Question 1

Is my company in scope for NIS 2 in Germany?

Accepted Answer

Scope under the NIS-2-UmsuCG in force since 06 December 2025 depends on sector and size. Essential entities include energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space, with thresholds at 250 employees or 50 million euros turnover. Important entities include postal and courier services, waste management, manufacture of chemicals, food, medical devices, computers and machinery, motor vehicles, digital providers and research, at 50 employees or 10 million euros turnover. Roughly 29,500 companies in Germany are estimated to fall into scope, against around 4,500 under the previous BSIG regime.

Question 2

What are the NIS 2 incident reporting deadlines?

Accepted Answer

Under § 32 BSIG, an essential or important entity must submit an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours with an initial assessment and indicators of compromise, an interim report on request, and a final report within one month including a root cause analysis, the mitigation measures applied and the cross-border impact. The competent authority is the Bundesamt für Sicherheit in der Informationstechnik, BSI, via its single point of contact. Late or missing reports are sanctioned under § 60 BSIG with fines up to 10 million euros or 2 percent of global turnover for essential entities.

Question 3

What is the ISO 27001:2022 transition deadline?

Accepted Answer

Accredited certification bodies could only issue new ISO/IEC 27001:2013 certificates until 31 October 2023, and existing certificates had to be transitioned to ISO/IEC 27001:2022 by 31 October 2025 under IAF Resolution 2022-08 and IAF MD 26. Since 01 November 2025 any active ISO 27001 certificate must reflect the 2022 version. The new Annex A reduces the control count from 114 to 93 and groups them into four themes: organisational, people, physical and technological controls. Companies that missed the deadline must restart with a full Stage 1 and Stage 2 audit, typically adding three to six months of effort.

Question 4

How does DORA relate to NIS 2 for German banks?

Accepted Answer

DORA, Regulation 2022/2554, applies to financial entities as lex specialis from 17 January 2025 and takes precedence over NIS 2 for the same subject matter under Art. 1 Abs. 2 DORA and Art. 4 NIS-2 Directive. German banks therefore comply with DORA Art. 5 to Art. 16 on ICT risk management, Art. 17 to Art. 23 on incident reporting to the BaFin, Art. 24 to Art. 27 on resilience testing including TLPT every three years for significant institutions, and Art. 28 to Art. 30 on third-party ICT risk. BaFin repealed VAIT with effect from 17 January 2025, and BAIT no longer applies to DORA institutions; the ICT risk control function now follows from Art. 6 Para. 4 DORA.

Question 5

What does an external CISO cost in Germany?

Accepted Answer

An external CISO or CISO as a service for a mid-sized German company between 100 and 1,000 employees usually costs 3,000 to 9,000 euros per month for ongoing oversight, plus 180 to 320 euros per hour for project work such as ISO 27001 implementation, NIS 2 readiness or DORA gap assessment. A full ISO 27001:2022 implementation programme for an organisation of 200 employees typically runs at 60,000 to 120,000 euros across six to nine months. The model is materially below a permanent CISO at 130,000 to 200,000 euros gross salary plus tooling, and provides a documented escalation path independent from operational IT.

Question 6

How does NIS 2 affect German subsidiaries of US groups?

Accepted Answer

A US group with a German subsidiary in an in-scope sector is treated as an essential or important entity at the level of the German entity if the size thresholds are met. The German Geschäftsführer carries personal supervisory responsibility under § 38 BSIG and can be liable for failure to ensure cybersecurity risk management. Group security policies must be translated into German artefacts including a written ISMS scope, an incident response plan aligned to the § 32 BSIG deadlines and a BSI single point of contact registration. Reliance on a US-based SOC is permitted but requires a documented third-party governance, encryption requirements and a tested handover for the 24-hour early warning.

Question 7

Is the information security officer protected from dismissal?

Accepted Answer

The information security officer does not benefit from a statutory dismissal protection comparable to § 6 BDSG. Protection is implemented through contractual independence: a defined reporting line to the management board, written authority to halt non-compliant projects, indemnification for good-faith decisions and a fixed term that aligns with audit cycles, typically three years. § 38 BSIG obliges the management to implement the risk management measures, supervise their implementation and undergo training itself; appointing an officer does not release it from that duty. An external CISO arrangement on a service contract removes the dismissal question and is the standard model for mid-sized companies that need senior expertise without a permanent hire.

Information Security Officer (ISB / CISO)

Talk to us about Information Security Officer (ISB / CISO)

What is an Information Security Officer in Germany?

Duties of the Information Security Officer

When must an Information Security Officer be appointed?

Typical sectors

How CIVAC supports your Information Security Officer

Frequently asked questions

Need this officer role for your organisation?