NIS 2 Registration: What Companies Still Need to Do

Table of Contents

NIS 2 Registration: What Companies Still Need to Do

July 31, 2026, was the official deadline for BSI registration under the NIS 2 Directive. Anyone who has not yet completed NIS 2 registration with the BSI by this date now faces a clear task: to act immediately. Inaction is not an option—not legally, not economically, and not in terms of corporate responsibility.

What Applies After the Deadline: The Current Legal Situation

Under the NIS2UmsuCG—the German law implementing the EU directive—operators of essential and important facilities are required to register with the Federal Office for Information Security (BSI). The deadline of July 31, 2026, does not mark the end of this requirement, but rather the beginning of enforcement by the authorities.

According to data from the Chamber of Industry and Commerce (IHK) and the Federal Office for Information Security (BSI), as of the reporting date, approximately 10,500 of the 29,000 affected companies had not yet registered. This represents more than one-third of all organizations required to comply—a significant compliance gap that authorities are increasingly monitoring.

What are the potential consequences?

The NIS2UmsuCG provides for severe penalties:

  • Fines of up to 10 million euros or 2% of global annual revenue for major entities
  • Fines of up to 7 million euros or 1.4% of annual revenue for key institutions
  • Personal Liability of Management for Gross Negligence or Intentional Violations
  • Possible Order by the BSI to Temporarily Suspend Operations

In this context, executive liability is not merely a theoretical risk. The NIS2UmsuCG explicitly stipulates that management bodies must actively direct and monitor the implementation of cybersecurity measures.

NIS-2 Registration with the BSI: How to Complete the Retrospective Registration

Retroactive registration is possible and should be initiated immediately. To this end, the BSI operates the MELDEPFL portal (formerly the KRITIS portal), which serves as the central reporting system for all affected organizations.

Step-by-Step: What to Do Now

1. Assess the impact

Not every company is automatically subject to NIS 2. The regulation applies to entities in 18 defined sectors—ranging from energy and transportation to digital infrastructure, healthcare, and waste management—that exceed certain thresholds:

  • Major institutions: 250 or more employees, or €50 million in annual revenue and €43 million in total assets
  • Major organizations: 50 or more employees, or €10 million in annual revenue plus €10 million in total assets

Our article, “NIS 2 Directive: Who Needs to Take Action and What Companies Need to Know Now,” provides an initial overview of which companies are affected.

2. Complete registration on the BSI portal

The following information is required for registration:

  • Company Name, Legal Form, and Commercial Register Number
  • Contact Information for the IT Security Contact Person
  • Classification as an essential or important facility
  • Corresponding NIS-2 sector as specified in the NIS2UmsuCG Annex
  • Competent supervisory authority (BSI or sector-specific authority)

3. Appoint a CISO or security officer

The law requires the designation of a person responsible for IT security. This person must be designated internally and registered on the BSI portal.

4. Establish reporting processes

Once registration is complete, the operational obligation begins: Significant security incidents must be reported within 24 hours, and a full report must be submitted within 72 hours.

What Steps Must Be Taken After Registration

Registration is the first step—not the last. The NIS2UmsuCG requires affected organizations to implement a comprehensive risk management system.

Minimum Technical and Organizational Measures

According to the BSI minimum standard and Section 30 of the NIS2UmsuCG, the following, among other things, are mandatory:

  • Risk Analysis and Information Security Management System (ISMS)
  • Incident Response and Business Continuity Management
  • Supply Chain Security – Third-Party Vendors and Service Providers Must Also Be Vetted
  • Access Control and Identity Management (MFA, Privileged Access)
  • Encryption of Sensitive Data During Transmission and Storage
  • Employee Training and Awareness
  • Vulnerability Management and Regular Security Testing

Our guide, “Implementing NIS 2 Requirements Step by Step,” describes a structured approach to implementing these requirements.

Zero Trust as a Strategic Foundation

For companies that want to fundamentally realign their security architecture, the BSI—like international security agencies—recommends transitioning to zero-trust principles. This means: no access without verification, and no implicit trust relationships within the network.

The zero-trust model is not a product, but an architectural principle. Learn more in our article " Zero-Trust Architectural Principle."

IT Compliance for SMEs: Unique Challenges

NIS 2 compliance poses an organizational challenge, particularly for small and medium-sized enterprises. Resources are limited, and in-house IT security teams are rare. Nevertheless, the same legal requirements apply.

A PwC study from June 2026 shows that only 38% of affected SMEs have implemented a formal ISMS. At the same time, smaller companies in particular are disproportionately often the targets of ransomware attacks—a risk that continues to rise due to a lack of cybersecurity measures.

Our article on ransomware prevention for small and medium-sized businesses describes effective protection against ransomware and other cyber threats.

