG) has been in effect since December 6, 2025 – without any transition period. At the core of the new obligations is Section 30 BSIG. It defines which risk management measures essential and important entities must at least implement. Around 30,000 companies in Germany are newly subject to these obligations, many of them without a dedicated security team.

This guide goes through the ten mandatory areas of Section 30 (2) BSIG individually: what the law requires, what this means in practice, and what evidence is required in the event of an audit. It does not replace legal advice, but provides a reliable orientation on where you stand and where to start.

The Fundamental Obligation: Appropriate, Proportionate, Effective

Section 30 (1) BSIG requires entities to take appropriate, proportionate, and effective technical and organizational measures. The aim is to prevent disruptions to the availability, integrity, and confidentiality of the IT systems, components, and processes used for their own services – and to minimize the impact of security incidents as much as possible.

What "proportionate" means is specified by the law itself. Factors to be taken into account include:

• the degree of risk exposure,

• the size of the entity,

• the implementation costs,

• the likelihood of occurrence and severity of security incidents, as well as their societal and economic impact.

A nursing home with 80 employees therefore does not need to run the same program as a major hospital or a transmission system operator. What is crucial, however, is that the entity must be able to prove that it fulfills its obligations. Without documentation, there is no proportionality to invoke.

Section 30 (2) BSIG sets the standard: The measures must adhere to the state of the art, take relevant European and international standards into account, and be based on an all-hazards approach. This means: not only cyberattacks, but also power outages, fire, human error, or the failure of a service provider.

Overview of the Ten Mandatory Areas

According to Section 30 (2) BSIG, the measures must at least include the following:

1. Policies on risk analysis and information system security

2. Incident handling

3. Business continuity (backup management, disaster recovery) and crisis management

4. Supply chain security

5. Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure

6. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

7. Basic cyber hygiene practices and cybersecurity training

8. Policies and procedures regarding the use of cryptography

9. Human resources security, access control policies, and asset management

10. Multi-factor authentication, secured communications, and secured emergency communication systems

1. Risk Analysis and Information Security Policies

What the law requires: "Concepts regarding risk analysis and security in information technology" (Section 30 (2) No. 1 BSIG).

What this means in practice: You need an understanding of your risks before you can prioritize measures. Which systems and processes are critical to your services? Which threats are realistic? How likely is an outage, and what would it cost – for patients, for public supply, for production? This results in a risk register with assessments, responsible parties, and treatment decisions.

This item is the foundation for all other nine. Without a risk analysis, it is impossible to justify why a measure is proportionate, or why another was deferred.

Typical evidence: Risk analysis methodology, risk register, information security policy, formal risk acceptance for residual risks approved by executive management.

This is precisely what our Cyber Risk Assessment is for: Risk analysis according to Section 30 BSIG in four to six weeks, methodology and measures in accordance with ISO/IEC 27001, complete with a prioritized roadmap and an executive sign-off template.

2. Incident Handling

What the law requires: "Incident handling" (Section 30 (2) No. 2 BSIG).

What this means in practice: A process that defines how an incident is detected, assessed, contained, and resolved – and who makes decisions and when. This includes the interface with the reporting obligations under Section 32 BSIG: early warning to the BSI within 24 hours, incident notification with an initial assessment within 72 hours, final report after one month. These deadlines can only be met if it is clear in advance who reports and what information must be gathered.

Typical evidence: Incident response plan with roles and escalation paths, reporting process according to Section 32 BSIG, contact list, logs and reports of past incidents and exercises.

If no dedicated in-house team is available, our Incident Response handles the initial assessment, containment, and support with mandatory notifications.

3. Business Continuity and Crisis Management

What the law requires: "Business continuity, such as backup management and disaster recovery, and crisis management" (Section 30 (2) No. 3 BSIG).

What this means in practice: Backups alone are not enough. What matters is whether they work in an emergency: segregated from the production environment, protected against encryption, and regularly restored. In addition, there must be emergency operating procedures for critical processes – how the ward operates without the hospital information system, how the municipal utility functions without the billing system, how manufacturing runs without ERP – and a crisis team that knows its role.

Typical evidence: Backup concept, logs of restoration tests, business continuity and disaster recovery plans, crisis team organization, exercise reports.

4. Supply Chain Security

What the law requires: "Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Section 30 (2) No. 4 BSIG).

What this means in practice: Your security does not stop at your firewall. IT service providers with remote access, software vendors, maintenance companies for medical technology or operational technology (OT), cloud providers – each of these is a potential entry point. You need to know which suppliers are critical, what security requirements you impose on them, and how you verify compliance.

Conversely, if you are a supplier yourself, you will increasingly face these questions from your own customers – even if you are not directly subject to NIS2.

Typical evidence: List of critical suppliers, security requirements in contracts, data processing agreements (DPAs), supplier assessments, regulated remote access procedures.

5. Security in Acquisition, Development, and Maintenance – Including Vulnerability Management

What the law requires: "Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure" (Section 30 (2) No. 5 BSIG).

What this means in practice: Security belongs in procurement – as a requirement in the specifications, not as an afterthought after the purchase. And in day-to-day operations, you need systematic vulnerability management: a complete asset inventory, regular vulnerability discovery, prioritization based on actual risk, and tracked remediation. Medical devices and OT systems require special caution, as active scans can disrupt operations.

Typical evidence: Asset inventory, scan and vulnerability reports, patch and remediation process with defined deadlines, documentation of compensating controls, security requirements in procurement documents.

