Compliance Regulations

NIS2 Implementation Act and Critical Infrastructure Protection Act: What Companies Must Implement Now

10. March 2026
19 min. reading time

New Regulatory Requirements for Greater Resilience, Security, and Crisis Preparedness

At the turn of the year, Germany adopted two new laws: the Critical Infrastructure Protection Act (KRITIS-Dachgesetz) and the NIS2 Implementation Act (NIS2-Umsetzungsgesetz). Together, they establish, for the first time, nationwide, cross-sector minimum standards for the physical protection of critical infrastructure while creating a stable framework for information and network security.

Dach Nis2

The Critical Infrastructure legislation and NIS2 require organizations to demonstrate measurable IT security and resilience. They significantly increase audit and documentation requirements while, for the first time, placing clear legal accountability on executive management.

For businesses, these new regulatory requirements mean that action can no longer be postponed. Organizations must now establish appropriate structures, adapt their processes, and clearly define responsibilities. But what does this mean in practice for your company? What actions need to be taken?

Nis2 Unternehmen

Key Takeaways

The Critical Infrastructure Protection Act and the NIS2 Implementation Act Have Been Adopted

Companies must now actively and formally address resilience, cybersecurity, and regulatory compliance requirements.

More Organizations Are Affected Than Expected

In addition to traditional Critical Infrastructure (KRITIS) operators, the legislation now also applies to IT service providers, software vendors, industrial companies, and logistics providers.

Concrete Implementation Requirements

Risk assessments, technical and organizational security measures, incident response processes, and secure supply chains must now be implemented and fully documented.

Management Is Accountable

Cybersecurity has become an executive responsibility under the law, including management liability, clear governance structures, and regular executive involvement.

What Is NIS2?

The NIS2 Implementation Act transposes the European NIS2 Directive into German law. It requires significantly more organizations to implement risk management, technical security measures, and rapid reporting of cybersecurity incidents. New requirements include stricter regulatory oversight, clear governance obligations, substantial financial penalties, and personal accountability for executive management in the event of non-compliance.

The NIS2 Implementation Act and the Critical Infrastructure Protection Act: Two Regulations – One Common Goal

The Critical Infrastructure Protection Act and NIS2 essentially pursue the same objective: strengthening the resilience of critical and security-relevant organizations.

What They Have in Common:

  • A risk-based approach: Organizations must systematically assess risks.
  • Mandatory security measures: Technical, organizational, and fully documented.
  • Incident reporting obligations: Rapid response is essential.
  • Supply chains are now a key focus: Risks no longer end at the company’s own boundaries.
  • Management accountability: Security is no longer solely an IT responsibility.

In short, both regulations require structured security instead of isolated individual measures. Nevertheless, they differ in their primary focus.

The Critical Infrastructure Protection Act is no longer limited to protecting individual IT systems. Instead, it focuses on creating organization-wide resilience. This includes the physical security of facilities, the protection of critical business processes, effective emergency and crisis management, and comprehensive organizational preparedness.

The legislation applies to the backbone of society—organizations operating in the energy, water, healthcare, food, IT and telecommunications, transport, and logistics sectors. Its central question is:

How can business operations remain functional under all circumstances?

NIS2, by contrast, focuses specifically on IT and information security. Its key elements include clearly defined minimum security requirements, stricter incident reporting obligations, personal management accountability, and significant penalties for non-compliance—even for organizations that are not classified as Critical Infrastructure operators.

Simply put:
The Critical Infrastructure Protection Act and NIS2 are not alternatives—they complement each other. While the Critical Infrastructure Protection Act establishes the framework for physical and organizational resilience, NIS2 defines concrete requirements for cybersecurity and information security. Organizations should therefore consider both regulatory frameworks together rather than treating them separately.

Success belongs to organizations that approach resilience holistically (Critical Infrastructure Protection Act), implement cybersecurity systematically (NIS2), and combine both within an integrated security strategy.

Because in reality, one principle always applies: An IT outage is always an operational risk—and vice versa.

Who Is Affected – and Why Many Organizations Underestimate It

The new legal requirements apply to significantly more organizations than many realize—and often indirectly. As a result, many companies only discover at a late stage that they are affected.

The regulations apply directly to:

  • Operators of Critical Infrastructure (e.g., energy, water, healthcare, transport)
  • Medium-sized and large companies operating in designated sectors (NIS2)
  • IT and cloud service providers
  • Managed Service Providers (MSPs) and data center operators

The following organizations are now also indirectly affected:

  • Suppliers and service providers to Critical Infrastructure operators
  • Software vendors with significant market relevance
  • Industrial companies with critical production functions
  • Logistics and transportation companies

The determining factor is not only the industry, but also an organization’s importance for essential services, the economy, or digital infrastructure.

