
NIS-2: New requirements for cyber security
NIS-2: Summary of the most important information
The NIS 2 Directive is an EU-wide regulation that obliges companies and organizations to meet higher security standards for network and information systems.
-
NIS-2 came into force in January 2023 and applies to companies with 50 or more employees or a turnover of EUR 10 million in 18 defined sectors
-
Failure to comply with NIS 2 requirements can result in high fines, loss of business and reputational damage
-
Companies must implement cyber security risk management, report security incidents within 24 hours, secure their supply chains and use certified IT products where appropriate
-
The directive should be transposed into national law by October 2024. Although the German draft law (NIS-2UmsuCG) has been adopted, it has not yet been passed.
What is NIS-2?
The Network and Information Security (NIS) Directive is an EU-wide regulation that expands and tightens cyber and information security standards for certain organizations and sectors. With NIS-2, the EU aims to strengthen the resilience and security of network and information systems throughout the European Union. Experts assume that the NIS-2 directive will become for cyber security what the GDPR has become for data protection.
By when must NIS-2 be implemented?
The NIS-2 Directive came into force on January 16, 2023, and the EU member states then had until October 17, 2024 to transpose the directive into national law. In Germany, this was to be done through the NIS-2 Implementation and Cyber Security Strengthening Act (NIS-2UmsuCG).
Although the draft law was approved by the cabinet on July 24, 2024, it failed to be passed by the Bundestag. Negotiations continued after the end of the traffic light coalition, but were ultimately unsuccessful. This means that the implementation of NIS-2 in Germany remains open and the EU implementation deadline will be significantly exceeded. The EU Commission has already initiated infringement proceedings against Germany. Nevertheless, the specific requirements of the directive and the draft implementation law provide a clear framework for companies.
NIS 2 compliance made easy - with MaibornWolff
Are you affected by the NIS 2 Directive? Our experts will be happy to support you in implementing the requirements of the NIS 2 Directive. MaibornWolff offers holistic risk management right from the start: We help you to strategically identify risks, minimize them sustainably and remain secure in the long term. This gives you exactly the security your company needs - not just on paper, but above all in practice.
Opt for real cyber security
With MaibornWolff, you can rely on a partner who sees compliance not as a compulsory exercise, but as an opportunity for real cyber security.

Crucial to the success of the project: the team did not try to bring security into the development teams from outside in a 'police role'. Instead, it empowered our teams themselves to systematically assess security.
Which companies are affected by NIS-2?
NIS-2 affects companies that operate in an EU country. It does not matter whether they are also based in the EU. With the NIS-2 Directive, the EU holds so-called "essential" and "important" entities accountable. These include companies and institutions from a total of 18 economic sectors. In addition to the location and field of activity, the number of employees and annual turnover also play an important role: companies with 50 or more employees or an annual turnover of at least ten million euros must implement the NIS 2 Directive.
Be sure to check whether your company is affected by NIS-2, as non-compliance with the NIS-2 requirements can result in heavy fines.
These sectors are covered by the NIS 2 Directive
Whether your company must meet the requirements of the NIS 2 Directive depends on whether it belongs to one of the 18 defined business sectors. These are divided into sectors of high criticality and other critical sectors.

Sectors of high criticality
- Energy (electricity, district heating and cooling, crude oil, natural gas, hydrogen)
- Transportation (air transport, rail transport, shipping, road transport)
- Banking, financial market infrastructures
- Public health
- Drinking water, waste water
- Digital infrastructure & public administration
- Management of ICT services (business-to-business)
- Space

Other critical sectors
- Postal and courier services
- Waste management
- Production, manufacture and trade in chemical substances
- Production, processing and distribution of foodstuffs
- Manufacturing industry / production of goods
- Providers of digital services
- Research
Essential and important facilities: What's the difference?
With the introduction of the NIS 2 Directive, the previous distinction between operators of essential services (OES) and digital service providers (DSP) no longer applies. These have been transferred to the new categories of essential and important facilities. The cybersecurity requirements are the same for both groups, but there are differences in terms of regulatory control and possible sanctions:
➜ Essential entities are large companies with at least 250 employees or an annual turnover of more than €50 million that operate in a high-criticality sector. They are subject to strict, proactive monitoring by the authorities, i.e. regular inspections and audits. Violations can be punished with fines of up to 10 million euros or 2% of annual turnover.