Make Targeted Use of External Support

For small and medium-sized businesses without their own security department, the following options are available:

  • Managed Security Service Provider (MSSP): Outsourcing of Monitoring, Incident Response, and Compliance Documentation
  • IT Security Consulting: External experts provide support during the registration process and help structure the ISMS project
  • BSI Resources: The BSI provides implementation guides, checklists, and industry standards free of charge (it-grundschutz.bsibund.de)
  • IHK Consulting: Many Chambers of Industry and Commerce offer free initial consultations on how NIS 2 affects your business

NIS 2 Checklist: What Companies Need to Do After July 31, 2026

The following overview provides a concise framework for action:

  • Impact assessed according to NIS2UmsuCG (sector, size, function)
  • Registration on the BSI portal has been initiated or completed
  • IT Security Officer (CISO / ISB) Appointed
  • Security incident reporting processes defined and communicated
  • Risk Analysis and ISMS Plan Commissioned or Underway
  • Supply chain and critical service providers assessed for security requirements
  • Training plan for employees and management developed
  • Evidence of the measures taken has been documented for a potential BSI audit

FAQ: NIS-2 Registration with the BSI

What happens if I complete the BSI registration now—will I still face fines?

Authorities generally view prompt retroactive registration favorably. It reduces the risk of fines, though it does not completely eliminate it. The key is to demonstrate that the registration process has been initiated and that no further compliance violations occur. Companies that begin implementing technical measures at the same time signal their willingness to cooperate with the authorities.

Does the NIS 2 registration requirement also apply to subsidiaries of international corporations?

Yes. The determining factor is whether the entity operates in Germany and meets the thresholds—regardless of whether the parent company is already registered in another EU country. Every independent legal entity with its registered office or principal place of business in Germany must fulfill the registration requirement on its own.

What does the BSI mean by a “significant security incident” that must be reported?

A security incident is considered significant if it causes or could cause significant operational disruptions, or if it significantly affects other natural or legal persons. This includes, in particular, ransomware attacks, data breaches with operational implications, DDoS attacks on critical systems, and supply chain compromises.

This content was generated using AI, but was reviewed and edited by our editorial team before publication.

Share:

Scroll up

Jamil Isayyed

Jamil is an experienced digital process professional, has a rich international background in the information technology and services industry spanning Germany, Greece and Palestine. He holds a Bachelor's degree in Computer Science and a Scrum Master certification from the Scrum Alliance with a focus on Computer Software Engineering. Jamil is passionate about leading and building high-performance teams that deliver exceptional experiences and create valuable opportunities for clients. In addition to his main role, he is the Director of Axsos Academy GmbH. In this role, he leads a dynamic German-Palestinian bootcamp designed to help young people enter the IT market and build a successful career.

Bernd Length

Bernd Länge has been working in the IT industry for over 20 years and advises clients and interested parties on cyber security issues as well as on the development and implementation of information security management and data protection. In this role, he acts as an external data protection and information security officer for clients. It is important to him to take a pragmatic approach and work closely with clients, partners and vendors to ensure that clients' enterprise security is up to date.

Martin Müller

As a technology enthusiast and committed leader, he has been helping companies in the IT sector to shape the future of work for over 20 years. Thanks to his quick thinking and ability to develop effective solutions, he is able to formulate a clear vision of what our future way of working will look like. Step by step, he overcomes challenges and drives us forward into the future. However, he does not accomplish these tasks alone. He has a competent team that he trusts completely and can rely on. Together they overcome every hurdle! Through positive, critical thinking, the second-best solution often leads to incremental success - after all, even an empire wasn't built in a day. This approach makes him unique in his role and he looks forward to working with you on the path to the future.

Rolf Stephan

His enthusiasm for information technology led Rolf to study computer science and graduate from the University of Karlsruhe, now the KIT / Karlsruhe Institute of Technology. Rolf has been working in the IT sector ever since and knows the industry inside out - both nationally and internationally. For more than 25 years, he has focused on international cooperation between experts across all cultures. He also pursued this approach in the first company he founded, AD Solutions AG, which quickly developed into a renowned international IT service provider with several branches in Germany, Switzerland, Austria and the USA. Rolf Stephan has been General Manager since 2010 and CEO of AXON IVY AG, headquartered in Switzerland, since 2021. He has been an investor, shareholder and Chairman of the Supervisory Board of Axsos AG since 2009.

Frank Müller

Frank is a passionate IT expert and visionary entrepreneur. He loves and believes in peace and freedom. For him, these values are more than just words. They are the result of great awareness, responsibility and a solid foundation. His foundation is his faith in Jesus and his unconditional love for people. Frank builds his great visions on this foundation, such as his commitment to peace in the Holy Land. He is not afraid to realize creative and unconventional ideas, such as founding a medium-sized company that spans four countries and cultures and offers its employees a great deal of freedom. Founding a bootcamp academy in the midst of the coronavirus pandemic is certainly one of these ventures. Through these efforts, Frank creates new innovations and added value for his customers and the people who travel with him. With more than 32 years of IT experience and 15 years as an entrepreneur, Frank helps other entrepreneurs focus on their core business and translate their needs into technology opportunities and implementations. His team and he can translate these requirements into a customized IT strategy, processes and technologies. Frank always has a heart for the people he supports and wants to encourage them to break new ground and develop their potential. Frank is open to exchanging ideas with people who see values not as CSR or marketing chatter, but as the basis of their actions. He seeks contact with people who want to change the world for the better. He also welcomes those who are looking for support from him or his team on their journey into the cloud, digitalization or the use of AI.