The backbone of our society is affected—organizations operating in the energy, water, healthcare, food, IT and telecommunications, transport, and logistics sectors. The central question is:

The central question is: How can business operations remain functional under all circumstances?

Why Many Organizations Still Underestimate Their Exposure:

  • Typical misconceptions (“We are not a Critical Infrastructure operator.” or underestimating the size and relevance of their organization.)
  • Supply chains are overlooked: Even organizations that are not directly regulated are often subject to requirements through their customers or business partners.
  • Focusing only on IT: The Critical Infrastructure Protection Act aims at holistic organizational resilience, including physical security and organizational preparedness.
  • “The regulations are not in force yet.”: Both laws have been adopted and are legally binding, including penalties for non-compliance.

In short: Any organization that plays a critical role in supporting the economy or society should proactively assess whether it falls within the scope of these regulations—rather than waiting for an inquiry from the supervisory authorities.

NIS2 Requirements: What Companies Must Implement Now

Unternehmen organisieren

Organizations must no longer merely define appropriate security measures—they must also implement and document them in a transparent and verifiable manner.

1. Establish a Comprehensive Risk Assessment

Both the Critical Infrastructure Protection Act and NIS2 require organizations to conduct a systematic risk assessment—not only at the IT level.

This includes:

  • Identifying critical business processes
  • Assessing cyber, physical, and organizational risks
  • Analyzing dependencies (e.g., service providers, energy supply, supply chains)

It is important to note that the risk assessment is not a one-time project, but a continuous process.

Organizations must implement appropriate technical and organizational measures and be able to demonstrate them.

This includes:

  • Access controls and Identity Management (a core focus of OEDIV SecuSys)
  • Network security and segmentation
  • Patch and vulnerability management
  • Backup and disaster recovery concepts
  • Physical protection of critical facilities

The key is not only implementing these measures, but also ensuring they are fully documented and verifiable during audits.

NIS2 significantly strengthens incident reporting requirements:

  • Early warning notification within 24 hours
  • Detailed reports within a few days
  • Documented root cause analysis and corrective actions

To meet these requirements, organizations need a robust incident response plan, clearly defined roles and escalation procedures, and regularly tested processes (such as tabletop exercises, which are unfortunately still neglected too often in practice).

Cybersecurity is no longer purely an IT issue. It has become a strategic, organization-wide responsibility. One of the most significant changes introduced by NIS2 is that executive management is now directly responsible for implementation—including personal liability. 

In practical terms, this means cybersecurity must become a permanent agenda item for executive leadership. This includes regular reporting, management decision-making processes, and targeted training for executives. Simply delegating responsibility and forgetting about it is no longer an option.

Both regulatory frameworks require organizations to look beyond their own operations.

This includes establishing security requirements for service providers, implementing appropriate contractual obligations and evidence requirements, and regularly reviewing critical partners. IT service providers, in particular, are increasingly becoming a focus of regulatory authorities. Common Mistakes Organizations Should Avoid:

  • Underestimating whether the regulations apply to them
  • Focusing solely on IT instead of overall organizational resilience
  • Implementing security measures without proper documentation
  • Failing to involve executive management
  • Neglecting emergency response testing

These weaknesses will become apparent during audits or security incidents—often with serious consequences.

You can also read our Security Trends 2026 blog article to learn what else organizations should focus on in the field of cybersecurity.

Why Identity & Access Management Is Central to NIS2 Compliance

Identity & Access Management (IAM) is not just one component of NIS2 compliance—it is one of its fundamental requirements. Why? Because a large proportion of the NIS2 requirements revolve around access control, auditability, and risk reduction.

IAM provides:

  • Access control as a core requirement: NIS2 requires that only authorized individuals have access to systems and data. An integrated IAM solution ensures that access is role-based, traceable, and granted according to the principle of least privilege. In other words: who is allowed to access what, when, and under which conditions? Without IAM, controlled access security is impossible.
  • Protection against the most common attack vectors: A large proportion of successful cyberattacks are based on compromised accounts and excessive privileges. IAM reduces these risks through Multi-Factor Authentication (MFA), strong authentication, and regular access reviews.
  • Auditability for regulators and auditors: NIS2 requires organizations to demonstrate verifiable security measures. IAM provides access logs (who accessed what and when), permission models, and audit trails. These are essential for proving compliance.
  • Rapid response during security incidents: Every minute counts during a cyber incident. IAM enables organizations to immediately disable accounts, revoke access rights, and isolate compromised identities.
  • Control over external access: NIS2 also covers supply chains and third-party service providers. IAM governs external partner access, time-limited permissions, and secure remote access.

Conclusion: IAM is the foundation for nearly all NIS2 requirements. It combines security, compliance, and operational resilience. Without an effective IAM solution, access control, auditability, and incident response cannot be implemented effectively.

