Skip to main content
German NIS2 Implementation Act · self-check

Is your company in scope of NIS2?

At most eight questions, three minutes: the check shows whether you are probably an essential or important entity in Germany, which duties have applied since 6 December 2025 and where you stand.

Start the check

Free · up to 8 questions · no sign-up

The NIS2 check

Pick one answer per question. You see the result right away, with the reference in the German BSI Act for every point.

Question 01 of 8

Does your company operate a critical facility (KRITIS) in Germany?

Critical facilities are of high importance for supplying the population, for example in energy, water, health or transport.

Does your company offer one of these services?

For these providers NIS2 applies regardless, or largely regardless, of company size.

Which sector is your company active in?

Pick the sector of your main activity. Activities that are negligible compared with your business as a whole do not count (Section 28 (3) BSIG).

How many employees does your company have?

Counted in annual work units: part-time staff pro rata, trainees and staff on parental leave not at all. Partner and linked enterprises generally count too.

What are your annual turnover and balance sheet total?

Use the most recent annual accounts.

Has your company already registered with the BSI?
Do you manage information security with a documented management system, for example under ISO 27001 or BSI IT-Grundschutz?
Is there a defined process for reporting a significant security incident to the BSI within 24 hours?

Result …

What to look at

The duties that then apply

An assessment based on your answers, not legal advice. For a binding assessment, please consult your legal counsel.

The full evaluation as a PDF

We send you your result with every duty, its legal reference and your answers. If you like, we show you in a short call how preeco | information security makes your security management provable.

  • Classification and duties with their reference in the BSIG
  • Your open points with concrete next steps
  • Your answers, ready to pass on to management or legal counsel

Privacy
We use your answers and contact details to send you the evaluation and to contact you. Please see our privacy policy.

Thank you for your inquiry!

Thank you. We will email you the evaluation shortly and get in touch for a quick follow-up.

FAQ

Frequently asked questions

The German NIS2 Implementation Act took effect on 6 December 2025 (BGBl. 2025 I No. 301). The duties of the new BSI Act have applied since then without a general transition period; entities in scope must register no later than three months after coming into scope.

In annual work units under the EU Commission’s SME recommendation: part-time staff count pro rata, trainees and staff on parental leave do not. Data of partner and linked enterprises is generally added (Section 28 (4) BSIG).

The classification depends on sector and size. The duties on risk management, reporting, registration and management apply to both; the main difference lies in how the BSI supervises them.

Often yes, indirectly: customers in scope must manage the security of their supply chain (Section 30 (2) no. 4 BSIG) and pass requirements on through contracts and supplier questionnaires.

No. The check is an assessment based on your answers and names the legal reference for every point. For a binding assessment of your case, please consult your legal counsel.