NIS-2 / BSIG

NIS-2 / BSIG

From legislation to everyday practice

With the German NIS-2 implementation act, the European NIS-2 directive has been transposed into the German BSI Act (BSIG). People still call it “NIS-2” – the obligations now live in the BSIG. Far more companies than before are classified as “important” or “particularly important entities”. They must implement risk management measures, report significant security incidents and register with the BSI.

Management is accountable

Section 38 BSIG addresses management directly: it must approve the risk management measures, oversee their implementation and regularly attend training so it can identify and assess risks and risk management practices in information security. Information security can no longer be fully delegated.

My services

Management training under Section 38 BSIG

• Compact training for managing directors and executive boards – on site or remote
• Duties and liability explained in plain language
• Enabling management to assess risks and measures – with practical examples

Assessment

• Clarifying whether and how your company falls under the BSIG
• Gap analysis against the risk management requirements
• A prioritised roadmap instead of an endless list of measures

Systematic implementation

• Risk management measures based on an ISO 27001 ISMS
• Processes for detecting and reporting security incidents
• Audit-ready documentation – without paper tigers

Thinking ISO 27001 and NIS-2 together

If you run or build an ISMS according to ISO 27001, you already cover a large part of the NIS-2 requirements. I use these overlaps so you don’t have to maintain two parallel worlds.