![\"Im](\"https:\/\/visit.astrum-it.de\/wp-content\/uploads\/2026\/04\/was-ist-nis2-1200x668.jpg\")
<\/p>\n
Ransomware, targeted sabotage, and supply chain attacks are no longer isolated incidents but rather an ongoing risk for businesses and public institutions.<\/p>\n
Organizations whose failure would have far-reaching consequences are therefore a particular focus of regulatory requirements.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
Cyber Resilience as a Strategic Priority<\/h2>\n
Against this backdrop, cyber resilience is becoming increasingly important: the ability not only to prevent security incidents, but also to limit their impact and quickly restore business operations.<\/p>\n
The EU\u2019s NIS2 Directive and the national implementing law establish a significantly expanded regulatory framework for this purpose. Companies are required to<\/p>\n
- \n
- systematically establish cybersecurity<\/li>\n
- manage risks in a structured manner<\/li>\n
- report security incidents transparently<\/li>\n<\/ul>\n
This makes information security a business-critical discipline\u2014and a clear responsibility at the management level.<\/p>\n
NIS2 goes beyond purely technical measures: it requires a holistic approach that encompasses organization, processes, and technologies in equal measure.<\/p>\n<\/div>
Which companies are affected?<\/h2>\n
Whether a company falls under the NIS2 regulation must generally be determined independently<\/a><\/strong>. The law distinguishes between important and critical infrastructure operators<\/strong>\u2014a classification that can be complex in detail.<\/p>\n
As a general guideline, the following are particularly affected:<\/p>\n
- \n
- KRITIS operators<\/a><\/strong><\/li>\n
- Trust service providers (e.g., qualified digital signature providers)<\/li>\n
- Operators of DNS services and TLD registries<\/li>\n
- Providers of public telecommunications services and networks<\/li>\n
- Companies with 50 or more employees or with more than \u20ac10 million in revenue and total assets in defined sectors<\/li>\n<\/ul>\n
An official classification test is provided by the Federal Office for Information Security (BSI).<\/p>\n<\/div>
Overview of Relevant Sectors<\/h2>\n
The NIS2 Directive covers a wide range of industries, including:<\/p>\n
- \n
- Energy supply<\/li>\n
- Transportation and traffic<\/li>\n
- Finance<\/li>\n
- Healthcare and medical technology<\/li>\n
- Water and wastewater management<\/li>\n
- Digital services and IT infrastructure<\/li>\n
- Food industry<\/li>\n
- Chemical and manufacturing industries<\/li>\n
- Research institutions<\/li>\n<\/ul>\n
As a result, NIS2 affects a significant portion of the German economy\u2014estimates suggest that around 30,000 companies are affected.<\/p>\n<\/div><\/div><\/div><\/div><\/div>
Key Obligations for Companies<\/h2>\n
Companies subject to NIS2 must meet a number of specific requirements. These include, in particular:<\/p>\n
Registration and Record-Keeping<\/h3>\n
- \n
- Registration with the BSI<\/li>\n
- Documentation of implemented security measures<\/li>\n
- Record-keeping obligations (e.g., through audits of KRITIS operators)<\/li>\n<\/ul>\n
Risk Management and Security Measures<\/h3>\n
- \n
- Conducting structured risk analyses<\/li>\n
- Implementing business continuity and crisis management processes<\/li>\n
- Deploying technical measures such as encryption and multi-factor authentication<\/li>\n
- Training and raising awareness among employees<\/li>\n<\/ul>\n
Reporting and Information Obligations<\/h3>\n
- \n
- Immediate reporting of significant security incidents to the BSI<\/li>\n
- Ongoing reporting on incident management<\/li>\n
- Notification of customers or partners upon order of the authorities<\/li>\n<\/ul>\n
Consequences of violations<\/h3>\n
- \n
- Ensuring and monitoring the measures<\/li>\n
- Mandatory training<\/li>\n
- Personal liability for breaches of duty<\/li>\n<\/ul>\n
KRITIS operators are also subject to additional requirements, such as restrictions on the use of certain critical components.<\/p>\n
Consequences of violations<\/h3>\n
The NIS2 regulation provides for graduated sanctions, some of which are substantial. Fines can amount to up to \u20ac10 million or 2% of global annual turnover\u2014whichever is higher.<\/p>\n
Furthermore, liability can be extended to management. Violations can result not only in regulatory consequences but also in personal liability risks for board members and executives.<\/p>\n<\/div>
Implementation: Holistic and Practical<\/h2>\n
The requirements of NIS2 apply not only to IT systems but to the entire organization\u2014from technical safeguards and processes to physical security.<\/p>\n
ASTRUM IT helps companies implement these requirements in a structured and sustainable manner\u2014as part of a holistic, future-proof IT strategy.<\/p>\n
This includes, among other things:<\/p>\n
- \n
- Custom software development<\/strong><\/a> that integrates security from the very beginning<\/li>\n
- Fully managed hosting<\/a><\/strong> and operations on GDPR-compliant<\/strong>, ISO 27001-certified infrastructures in Germany<\/a><\/strong><\/li>\n
- Solutions such as VISIT<\/strong>, which make a significant contribution to physical access control\u2014for example, in visitor management<\/a><\/strong> and yard management<\/strong><\/a>.<\/li>\n<\/ul>\n
This creates a comprehensive approach that combines digital and physical security and lays the foundation for digital vitality.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"featured_media":3402,"template":"","meta":{"_acf_changed":false,"rs_blank_template":"","rs_page_bg_color":"","slide_template_v7":"","_links_to":"","_links_to_target":""},"mediathek-kategorie":[50],"class_list":["post-4667","news","type-news","status-publish","has-post-thumbnail","hentry","mediathek-kategorie-technology-insights-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news\/4667","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news"}],"about":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/types\/news"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media\/3402"}],"wp:attachment":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media?parent=4667"}],"wp:term":[{"taxonomy":"mediathek-kategorie","embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/mediathek-kategorie?post=4667"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Fully managed hosting<\/a><\/strong> and operations on GDPR-compliant<\/strong>, ISO 27001-certified infrastructures in Germany<\/a><\/strong><\/li>\n
- Custom software development<\/strong><\/a> that integrates security from the very beginning<\/li>\n
- KRITIS operators<\/a><\/strong><\/li>\n