NIS2 in Germany: what the BSIG asks of networks

Germany transposed NIS2 with the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which came into force on 6 December 2025 and rewrote the BSI Act (BSIG). It reaches far more companies than the old KRITIS rules: particularly important entities (besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen) in the sectors of NIS2, as well as operators of critical installations. For most of them the practical questions are three: are we registered with the BSI, can we report a significant incident within 24 hours, and will we notice it early enough to do so.

Who is covered

The size thresholds follow NIS2. In general, a company is in scope if it works in one of the sectors the law lists and is at least medium-sized: 50 or more staff, or an annual turnover and a balance sheet total both above EUR 10 million. Some entities are covered regardless of size. The BSI's pages on NIS-2-regulated companies explain how to check whether yours is one of them.

Registration with the BSI

A covered entity registers with the BSI within three months of becoming covered (§ 33 BSIG). Registration has two steps: an account with Mein Unternehmenskonto (MUK), then registration in the BSI portal. For companies covered from the start, the three months ran from 6 December 2025.

Reporting: 24 hours, 72 hours, one month

Significant incidents are reported in stages (§ 32 Abs. 1 BSIG): an early first report within 24 hours of becoming aware of the incident, a report within 72 hours, an interim report if the BSI asks for one, and a final report no later than one month after the 72-hour report; if the incident is still ongoing then, a progress report is due instead and the final report once it has been handled (§ 32 Abs. 2). The stages and what each must contain follow Article 23 of NIS2. Reports go to the joint reporting office (gemeinsame Meldestelle) run by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK), which is reached through the BSI portal; an entity that has a significant incident before it has registered uses a form in the BSI's reporting and information portal (MIP). Our NIS2 deadline calculator turns the moment you became aware into dates.

Risk-management measures, and attack detection

The BSIG takes over the risk-management measures of Article 21 NIS2: incident handling, business continuity, supply-chain security, policies for assessing whether the measures work, and more. The law names no product.

Operators of critical installations have one requirement more. Under § 31(2) BSIG they must use attack detection systems (Systeme zur Angriffserkennung) that continuously and automatically capture and evaluate suitable parameters from ongoing operation. The BSI publishes guidance on what such systems should cover.

What this means for network monitoring

You cannot report within 24 hours an incident you have not noticed. Most intrusions that end in a reportable incident cross the network long before they cause damage: a workstation checking in with an outside server, one host scanning others, new administrator sessions, a large upload at night. Watching that traffic continuously is one of the few ways a small team notices in time, and it covers devices that cannot run an endpoint agent, such as printers, cameras and production machines.

For operators of critical installations, network detection can be one part of an attack detection system under § 31(2) BSIG. Whether a particular set-up meets the requirement is for the operator to show to its auditor; no tool meets it on its own.

What NetSenX does, and what it does not

NetSenX watches how every host behaves on the network and flags command-and-control beaconing, scanning, lateral movement and unusual outbound data volume, on every plan, Free included. It explains every alert in plain language, writes alerts, analyst decisions and configuration changes to an audit log, and tracks each incident against the NIS2 Article 23 deadlines. Customer data is stored in the EU, with the API in Frankfurt and Paris.

NetSenX does not decide whether your company is covered, does not register it with the BSI and does not submit reports on your behalf: those duties stay with you. The Free plan monitors up to 3 devices with no time limit; see pricing and NIS2 network monitoring.

FAQ

Since when does NIS2 apply in Germany?

Since 6 December 2025, when the NIS2UmsuCG came into force and the new BSI Act (BSIG) began to apply.

Where do German companies report NIS2 incidents?

To the joint reporting office of the BSI and the BBK (gemeinsame Meldestelle), reached through the BSI portal: an early first report within 24 hours of becoming aware of a significant incident, a report within 72 hours and a final report within one month after that (§ 32 Abs. 1 BSIG). Before registration, the BSI's reporting and information portal (MIP) has a form for it.

Does every covered company need an attack detection system?

The explicit duty in § 31(2) BSIG applies to operators of critical installations. Other covered entities must take the BSIG's risk-management measures, which name no specific tool; continuous network monitoring is one way to detect and report incidents in time.

Does NetSenX register us or report to the BSI?

No. NetSenX detects suspicious network behaviour, keeps the alerts and the audit log a report draws on and tracks the reporting deadlines. Registration and reporting stay with your company.

Sources

Accessed on 7 November 2026; the three BSIG sections on 9 November 2026.

Written by the NetSenX Team at TriStiX S.L. This article is general information, not legal advice; check your obligations with the BSI or your legal counsel. Questions: info@netsenx.com.