➜ Important facilities are companies from other critical sectors with at least 50 employees or 10 million euros in turnover. They are only inspected if there are concrete grounds for suspicion(reactive supervision). The maximum fines amount to 7 million euros or 1.4% of annual turnover.
National authorities can also classify companies as significant or important regardless of their size if their activities are of particular security relevance. In addition, management can be held personally liable for violations - with an upper limit of 2% of global annual turnover.
NIS 2 requirements for companies
In order to meet the requirements of the NIS 2 Directive, companies must implement comprehensive security measures. These include, among other things:
-
Management responsibility: Managers must not only approve cyber security measures, but also actively monitor them. They are obliged to take part in training courses and are personally liable in the event of breaches.
-
Cybersecurity risk management: Companies should take technical, operational and organizational measures to minimize security risks. These include emergency plans, access controls, encryption as well as backup and crisis management. Effective risk management also includes the complete recording, assessment and comprehensible handling of risks - including the option of consciously accepting certain risks.
-
Security in the supply chain: Not only the affected companies themselves, but also their service providers and suppliers are subject to clear security requirements. Coordinated risk assessments help to identify potential vulnerabilities at an early stage.
-
Notification and reporting obligations: Security incidents must be reported within 24 hours as an early warning. An initial analysis must be carried out after 72 hours and a final report after one month at the latest.
-
Certified IT products & security standards: Companies may be obliged to use certified IT and communication products and implement European security standards. Security requirements must also be taken into account when procuring IT and network systems.
-
Training & sensitization of employees: Regular training on cyber hygiene, secure data handling and threat detection should minimize human error as a security risk.
-
Obligation to register: Companies are obliged to register with the competent national authority to ensure compliance with the NIS 2 requirements.

Implement the NIS 2 directive efficiently and benefit now from our comprehensive NIS 2 advice.
Our references & projects
A reference is worth more than 1,000 words. Fortunately, we have dozens of them. Click through a selection of our most exciting projects and see for yourself!
-
MAN: Efficient threat analysis for control unitsLearn more
Digitalization increases cyber risks - especially for MAN's new CM4 control unit. Our experts use the 4×6 methodology and ThreatSea to identify threats at an early stage and develop targeted protective measures. Find out how MAN uses intelligent risk analysis to strengthen the security of its vehicles.
MAN: Efficient threat analysis for control unitsLearn more7 monthsProject duration
Over 20 workshopsThreat analyses
Over 500Potential risks evaluated
-
Siemens: AI demand prediction platform for industrial production planningRead more
Siemens is looking to the future with the AI Demand Prediction Platform. Thanks to machine learning and AutoML, precise demand forecasts can be created for over 100 products and production can be better planned. Launched as a proof of concept, the platform quickly developed into a system that can be used productively. The self-service web application will soon be used in other plants.
Siemens: AI demand prediction platform for industrial production planningRead moreProject durationSince February 2022
Proof of conceptin a few weeks
Time series predictionfor 100 different products
-
TÜV NORD GPT: Development of AI assistanceRead more
Find relevant information faster by chatting with documents? It's possible! The TÜV NORD GROUP uses GPT technology in the secure Microsoft Azure Cloud. With the aim of optimizing knowledge management and efficiency. The system enables new usage options within the testing group and is operated securely. Find out more about the innovative AI assistance system now.
TÜV NORD GPT: Development of AI assistanceRead moreProject durationsince September 2023
33.000GPT applications in the first month
ChatGPT Model 4in the European Microsoft Azure Cloud
-
Schöck components: Improvement of the requirements processRead more
Together with MaibornWolff, the construction industry specialist optimized the requirements management of its Scalix design software. Thanks to the digital design approach, the technical requirements were re-specified and the software was further developed in a user-centered manner. The aim is to continuously increase user satisfaction and integrate internal and external interests. Read more about the methodology and results now!
Schöck components: Improvement of the requirements processRead moreProject durationsince 2022
Team size2-3 Digital Designer:inside
In 2024Scalix replaces old software -
VW: Digitization of key production figures with the iProcess appRead more
Less paper, more efficiency: Volkswagen replaces analog processes with the iProcess app. Cloud-native technologies and digital design enable intuitive recording and analysis of key production figures. This increases transparency and overall equipment effectiveness and paves the way for predictive maintenance at the automotive group.
