NIS-2 Consulting

Q: What distinguishes a critical infrastructure from a particularly critical infrastructure?

Size. Organizations in regulated sectors with 50 or more employees or more than 10 million euros in revenue and total assets are considered important entities; those with 250 or more employees or more than 50 million euros in revenue and 43 million euros in total assets are considered particularly important entities. Operators of critical infrastructure are always considered particularly important.

Q: Do we need to register with the BSI?

Yes, if you are classified as an important or particularly important entity. According to Section 33 of the BSIG, you have three months to do so, calculated from the date on which you are first classified as such an entity. Changes to the registered data must be reported immediately, no later than within two weeks.

Q: What exactly does the BSIG require of us?

Section 30 of the BSIG lists ten categories of risk management measures, including risk analysis, incident handling, business continuity, supply chain security, access control, and cryptography. In addition, there are reporting and documentation requirements. Section 38 of the BSIG explicitly assigns responsibility for implementation, monitoring, and training to senior management.

Q: Is management personally liable?

Section 38 of the BSIG explicitly holds management accountable: It must approve the risk management measures, monitor their implementation, and undergo training itself. Lawyers can advise on the scope of personal liability in individual cases; we provide support with the technical implementation.

Q: How do NIS-2 and KRITIS differ?

Under NIS-2, the BSIG covers significantly more facilities than the previous KRITIS legislation; the key factors are sector and size. Operators of critical infrastructure that also exceed the thresholds set by the KRITIS Regulation are always considered particularly important facilities and are additionally subject to the obligation to provide evidence under Section 39 of the BSIG.

Meet regulatory requirements with confidence now

The NIS-2 Directive significantly tightens cybersecurity requirements in the EU. Many companies – especially those in KRITIS-related and regulated industries – are directly affected for the first time or must substantially expand their existing security measures.

With a structured NIS-2 implementation, you ensure that your company remains compliant, reduces risks, and avoids penalties.

Why NIS-2 is relevant to your company

The NIS-2 Directive requires companies to implement comprehensive technical and organizational measures, as well as to adhere to clearly defined reporting and documentation obligations.

Affected sectors include, among others:

Energy, transportation, and transit
Healthcare
Finance and insurance
IT and telecommunications
Public administration
Sectors of industry and manufacturing

Many small and medium-sized enterprises are also subject to the regulation.

The benefits of complying with the legal requirements:

Avoiding fines and liability risks
Increasing your company’s cyber resilience
Clear structures and responsibilities
Trust among customers, partners, and regulatory authorities
Competitive advantages through demonstrable compliance

Our NIS-2 consulting: A pragmatic approach to compliance

We provide structured and efficient support in implementing the NIS-2 requirements:

Conducting a gap analysis
Deriving concrete measures from regulatory requirements
Establishing or further developing an ISMS (e.g., in accordance with ISO 27001)
Implementing risk and incident management processes
Support with reporting obligations and reporting procedures
Raising awareness and training your employees

Our approach: practical, audit-ready, and tailored to your organization.

Typical areas of focus under NIS-2

We specifically address the key requirements of the directive:

Risk management and security strategy
Incident detection, response, and reporting processes
Business continuity and crisis management
Supply chain and third-party risks
Access controls and technical security measures
Security Awareness at All Levels

Optional: External information security officer

The requirements of NIS-2 must be met on an ongoing basis – not just implemented once. Upon request, we also provide long-term support:

Operation and further development of your ISMS
Coordination of regulatory requirements
Preparation for audits and compliance demonstrations
Support during security incidents

Why abat?

With abat, you can rely on an experienced partner for regulated environments:

Comprehensive expertise in ISO 27001, KRITIS, and regulatory requirements
Many years of experience in establishing and operating ISMS
A practical approach with a focus on feasibility
A combination of methodological and technical expertisez

We help you implement NIS-2 efficiently and sustainably – without unnecessary complexity.

The next step: Check your NIS-2 readiness now

Whether you’re already affected or want to prepare: We’ll analyze your current situation and identify specific areas where action is needed.

FAQs

Does NIS-2 apply to our company?

This can only be answered with certainty after a case-by-case legal review. The BSIG, as amended by the NIS-2 Implementation Act, is the governing legislation. Whether your company is affected depends, among other things, on your industry, the number of employees, and your revenue and total assets. We would be happy to assess your compliance status through an analysis and outline the next steps for you.

What distinguishes a critical infrastructure from a particularly critical infrastructure?

Do we need to register with the BSI?

What exactly does the BSIG require of us?

Is management personally liable?

How do NIS-2 and KRITIS differ?

TISAX^® is a registered trademark of the ENX Association. The mention of the TISAX^® trademark does not imply any statement by the trademark owner regarding the suitability of the services advertised here. The exclusive responsibility for the content of the website and the services presented here lies with abat.

Our customers in the area protect

Saskia

ISMS Consultant
Bremen

For me, abat is: fun, exciting projects - great customers and colleagues packed into a respectful and trusting atmosphere with plenty of room for continuous development!