lock in a digital environment, symbolizes cyber security and integrity within the framework of NIS-2.

NIS-2 Directive: Implementing requirements in a legally compliant manner

Protect your company against cyber threats and comply with the legal requirements of the NIS-2 Directive in Germany on a permanent basis.

Who is affected? Companies with 50 or more employees or €10 million in turnover in 18 sectors.
What needs to be done? Implement cybersecurity risk management, secure supply chains, and use certified IT products.
Reporting deadlines: Security incidents must be reported within 24 hours.
Penalties: Violations can result in fines amounting to millions of dollars and damage to reputation.
Status in Germany: The directive is regulated nationally by the NIS-2 Implementation Act (NIS-2UmsuCG).

EU legal situation: The directive has been in force since January 16, 2023.
Delay in Germany: The draft bill of July 24, 2024 has not yet been finally passed by the Bundestag.
Consequence: The EU Commission has initiated infringement proceedings against Germany.
Recommended action: Despite pending national adoption, the current draft law already provides a binding framework for cybersecurity risk management.

Holistic risk management

We strategically identify your risks and minimize them in a sustainable manner. This ensures your long-term security, compliance with all NIS 2 requirements, and effective protection of your critical business processes against threats.

Practical compliance solution

Our experts support you in implementing the requirements directly in practice. We ensure that you not only comply with the directive on paper, but also achieve genuine cyber resilience.

Stable business continuity

We ensure your business continuity during the NIS 2 transition. Through targeted measures, we minimize downtime risks and permanently strengthen the resilience of your network and information systems.

Active awareness training

We raise awareness among your employees through targeted training. This enables you to build a strong security culture that reduces the risk of human error and firmly anchors the requirements of the NIS 2 Directive.

The sectors: Energy (electricity, gas, hydrogen), transportation (air, rail, shipping, road), banking & financial markets, healthcare, drinking water & wastewater, digital infrastructure, public administration, ICT management (B2B), and space.
The consequence: They are subject to proactive supervision (regular audits).
The risk: Violations of the NIS 2 requirements are punishable by fines of up to €10 million or 2% of global annual turnover.

Responsibility of managers: Management must actively monitor safety measures and participate in training courses. Important: You are personally liable for any violations.
Risk management & IT standards: Emergency plans, encryption, and backups are mandatory. In addition, you must comprehensively record risks and use certified IT products where necessary.
Secure supply chains: The security requirements also apply to your service providers and suppliers. Coordinated assessments help to identify weaknesses in the chain at an early stage.
Strict reporting deadlines: When incidents occur, the clock is ticking: early warning after 24 hours, analysis after 72 hours, and a final report after no more than one month.
Human factor: Regular training on cyber hygiene is essential to minimize the risk of human error within the team.
Registration: You must officially register your business with the relevant national authority.

Hefty Price Tags (Fines): Essential entities risk penalties of up to €10 million or 2% of global annual revenue. For important entities, fines can reach up to €7 million or 1.4% of revenue.
Management Responsibility (Liability): Senior management must not only approve measures but also actively oversee their implementation. In the event of failures, personal liability of executives is at risk.
Market exclusion (reputation & supply chain): Failure to comply can lead to exclusion from supply chains. This is compounded by massive reputational damage and business losses.

Frequently asked questions about NIS-2

What is the difference between NIS and NIS-2?
The NIS-2 Directive replaces the NIS Directive (2016/1148) that has been in force since 2016 and raises the cybersecurity level in the EU to a new standard. While NIS laid the foundation for the protection of critical infrastructures (KRITIS), a uniform security level across all member states could not be achieved at that time.

NIS-2 tightens three key aspects:
- Requirements: The NIS-2 Directive creates the conditions for a Europe-wide, uniform security level.
- Scope: NIS-2 significantly expands the scope, meaning that well over 100,000 companies are now affected.
- Responsibility: Senior management is held to a higher standard of accountability in consistently implementing cybersecurity measures.
What happens if my company is not based in the EU?

Companies based outside the EU must also comply with NIS-2 if they wish to provide services within the EU or collaborate with companies based in the EU. They must appoint a representative who is established in an EU member state and responsible for compliance with the regulations.

NIS-2 Directive: Implementing requirements in a legally compliant manner

Definition: What is the NIS 2 Directive?

An overview of the most important NIS 2 requirements for companies

By when must the NIS 2 Directive be implemented in Germany?

NIS-2 compliance with MaibornWolff: Your advantages

Holistic risk management

Practical compliance solution

Stable business continuity

Active awareness training

Who must comply with the NIS 2 requirements?

1. Essential facilities: Strict controls for key sectors

2. Important institutions: Reactive supervision in cases of suspicion

You must meet these NIS 2 requirements

Our refererences & projects

NIS-2 violations: What companies risk if they fail to comply

NIS-2 without stress: Your upgrade for true cyber resilience

Frequently asked questions about NIS-2

What is the difference between NIS and NIS-2?

What happens if my company is not based in the EU?