VW: Digitization of key production figures with the iProcess appRead moreProject durationSince January 2021
Team size5 to 10 persons
Fast app developmentthanks to Digital Design
-
DER Touristik: Become a digital travel companion in 7 monthsRead more
Travel information, bookings, support - all in one app. With Flutter, MaibornWolff developed a cross-platform solution for DER Touristik. In just seven months, a stable app was created for iOS and Android that supports multiple brands, languages and countries. This is how customer proximity travels.
DER Touristik: Become a digital travel companion in 7 monthsRead more7 monthsFrom Kickoff to Go Live
iOS and AndroidDigital travel companion
Whitelabelling solutionUncomplicated integration of additional brands, languages and countries
-
Mixed reality: driving a real car in a virtual worldRead more
Virtual racing in a real car? MaibornWolff made it possible for the BMW M. Within three months, we used Unreal Engine 4 to develop a prototype that processes vehicle signals with high performance and creates an immersive driving experience without motion sickness. The cockpit remains real, the surroundings become the racetrack.
Mixed reality: driving a real car in a virtual worldRead more<3 monthsFrom the vision to the prototype
3D applicationsin real time
TeamUnreal development, XR technology, game design, smart devices, 3D content
-
KUKA: Web interface for a new Human Machine InterfaceRead more
Rethinking robotics: KUKA is working with us to develop iiQKA.OS - an operating system with an intuitive web HMI. Using web technologies and scrum methods, we enable flexible customization and simple control. Open collaboration makes robotics more accessible than ever before.
KUKA: Web interface for a new Human Machine InterfaceRead moreGoalReplacing the current control software
iiQKA.OSFast and intuitive development
> 11,000 hoursProject work
-
STIHL: Control iMOW robotic mower via appRead more
Robot mower redefined: The iMOW from STIHL makes lawn care smarter. Our software expertise combined with STIHL's hardware know-how ensures intuitive app control. The result? A networked device that makes gardening easier - simple, efficient, innovative.
STIHL: Control iMOW robotic mower via appRead moreProject durationsince August 2020
Robot mowerControl via app
Process optimizationwith the customer
-
DEKRA: Modern enterprise architecture thanks to co-creationRead more
New IT for a sustainable future: the global auditing group needed to modernize its IT landscape. Co-Creation created a harmonized architecture and the EA Community promotes cross-border exchange for strong IT until 2025 - and beyond.
DEKRA: Modern enterprise architecture thanks to co-creationRead moreMost important method:Building an EA community
Created conceptEnterprise Architecture
Cooperationat eye level
-
Miele domestic appliances are networked worldwideRead more
How do household appliances become smart? Miele relies on an IoT platform that we played a key role in developing. Container-based architecture ensures stable communication, DevOps for continuous improvement - so that smart appliances can be found in millions of households worldwide.
Miele domestic appliances are networked worldwideRead moreProject durationsince 2016
Success factors:High availability and scalability
IoT platformwith container-based architecture
-
MAN: Secure Software Development Life CycleRead more
Trucks are networked - and therefore unfortunately also targets for attack. With SSDLC, MAN relies on security by design and integrates the highest security standards directly into development. Together with 22 teams, we have established security measures that go beyond the legal requirements.
MAN: Secure Software Development Life CycleRead more22 monthsProject duration
UNECE R155successfully integratedMethodsSecurity Champions, DevSecOps, OWASP SAMM
-
It's LOS: Building a cloud-based low-code applicationRead more
Democracy meets digitalization: For "Es geht LOS!", we developed a low-code app for candidate management in five weeks. Built on AWS, it enables secure draws and efficient user management - for more citizen participation digitally.
It's LOS: Building a cloud-based low-code applicationRead moreProject durationSince the beginning of 2022
MVPin only 5 weeks
TechnologiesAmplify, AppSync, CodeCommit, IAM, Cognito, DynamoDB, Lambda
-
Monitoring alarms in industrial plantsRead more
Safety in industrial plants requires a real-time overview. We developed a live monitoring platform that networks measuring devices and collects data via Azure IoT and Kubernetes. A scalable MVP was created in just three months: alarms appear in under ten seconds thanks to automated data acquisition via smartphone and Bluetooth.
Monitoring alarms in industrial plantsRead more3 yearsProject duration
<3 monthsto the MVP
Cloud migrationModernization & relocation -
Planning systems: Optimizing the capacity utilization of pressing plantsRead more
Maximum capacity utilization, minimum costs: Our customer relies on a central planning system for pressing plants. We have been supporting its further development with .NET Core, GraphQL and PostgreSQL for over ten years. Now the journey is moving to the cloud - for greater scalability, flexibility and efficiency.
