NIS2 Compliance for German Mittelstand — Practical Implementation

NIS2 (Directive (EU) 2022/2555) applies to companies in 18 sectors considered "key" or "important" with at least 50 employees and EUR 10M turnover. The German transposition is the NIS2UmsuCG. It incorporates the EU directive into Federal IT Safety Law.

The "key" category covers energy, transport, banking, financial market systems, health, drinking water, waste water, digital systems, ICT service control, public administration, and space. The "important" category adds postal and courier services, waste control, manufacturing of chemicals, food live, manufacturing of medical devices and machinery, digital vendors, and research organisations.

Companies determine in-scope status themselves — there is no central list issued by BSI. The thresholds are headcount and turnover. Smaller items can still be designated by member states if they are sole vendors of a critical service. Companies that are unsure should run a self-labeling against the sector list in Annex I and Annex II of the directive.

Group structures matter: the assessment usually applies at the legal-item level, not at the merged group level. A holding company is rarely in scope on its own, but operating subsidiaries in key sectors typically are.

NIS2 Article 21 lists 10 technical/organisational measure areas. Most map directly to ISO 27001:2022 Annex A controls (incident handling → A.5.24-A.5.30, supply-chain safety → A.5.19-A.5.23, biz continuity → A.5.29-A.5.30, access control → A.5.15-A.5.18, etc.). A cross-walk document is the fastest way to proof coverage.

The 10 Article 21 areas in short. Risk study and info system safety policies. Incident handling. Biz continuity and crisis control. Supply chain safety. Safety in network and info systems acquisition and dev work. Policies to assess the value of cybersecurity risk-control measures. Basic cyber hygiene practices and cybersecurity training. Cryptography policies. Human resources safety and access control. Use of multi-factor sign-in and secured comms.

An ISO 27001:2022-certified ISMS already satisfies the vast majority of these. The gaps that typically remain are the formal supply-chain risk procedure, the 24/72-hour incident-reporting playbook, and explicit board-level oversight proof. These can be added without rebuilding the ISMS. They fit as new clauses in the Statement of Applicability and as new steps in the existing document hierarchy.

For companies without ISO 27001, the BSI IT-Grundschutz starting point is an alternative reference framework that German regulators accept. It covers the same ground with German-language artefacts and a step-by-step rollout path.