FREE NIS2 CHECK
Are you affected by NIS2? Take the test.
Answer 3-4 quick questions and get an immediate initial assessment of your NIS2 applicability - for healthcare, energy, water, and industry. Free of charge, no registration required.
Which sector is your organisation active in?
Choose the category that best describes your organisation.
Who is affected by NIS2?
Under NIS2, health, energy, and water are classified as sectors of high criticality, while parts of industry and medical technology are considered other critical sectors. Whether your organization is affected essentially depends on two criteria: your activity in the sector and the size of your company.
Particularly important facilities
Large enterprises in healthcare, energy, or water: 250 or more employees or over €50 million in turnover and over €43 million in total assets—as well as all critical infrastructure (CRITIS) operators, e.g., hospitals with 30,000 or more fully inpatient cases per year.
Important facilities
Medium-sized companies in these sectors: 50 or more employees, or over €10 million in revenue and balance sheet total—such as medical center networks, laboratories, or smaller municipal utilities. Manufacturing and medical technology companies of this size or larger are also considered important entities.
Not directly affected?
Smaller facilities often fall below the thresholds - but are increasingly being contractually obligated to implement cybersecurity measures as service providers or suppliers of affected facilities (supply chain security, § 30 BSIG).
These obligations apply to affected entities.
The NIS2UmsuCG has been in force since December 6, 2025 - with no transition period. The registration deadline with the BSI has already expired: anyone who has not yet registered should do so without delay.
Risk management: including awareness training, vulnerability management, incident handling, and supply chain security.
Reporting obligations under Section 32 of the German Federal Office for Information Security Act (BSIG): Initial report within 24 hours, follow-up report within 72 hours, final report after one month.
Management must implement and monitor the measures and participate in training themselves - in the event of a breach of duty, they are liable to their own organization.
Sources: NIS2UmsuCG / BSIG; BSI; Directive (EU) 2022/2555 (NIS2).