NIS-2 Compliance.
What is important for companies now:

The NIS-2 Directive comes into force on October 1, 2024. With the transposition of the new EU NIS-2 Directive into national law, around 29,000 companies will become the direct focus of Germany's cybersecurity agenda in addition to critical infrastructures.

 

With the implementation of the NIS2 Directive and the KRITIS Framework, there will be two main groups of sectors from 2024:

1. critical sectors for operators of critical facilities (KRITIS)

2. essential and important entities from the NIS-2 Directive.
 

Operators of critical facilities automatically become a essential entitie with NIS-2.

The regulation of the organisations and the amount of fines that may be incurred depend on the classification of the organisation as

• essential entisies with or without critical facilities or

• important entities.

​

▶︎ 1. Operators of critical facilities 

Critical facilities are those whose failure or impairment could have a significant impact on the security of supply or public safety.

The sectors for operators of critical facilities are defined in the KRITIS Framework. They overlap with the sector definition from the NIS-2 Directive. Some of the critical services and facilities still have to be defined in an ordinance. The KRITIS Framework is still being drafted.

Threshold values for critical facilities are defined in the “Ordinance on the Determination of Critical Infrastructures” in accordance with the BSI Act BSI-KritisV (de).

​

▶︎ 2. Entities

The sectors for facilities are defined in Annexes 1 and 2 of the NIS-2 Directive (de) (government draft of 22.7.2024). Membership of a particularly important or important facility depends on the size of the company, the sector and, in some cases, the specific industry.

Particularly important institutions and important institutions are obliged to take appropriate technical and organizational measures to ensure the security of their information technology systems.

​

❗️Companies themselves are responsible for identifying KRITIS facilities and determining whether they are affected as NIS2 facilities.