What is NIS2?<\/strong> The EU Directive on Network and Information Security (NIS2, Directive 2022\/2555) establishes binding cybersecurity obligations for critical sectors. It replaces the 2016 NIS Directive, significantly expands its scope, and introduces a uniform sanctions regime with personal liability for managers.<\/p>\n The NIS2UmsuCG has been in force since December 6, 2025. The often-cited “appropriate security” has now been concretized by the ENISA Technical Implementation Guidance (June 2025) \u2013 this is the difference from older compliance frameworks that allowed more room for interpretation. Anyone arguing they lacked clarity on what exactly needed to be done has a research problem, not a regulatory problem.<\/p>\n Art. 21 NIS2 defines ten categories of measures that a regulated entity must have implemented and documented. ENISA further clarified in Q1 2026: MFA for privileged access, remote access accounts, and vendor accounts is “practically always appropriate” \u2013 leaving little room for interpretation through “where appropriate.”<\/p>\n\n What Many Already Have<\/p>\n What Is Typically Missing<\/p>\n Germany was one of the last EU members to implement it. The NIS2UmsuCG came into force on December 6, 2025, almost 15 months after the European implementation deadline. Between its adoption and operational BSI enforcement, affected companies had approximately 13 weeks \u2013 less than a quarter \u2013 for risk management setup, documentation, and registration.<\/p>\n Austria adopted the NISG 2026 on December 12, 2025. Effective: October 1, 2026. Affected Austrian companies thus have a short window to establish their compliance foundations before the new supervisory authority \u2013 the Federal Office for Cybersecurity \u2013 enters its operational phase. Scope: approximately 4,000 companies from 18 sectors.<\/p>\n Poland implemented one of the most far-reaching implementations in the EU with the KSC Act on April 3, 2026: 42,000 regulated entities, expanded from previously around 400. This is not a typo. For German-Polish supply chains and nearshoring partners, this means immediate compliance pressure on both sides.<\/p>\n Switzerland: Not an EU member, no direct NIS2 obligation. For Swiss companies acting as IT service providers for NIS2-regulated EU entities\n Five steps cover the most common compliance gaps. None of these points require ISO 27001 \u2013 but all demand written proof.<\/p>\n\n Every question is locked. A tap unlocks the answer.<\/p>\n\n Essential entities are companies in sectors of high criticality (Annex 1 BSIG) with at least 250 employees or 50 Mio. EUR annual turnover and 43 Mio.\n In the event of a significant security incident – defined as an incident with considerable impact on the service – an initial report must be submitted to the BSI within 24 hours. A more detailed assessment follows within 72 hours, and a final report after one month. Reporting is done via the BSI reporting portal. A “significant incident” is a term that the BSI will further specify – when in doubt: report, don’t wait.<\/p><\/details>\n\n Not necessarily in the form that suppliers themselves must be registered. However, regulated entities are obliged to assess and manage security risks in their supply chain. This means: written evidence of security practices from IT service providers with critical access, minimum contractual requirements, and audit rights. Those who fail to do so bear the liability risk themselves.<\/p><\/details>\n\n
\n
DACH Region’s Implementation Status<\/h2>\n
What IT Teams Must Check Now<\/h2>\n
Frequently Asked Questions<\/h2>\n
What Qualifies as an ‘Essential Entity’ under NIS2?<\/strong><\/summary>\n
The 24-hour Reporting Obligation in Detail<\/h3>\n
Must Suppliers Themselves Be NIS2-Compliant?<\/strong><\/summary>\n
More from the MBF Media Network<\/h3>
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-bsi-kritis-cloud-multi-cloud-compliance-61618487.jpg\")
<\/span>cloudmagazin<\/span>Architecture Drives Compliance Costs: How to Cut Them<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-csrd-eu-omnibus-2026-berichtspflicht-esr-38916809-250x167.jpg\")
<\/span>MyBusinessFuture<\/span>CSRD Post-2026: Reporting Changes and ESRS Relief for SMEs<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-deloitte-2026-operator-orchestrator-tech-80856405-250x143.jpg\")
<\/span>Digital Chiefs<\/span>From Operator to Orchestrator: What the Deloitte 2026 Study Means for DACH Executives Evaluating Their Tech Leadership<\/span><\/span><\/a>","protected":false},"excerpt":{"rendered":"The BSI has been in the operational testing phase since May 2026. What the NIS2 enforcement wave means for 29,500 regulated entities in Germany.","protected":false},"author":10,"featured_media":13800,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"","_yoast_wpseo_title":"NIS2 Enforcement 2026: BSI Audit Phase and DACH Checklist","_yoast_wpseo_metadesc":"NIS2 enforcement starts May 2026: \u20ac10m fines, registration & compliance checklist required.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":["nis2-enforcement-welle-q2-2026-erste-eu-verfahren-laufen-was","nis2-enforcement-welle-q2-2026-erste-eu-verfahren-laufen-was-2"],"footnotes":""},"categories":[3,255,259],"tags":[],"class_list":["post-13815","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aktuelles","category-praxis-umsetzung-en","category-strategie-governance-en"],"evm_reading_time_minutes":1,"wpml_language":"en","wpml_translation_of":17967,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/13815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=13815"}],"version-history":[{"count":4,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/13815\/revisions"}],"predecessor-version":[{"id":21423,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/13815\/revisions\/21423"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/13800"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=13815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=13815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=13815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}