Guides › NIS2
Implementing NIS2 pragmatically.
The NIS2 Directive and its national implementing laws, in Germany the NIS2 Implementation Act, significantly widen the circle of companies affected. What is required is documented, risk-based security management, and management is personally liable. If you already run an ISMS based on ISO 27001, you have a large part of this covered.
Who is affected?
Companies in defined sectors such as energy, transport, health, digital infrastructure, ICT services or manufacturing, generally with 50 or more employees or annual turnover and balance sheet total of more than €10 million.
Essential entities
Large companies in particularly critical sectors, with proactive supervision by the authority (in Germany the BSI).
Important entities
Medium-sized and large companies in the other sectors, supervised mainly when there is cause.
If in doubt, check
Whether you are affected should be assessed on a case-by-case basis. This overview does not constitute legal advice.
What NIS2 requires and where WolfISMS helps.
| NIS2 requirement | Covered by |
|---|---|
| Risk management for IT and OT | Assets, risk management |
| Incident handling | Incidents, playbooks |
| Business continuity and crisis management | BCM, emergency contacts |
| Supply chain security | Supplier management |
| Acquisition, development and maintenance | Change management, measures |
| Vulnerability management | Vulnerabilities, AI vulnerability search |
| Assessing effectiveness | Audits, KPIs & objectives, management review |
| Training and awareness | Personnel management, policy portal |
| Cryptography | Documents, measures |
| Access management and MFA | Access matrix, measures |
| Reporting obligations (guide) | Incidents, reporting assistant |
NIS2 in 12 steps for SMEs.
Clarify whether you are affected
Check sector, size and role in the supply chain.
Involve management
Inform top management and set the budget.
Appoint those responsible
Designate the information security officer and the contact person for authorities.
Define the scope
Delimit locations, IT/OT and critical processes.
Take stock
Record systems, service providers and existing measures.
Risk analysis
Assess assets and threats, prioritise risks.
Treatment plan
MFA, backups, patches and segmentation according to risk.
Incident handling
Define reporting channels and the process for notifying authorities.
Emergency management
Emergency plans, recovery and restore tests.
Secure the supply chain
Review contracts and service providers.
Training & awareness
Raise awareness regularly and practise reporting channels.
Documentation & review
Keep evidence and review annually.
Timeframe and typical mistakes.
Analysis and planning
Applicability, scope, inventory and risk analysis.
Core measures
Implement MFA, backups, the incident process and supply chain security.
Stabilise
Audits, management review and continual improvement.
Typical mistakes
Treating security as an IT topic only, neglecting documentation, not testing emergency processes.
Keep your NIS2 evidence under control with WolfISMS.
The NIS2 catalogue is included in WolfISMS. If you wish, we will set it up together with you.