What this looks like in practice for awareness and vulnerabilities is described in our guide Section 30 BSIG: Awareness Training and Vulnerability Management.

6. Assessing the Effectiveness

What the law requires: "Policies and procedures to assess the effectiveness of cybersecurity risk-management measures" (Section 30 (2) No. 6 BSIG).

What this means in practice: Implementing measures is only half the battle. The other half is regularly checking whether they are effective. This can be done via metrics (were patch deadlines met? has the reporting rate in phishing simulations increased?), internal audits, penetration tests, or repeating the risk analysis. What matters is the closed loop: measure, evaluate, adjust.

Typical evidence: KPI reporting to executive management, internal audit reports, test reports, management review with derived action items.

7. Training and Awareness

What the law requires: "Basic cyber hygiene practices and cybersecurity training" (Section 30 (2) No. 7 BSIG). The NIS2 Directive refers to basic cyber hygiene practices and cybersecurity training in Art. 21 (2) lit. g.

What this means in practice: All employees need regular, understandable training – not just a one-off mandatory video. Awareness works best when integrated into daily work routines: with phishing simulations that use realistic industry-specific scenarios, and short learning modules distributed throughout the year. Separate from this is the executive management training obligation under Section 38 (3) BSIG.

Typical evidence: Training concept, attendance records, aggregated analysis of phishing simulations, proof of training for executive management.

Our Awareness Training delivers a core course of around 20 minutes per year plus short spotlights, available in German, and complete with audit-compliant participation records.

8. Cryptography

What the law requires: "Policies and procedures regarding the use of cryptography and, where appropriate, encryption" (Section 30 (2) No. 8 BSIG).

What this means in practice: Determining where encryption is applied (data in transit, data at rest, backups, email), which algorithms and procedures are used, and how keys and certificates are managed. The Technical Guidelines of the BSI serve as guidance for the state of the art. Common weak points include expired certificates and outdated protocols on legacy systems.

Typical evidence: Cryptographic concept, overview of implemented cryptographic mechanisms, process for key and certificate management.

9. Human Resources, Access Control, and Asset Management

What the law requires: "Human resources security, access control policies and asset management" (Section 30 (2) No. 9 BSIG).

What this means in practice: Three topics in one point. HR: security aspects during onboarding, role changes, and offboarding. Access control: permissions based on the principle of least privilege, reviewed regularly, privileged accounts strictly secured. Asset management: an up-to-date inventory of all systems so nothing remains unmanaged on the network.

Typical evidence: Access control concept, recertification of access rights, onboarding and offboarding processes, asset inventory.

10. Multi-Factor Authentication and Secured Communications

What the law requires: "The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate" (Section 30 (2) No. 10 BSIG).

What this means in practice: MFA first where a stolen password causes the most damage: remote access, email, administrative accounts, cloud services. In addition, secure communication channels – and a plan for how the entity communicates if email and telephone systems are themselves compromised.

Typical evidence: MFA coverage per system, policy for communication tools, emergency communication plan.

Additional Requirements

Executive Management (Section 38 BSIG). Executive management must implement the measures under Section 30 and monitor their implementation. They must also regularly participate in training. In the event of breaches of duty, they are personally liable to their own entity. Section 30 is therefore not just an IT task, but a matter for leadership.

Reporting Obligations (Section 32 BSIG). Significant incidents must be reported in stages: an early warning within 24 hours, an incident notification within 72 hours, and a final report after one month.

Fines (Section 65 BSIG). For essential entities up to €10 million or 2% of total worldwide annual turnover; for important entities up to €7 million or 1.4%.

Industry Standards. According to Section 30 (8) and (9) BSIG, entities and their industry associations can propose industry-specific security standards to be reviewed by the BSI. Where such standards exist, for example in healthcare, it is worthwhile aligning your implementation with them.

EU Implementing Acts. For certain digital services – such as cloud providers, data centers, DNS services, or online marketplaces – an EU implementing act specifies technical requirements. According to Section 30 (3) BSIG, this takes precedence for these entities.

Where You Should Start

Tackling ten mandatory areas simultaneously is overwhelming for any organization without a dedicated security team. The following sequence has proven effective:

1. Clarify applicability. Are you an essential or an important entity? Our free NIS2 Check provides an initial assessment.

2. Conduct a risk analysis (No. 1). It highlights where the biggest gaps are and provides the justification for every subsequent priority.

3. Quick impact first. Usually this means MFA (No. 10), training and awareness (No. 7), working backups (No. 3), and an incident process with reporting workflows (No. 2).

4. Establish ongoing operations. Vulnerability management (No. 5) and effectiveness assessments (No. 6) are not one-off projects, but continuous processes.

5. Document everything, right from the start. In an audit, what is not documented is considered not implemented.

Conclusion

Section 30 BSIG is not a mere checklist, but a framework that every entity must fill out proportionally – and verifiably. The ten mandatory areas are interconnected: the risk analysis justifies priorities, training and vulnerability management reduce risk in daily operations, incident handling and business continuity planning limit damage, and effectiveness testing keeps the entire system functioning.

At Entropy CS, we support organizations in healthcare, utilities, and industry in implementing Section 30 BSIG – from a Cyber Risk Assessment to get started, all the way to ongoing operations. Our free Risk Check takes 30 minutes and shows where you stand today.

Sources: Sections 30, 32, 38, and 65 BSIG as amended by NIS2UmsuCG; Directive (EU) 2022/2555 (NIS2), Art. 21. This guide does not constitute legal advice.