Planning systems: Optimizing the capacity utilization of pressing plantsRead more>10 yearsCustomer support
Technological modernizationCloud-ready platformEfficiency through dataSite-specific cost planning -
Global workforce planning systemRead more
How do you achieve globally harmonized workforce planning? With a modern web application based on domain-driven design and hexagonal architecture. Event sourcing ensures transparent traceability, while Azure and Quarkus provide stability and scalability. The result: a flexible, future-proof solution.
Global workforce planning systemRead moreTeam sizeUp to 8 employees
Domain Driven DesignDevelopment approach
Microsoft Azure Cloudallows easy roll-out of new versions
-
DER Touristik Online: Development and migration of a multi-client capable travel booking platformRead more
Different brands, one platform: DER Touristik merges several independent websites. We are supporting the migration to the AWS cloud with digital design, microservices and testing. The focus is on performance, SEO and UX - for a seamless digital travel experience.
DER Touristik Online: Development and migration of a multi-client capable travel booking platformRead moreStandardized platformMulti-client travel portalQuality assuranceEnd-2-End test automationCloud transformationMigration to AWS cloud -
KUKA: UI/UX design for an app for load data analysis for industrial robotsRead more
How do you reduce support requests? With a smart UX! KUKA and MaibornWolff developed a web-based application for load data analysis. Through "Understand/Build/Learn" we recognized challenges early on and validated solutions for an intuitive user experience.
KUKA: UI/UX design for an app for load data analysis for industrial robotsRead moreMethodProduct Experience Design
Customer requestEasier interaction between users and the system
Our goalOptimized load data analysis, fewer support requests, higher satisfaction -
BMW Group: Replacement of a production-critical legacy systemRead more
20-year-old system, new digital future. We gradually migrated production software to a flexible architecture. After two years, central plants were running on the new solution - stable, fail-safe and ready for the challenges of tomorrow.
BMW Group: Replacement of a production-critical legacy systemRead moreProject durationMid-2018 to the beginning of 2024
Team size25 employees
Legacy systemreplaced after 20 years
-
BMW Group: Virtual reality brings vehicle design to lifeRead more
From the first draft to series production - BMW uses VR to visualize the entire development process. Based on the Unreal Engine, a uniform platform visualizes designs and processes. This saves on hardware prototypes and enables location-independent collaboration. MaibornWolff plays a key role in driving the development and integration of these VR use cases.
BMW Group: Virtual reality brings vehicle design to lifeRead more3.2 yearsProject duration
CooperationLocation-independent and virtual
InfrastructureScalable and expandable thanks to the cloud
-
BMW Group: Remote software upgrade for vehiclesRead more
No visits to the workshop, no stress - thanks to Remote Software Upgrade, BMW vehicles worldwide remain up-to-date "over-the-air". MaibornWolff has been developing and operating the backend for secure updates for over three years. Microservice architectures and DevOps approaches guarantee stability, performance and security.
BMW Group: Remote software upgrade for vehiclesRead more5 yearsProject duration
Millions of vehiclesreceive new features thanks to "over-the-air" upgrade
IT securityAlways up-to-date thanks to remote software upgrade
-
Creditreform: Secure proof of identity on the webRead more
Verifying online identities in a forgery-proof manner while maintaining user-friendliness - CrefoTrust makes it possible. Together, we developed a solution that creates trust with blockchain technology and proofs of concept. Personal and company data remain protected, while verifications run smoothly.
Creditreform: Secure proof of identity on the webRead more5 yearsProject duration
Pilot testsbased on several PoCs
Decentralized identityallows tamper-proof storage of identities and company information
-
Bayernwerk: Knowledge management via teamsRead more
Experience must not be lost - Bayernwerk digitizes the knowledge of long-standing employees. MaibornWolff designed an intuitive MS Teams app with a clear UX/UI. Close collaboration, lived Scrum values and user-centered development make the app a success. Promoting exchange, optimizing processes - this is how knowledge transfer works today.
Bayernwerk: Knowledge management via teamsRead more6 monthsProject duration
Target:Identify implicit knowledge
Requirements:a user-centered, intuitive and clear UX/UI design
-
Weidmüller: Progression of the Industrial Service PlatformRead more
IoT meets agility - Weidmüller and MaibornWolff developed the easyConnect platform for remote access, data visualization and machine learning. After intensive exploration, an MVP was created, accompanied by a cross-functional Scrum team. Making Industrial IoT smarter and more efficient.
