The NIS2 Directive (EU 2022/2555) is a cybersecurity directive adopted by the European Union in December 2022. Its objective is to sustainably increase the level of cybersecurity across the EU. It requires EU member states to transpose binding requirements for network and information security into national law by October 17, 2024, at the latest.
These include comprehensive requirements relating to:
- the state of the art of technical and organizational IT security measures,
- mandatory reporting of IT security incidents,
- risk management and governance at management level,
- regulatory supervision, audits, and enforcement measures, as well as
- sanctions for non-compliance.
With this, NIS2 pursues the overarching goal of sustainably strengthening the cyber resilience of critical infrastructures and essential services in Europe, and of better protecting the EU against cyberattacks, IT disruptions, and systemic risks.
In Germany, the new “Act Implementing the NIS 2 Directive” entered into force on December 6, 2025. It transposes key provisions of the EU directive into national law and, in particular, expands the requirements for cybersecurity risk management, reporting of significant security incidents, and the responsibilities of the management bodies of affected entities.
NIS2 in a nutshell
The term “NIS” stands for “Network and Information Security.” The NIS2 Directive is the successor to the first NIS Directive (NIS1) from 2016 and significantly expands its scope of application, requirements, and enforcement mechanisms.
To whom does the NIS2 directive apply?
The aim of the NIS guidelines is to equip system-relevant private and public sectors of the EU states with appropriate security technology and to improve the cooperative exchange of information on the subject of network security between the member states. NIS2 defines even clearer identification criteria for belonging to critical infrastructures according to the European Programme for Critical Infrastructure Protection (EPCIP) and includes new sectors:
Additional EPCIP sectors since NIS2 (2022)
- Production & processing (among others food, medical products, chemicals, vehicals, electronics, machinery)
- Providers of publicly available electronic communications services
- ICT service management (information and communication technologies, ICT in short)
- Public administration
- Space
- Postal and courier services
- Waste and waste water management
- Research
So who is affected by NIS2?
Whether a company is subject to NIS2 requirements depends primarily on its activities, the type of entity, and statutory size criteria. The German BSI Act distinguishes between particularly important and important entities. Special provisions apply to certain types of entities regardless of company size. Companies should therefore assess whether they fall within the scope of NIS2 based on the applicable legal criteria.
What companies should bear in mind about NIS2
Many companies will be newly affected by NIS2.
For example, providers of public electronic networks and communications services, manufacturers of data processing equipment, electronic, and optical products, and managers of information and communications technologies will all come under closer scrutiny under the new directive. This also includes system vendors and other technical suppliers. So, what now?
This is a lawyer providing clear answers on the impact of NIS2:
The NIS2 directive addresses current cybersecurity threats by recognizing the impact of compromised or incapacitated organizations in a wider range of sectors, and makes these organizations accountable for a required level of information security. It also establishes a European information and network security communication and cooperation network, EU-CyCLONe.
"Directive (EU) 2016/1148 of the European Parliament and the Council aimed to build cybersecurity capabilities across the Union, mitigate threats to network and information systems used to provide essential services in key sectors and ensure the continuity of such services when facing incidents, thus contributing to the Union’s security and to the effective functioning of its economy and society."
Directive (EU) 2022/2555 of the European parliament and of the council of 14 December 2022
Coordinated risk and crisis management
Specifically, the NIS2 directive serves as a "coordinated cybersecurity framework." It calls for national cybersecurity strategies and responsible authorities, e.g. as secure, central contact points, constantly available computer security incident response teams (CSIRTs), and risk and crisis management officers.
Compared to NIS1 the tasks that these authorities fulfill are more precisely defined, as are the components the network security strategy should consist of, e.g. security of the supply chain, secure communication, use of encryption and access controls, emergency communication systems, and more (see legal info paper). For the technical protection of particularly sensitive network communications, R&S Networks and Cybersecurity also offers specialized Layer 2 and Layer 3 network encryption solutions.
Tighter enforcement
Clear regulations are in place for monitoring and reporting. The European Union Agency for Cybersecurity (ENISA) shall keep a register of digital infrastructure companies covered by the directive. Significant security incidents must generally be reported to the BSI through an early warning within 24 hours of becoming aware of the incident, followed by a more detailed notification within 72 hours. A final report is generally due no later than one month after the 72-hour notification.
The institutions affected by NIS2 must prove that they comply with the relevant network security concepts by means of various versions of due diligence and proof of implementation (more on this in the legal info paper). In the event of violations, fines of up to EUR 10 million or 2 percent of the previous year’s worldwide turnover are to be expected.
The best way for companies to prepare for NIS2 implementation
Small and medium-sized companies should take heed when it comes to NIS2: Manufacturing and processing industries in diverse sectors now have to take care of their network security just as much as large corporations. Whether the food or automotive industry, or manufacturers, processors, or distributors of medical, electronic, or chemical products – many companies must now reassess their network security and adapt it if necessary.
How can companies systematically implement the applicable NIS2 requirements? Our infographic outlines ten steps to help you assess your IT security, identify risks, and make targeted improvements to the necessary security measures.
Hands-on tips for NIS2 directive implementation: What you can do now
With the entry into force of the German NIS2 Implementation Act, affected entities are now subject to binding cybersecurity risk management requirements. Companies should therefore review their current security posture, assess existing risks, and consistently implement the necessary technical and organizational measures. The following tips show you where to start.
Make precautionary arrangements
Regularly assess your current cybersecurity posture and identify existing security vulnerabilities. How sensitive and critical are your data and services? What impact would a cyberattack, system disruption, or prolonged outage have on your business operations?
