The NIS2 directive is Germany's most comprehensive cybersecurity regulation, and it now affects 29,500 companies – including every SaaS company and every web platform that provides digital infrastructure. Here is what you need to do now.
What is NIS2?
The NIS2 directive (Network and Information Security Directive 2) is the revised EU cybersecurity directive, transposed into German law by the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG). It replaces the previous NIS directive and dramatically expands the scope of who is covered.
Does NIS2 apply to my company?
NIS2 applies to you if your company:
- operates SaaS platforms that other businesses rely on
- offers online marketplaces or e-commerce platforms
- provides managed IT services or cloud services
- runs digital infrastructure that other businesses use
- has more than 50 employees or generates more than €10M in annual revenue
The 10 mandatory measures under Article 21
NIS2 Article 21 requires at least these ten cybersecurity measures:
- Risk analysis and security concepts for information systems
- Incident response – handling security incidents
- Business continuity – backup management and disaster recovery
- Supply chain security – security across the supply chain and with suppliers, including GDPR-compliant vendor management
- Security in procurement – development and maintenance of systems
- Effectiveness assessment – evaluating the cybersecurity measures
- Cyber hygiene and training – fundamental practices and awareness
- Cryptography – policies for encryption
- Personnel security and access control – asset management
- Multi-factor authentication – secure communication systems
In the German transposition, these measures are codified in Section 30 BSIG. BSI: NIS-2 Risk Management Measures (Section 30 BSIG)
Incident reporting obligations
| Deadline | Obligation |
|---|---|
| 24 hours | Early warning to the BSI |
| 72 hours | Detailed incident notification |
| 1 month | Final report with root-cause analysis |
Personal liability of management
A critical difference from previous regulations: members of management are personally liable for damages arising from a culpable failure to implement cybersecurity measures. This cannot be delegated to the CISO or the IT department.
How AnvilStack helps
We use AI tools to develop quickly – but every line of code is reviewed by senior engineers and made NIS2-compliant:
- Free assessment: We test your existing platform against all 10 NIS2 mandatory measures – you will find the full technical breakdown in our NIS2 Security Checklist
- Security-by-architecture: NIS2 compliance is built into the system architecture, not bolted on afterwards
- Incident response setup: We implement the reporting infrastructure for the 24h/72h/30d deadlines
- EU-sovereign hosting: Hetzner, Germany – no CLOUD Act, no US jurisdiction
- Documentation: Auditable evidence for the BSI, not just technical measures
In a free initial consultation, we assess your platform for NIS2 relevance and show you concretely where action is needed – from the assessment through to a hardened, EU-sovereign production platform.