Weidmüller: Progression of the Industrial Service PlatformRead more12 monthsup to the MVP
8 weeks analysisof professional, technical and organizational factors
Innovative portalfor end-to-end solutions
-
SMA: Development of a Web UI for ennexOS platformRead more
Optimizing energy flows, reducing costs - we have been developing the Web UI of the ennexOS platform with SMA Solar Technology since 2016. It digitizes energy management processes for over a million users and combines smart solutions for a sustainable energy future.
SMA: Development of a Web UI for ennexOS platformRead moreProject durationsince 2016
> 1.000Modules and components in ennexOS platform
> 7.000Fuse tests
-
digikoo GmbH: Apple Vision Pro for city plannersRead more
Planning cities smarter: Together with TUM, we developed the 3Digipad for Apple Vision Pro. It visualizes complex energy data in 3D and makes scenarios intuitively tangible. Dynamic building data and KPIs support urban planners in making sustainable decisions.
digikoo GmbH: Apple Vision Pro for city plannersRead more4 monthsProject duration
3D map with KPIsDisplay building data dynamicallyEnergy dataImmersive visualization -
digikoo: A data platform for the Azure CloudRead more
Structured geodata, automated quality assurance, seamless provision - we developed a powerful Snowflake data platform on Azure for Digikoo. It makes analysis easier for data scientists and lays the foundation for precise forecasts and new use cases.
digikoo: A data platform for the Azure CloudRead more5 monthsProject duration
Climate changePlan digitally and implement efficiently
Foundation data platformMicrosoft Azure Cloud
What happens if my company does not comply with the NIS 2 directive?
Non-compliance with the NIS 2 Directive can have serious consequences for companies. Essential entities risk fines of up to €10 million or 2% of annual global turnover, while important entities risk fines of up to €7 million or 1.4% of annual turnover. In addition, management has a direct responsibility: according to the NIS 2 Directive, it must not only approve cybersecurity risk management measures, but also monitor their implementation. If these requirements are not met, they can be held personally liable.
In addition to financial and legal consequences, there is a risk of reputational damage and business losses, such as exclusion from supply chains, if companies cannot provide evidence of the required security measures.
This makes it all the more important to implement the requirements of the NIS 2 directive at an early stage and actively minimize security risks . MaibornWolff supports you with individual solutions and practical expertise. Our aim is to ensure that your company not only meets the legal requirements, but is also secure in the long term.
FAQ: Frequently asked questions about NIS-2
What is the difference between NIS and NIS-2?
The NIS 2 Directive replaces the NIS Directive (2016/1148), which has been in place since 2016, and raises the level of cybersecurity in the EU to a new level. While NIS laid the foundation for the protection of critical infrastructures (KRITIS), it was not yet possible to achieve a uniform level of security in all member states.
NIS-2 tightens up three key aspects:
- Prerequisites: The NIS-2 Directive creates the prerequisites for a uniform level of security across Europe.
- Scope of application: NIS-2 greatly expands the scope of application, so that well over 100,000 companies are now affected.
- Responsibility: Upper management is made more responsible for consistently implementing cyber security measures.
What is the NIS-2UmsuCG?
The NIS-2 Implementation and Cybersecurity Strengthening Act (NIS-2UmsuCG) is the German draft law to transpose the NIS-2 Directive into national law. It is intended to regulate the cybersecurity requirements for companies in critical and important sectors and was passed by the Federal Cabinet on July 24, 2024, but has not yet been adopted (as of February 2025).
How can I prepare for the NIS 2 Directive?
Companies should develop a cyber security strategy at an early stage, review and adapt existing IT security measures and establish clear emergency and reporting processes. Close cooperation with IT security experts can help to implement all requirements efficiently.
What happens if my company is not based in the EU?
Companies based outside the EU must also comply with NIS-2 if they provide services within the EU or wish to work with companies based in the EU. They must appoint a representative who is established in an EU member state and is responsible for compliance.
Do companies have to register under NIS-2?
Yes, essential and important entities must register with the competent national authorities in accordance with the NIS 2 Directive. The purpose of this registration is to monitor compliance with cybersecurity requirements and enable better coordination in the event of security incidents. The exact requirements and deadlines for registration are set individually by each EU member state.