If you rate both of these highly, your network needs to be adequately protected. This starts with your technical equipment with secure, European gateways and firewalls as well as encryption solutions tailored to your needs and leads on to good risk management.
Hands-on tip:
Here we have compiled a clear overview of what is involved in professional network security.
In addition, you can assess the level of security measures you need to consider:
Conduct professional risk management
The first task in effective risk management is to clearly define responsibilities: Who is in charge of protecting the network and to what extent – the in-house IT, a special security team, or an external service provider? What risks are relevant for you, and how do you protect yourself against them?
Clear regulations help to deal with security incidents and to keep operations running even in a crisis. Network security ranges from employee training, a secure supply chain, tested network components, systems, and services, and cyber hygiene procedures, over the use of network and disk encryption, access controls, and authentication, to secure voice, video, and text communications, and much more.
Hands-on tip:
You can immediately upgrade the security of your existing devices without much extra effort. We'll show you exactly how here. We have also got more hands-on tips to help you build a solid security foundation.
You can also read our white paper on how to gain network visibility using deep packet inspection and encryption proxies:
Whitepaper: Network visibility through DPI and encryption proxies
Ensure ability to (re)act
If something should go wrong despite all the precautions, damage limitation is ensured by emergency teams and procedures. Your network security emergency response team should be available at all times, have redundant communication channels, and be in a secure location.
Regular situation assessments and proactive vulnerability analysis help them to monitor your network around the clock, detect threats early, and inform you immediately in the event of a security incident.
Hands-on tip:
Cloud-based network management increases your network security and reduces the load on security managers. The network management cloud takes over essential monitoring tasks and simplifies the configuration of your firewalls and other devices. A well-coordinated Security Information and Event Management (SIEM) system is worth its weight in gold here. Take a look for yourself: Cloud-managed security!
Ensure recovery from security incidents
After an IT security incident, every effort is made to recover from the crisis. But even before a crisis happens, what you need is a mature concept for data protection and digital sovereignty.
A major step has been taken once you have data backups and geo-redundant cloud servers. In the best case scenario, you will have in-house capabilities to close any security gaps and maintain the security of your systems.
Hands-on tip:
Test your digital sovereignty with our checklist and find out about the relevance of data sovereignty!
Or you can get familiar with our tips for digitally sovereign companies and authorities.
Count on good cooperation and support
While the prevention, resolution, and recovery from incidents is one thing, having the experts and resources to do so is another. NIS2 requires security precautions throughout the acquisition, development, maintenance, and management of networking and information systems. But not every company has the capacity for its own cybersecurity team.
In-house IT or experienced employees often have to manage network security and tasks such as firewall configurations in addition to their other duties. In cases like these, life can be a lot easier if you can rely on the right support.
Hands-on tip:
Let your UTM firewall do most of the work! With a user-friendly web interface as the central management console in the browser, the R&S®LANCOM Unified Firewalls provide a comprehensive overview of all devices and connections in the network, making it considerably easier to implement security requirements.
In addition, we support you with numerous support and training offerings as well as helpful reference projects for orientation and information:
Customer reference story: Secure VPN remote maintenance at OPTIMA
Customer reference story: Security package for practices with Hasomed
Conclusion: The new EU NIS2 directive affects significantly more companies and institutions than its predecessor NIS1. It has more stringent specifications, a more clearly defined verification of their implementation, and stricter sanctions in case of non-compliance.
Especially industries in food processing, manufacturing, providers of public electronic network and communication services, and administrators of information and communication technologies need to check whether the new guidelines apply to them and to monitor how their country is implementing the EU's requirements into national law.
Companies in the affected sectors should assess which statutory NIS2 obligations apply to them and whether their technical and organizational security measures meet the requirements. R&S Networks and Cybersecurity supports them with secure network solutions, high-performance firewalls, network and disk encryption tailored to their needs, and comprehensive security expertise.
How should companies begin implementing NIS2?
Companies should first determine whether they are subject to the NIS2 Implementation Act. Next, they should identify critical services, systems, data, and dependencies and assess their current cybersecurity posture. This includes network infrastructure, gateways and firewalls, access rights, data backups, and emergency and recovery processes, among other things. Based on this assessment, companies can evaluate and prioritize risks, define clear responsibilities, and develop and document appropriate security measures.
What technical measures help with the implementation of NIS2?
Technical security measures should be tailored to the organization’s specific risks and protection needs. These may include secure gateways and firewalls, encryption of sensitive data in transit and on endpoints, access controls and authentication, secure system configuration and maintenance, vulnerability assessments, and centralized monitoring and SIEM capabilities. Data backups and appropriate recovery measures can also help limit the impact of security incidents. Technical measures should always be embedded in a comprehensive risk management framework with clear responsibilities and processes.
Why is network visibility important for NIS2?
Network visibility provides an overview of devices, connections, data flows, and security-related events across the corporate network. Centralized network management, monitoring, SIEM, and regular security assessments help identify unusual activity and potential threats early. This allows security incidents to be classified more quickly and response measures to be implemented in a more targeted way. At the same time, this increased transparency helps companies document risks and implemented security measures in a clear and traceable way.
Ask the AI chatbot!
Do you still have questions? Or maybe you cannot find the information you are looking for? The AI-based Digital Assistant will answer all your questions about network security, IT security, and R&S®LANCOM Unified Firewalls – at any time, quickly, and without searching! Alternatively, you can of course still use the contact form.