With more than 25 years of experience, we are the ideal partner for organizations seeking reliable and innovative Identity & Access Management (IAM) solutions. We are also happy to advise you on which IAM tools are best suited to your organization. Schedule your free consultation today

NIS2 Checklist: First Steps for Organizations

NIS2 compliance is not a one-time project—it is an ongoing process. Organizations that implement the following measures systematically and in a structured manner will not only achieve compliance but also become significantly more resilient against real-world cyber threats.

1. Determine Whether Your Organization Is in Scope
  • Does your organization operate in one of the affected sectors?
  • Does it meet the size criteria (medium-sized or large)?
  • Does it play a critical role within supply chains?
  • Executive management is involved and informed.
  • Responsibilities for cybersecurity are clearly defined.
  • Regular reporting to executive management is established.
  • Training for executives has been completed.
  • Critical business processes have been identified.
  • Cyber and physical risks have been assessed.
  • Dependencies (IT, service providers, energy supply, etc.) have been analyzed.
  • The risk assessment is updated regularly.
  • Access controls (IAM, MFA) have been implemented.
  • Network security and segmentation are in place.
  • Patch and vulnerability management has been established.
  • A backup and recovery strategy has been defined.
  • Physical security measures have been considered.
  • An incident response plan has been documented.
  • Reporting procedures (e.g., the 24-hour notification requirement) have been defined.
  • Escalation procedures are clearly established.
  • Emergency exercises and testing have been carried out.
  • Critical service providers have been identified.
  • Security requirements are contractually defined.
  • Evidence and audits have been planned.
  • Supply chain risks have been assessed.
  • Security measures are documented.
  • Audit trails and logging are in place.
  • Compliance evidence is available at any time.
  • Preparations for audits and inspections have been completed.
  • Security measures are reviewed regularly.
  • Lessons learned from incidents are incorporated.
  • Processes are adapted to new threats and regulatory requirements.
  • A clear roadmap for continuous improvement is in place.

When Does the NIS2 Implementation Act Become Mandatory?
The NIS2 Implementation Act entered into force on December 6, 2025, and became effective immediately without any transitional period. The registration deadline with the German Federal Office for Information Security (BSI) expired on March 6, 2026. Approximately 29,000 organizations, including many medium-sized companies, are affected by the legislation, which also introduces personal liability for executive management. The determining factor is an organization’s relevance to security—including its role within supply chains.

How OEDIV SecuSys Supports You with Implementation

As a vendor-independent cybersecurity and Identity & Access Management (IAM) specialist, OEDIV SecuSys provides practical, pragmatic support. We see ourselves as a long-term partner, working alongside our customers as equals. Our focus is on consulting, implementation, and the long-term operation of Identity & Access Management solutions within complex IT environments.

Schedule a strategy consultation with us today and register for our webinar on NIS2-Compliant Supply Chain Monitoring on June 10, 2026. Discover practical use cases and concrete solutions for strengthening your supply chain security.

Critical Infrastructure Protection Act and NIS2: Act Now!

The implementation of these regulations into German law makes one thing clear: resilience and cybersecurity are no longer future challenges—they are now critical management responsibilities. Organizations that systematically assess their risks, implement practical security measures, and establish clear accountability will not only achieve regulatory compliance but also strengthen their long-term resilience and operational stability.

Together with our strong network of partners, we support organizations of all sizes and structures in implementing the requirements of the Critical Infrastructure Protection Act and the NIS2 Implementation Act in a practical, auditable, and future-proof manner—from the initial assessment to a comprehensive security strategy and the successful implementation of security measures.

Schedule your strategy consultation with us today!

FAQ

FAQ to the NIS2 Implementation Act

Here you will find answers to the most important questions about our services and solutions.

What Is the NIS2 Implementation Act?

The NIS2 Implementation Act transposes the European NIS2 Directive into German law. It requires more organizations to implement cybersecurity measures, establish risk management processes, and report security incidents. New requirements include stricter regulatory oversight, clear governance obligations, and personal liability for executive management in the event of non-compliance.

The NIS2 Implementation Act applies to medium-sized and large organizations operating in critical and security-relevant sectors, such as energy, IT, healthcare, transport, industry, and digital services. IT service providers, cloud providers, and organizations with a critical role in supply chains are also affected—often indirectly through customer requirements.

Organizations must establish a risk management framework, implement technical and organizational security measures, control access (e.g., through Identity & Access Management), report security incidents within the required timeframes, secure their supply chains, and document all security measures. Executive management can be held personally liable in the event of non-compliance. Organizations are also required to review and continuously improve their security measures on a regular basis.

Organizations have been required to comply with the NIS2 Implementation Act since it entered into force in December 2025. There is no transitional period—the requirements apply immediately. Regulatory authorities therefore already expect organizations to have implemented effective risk management, security concepts, and incident reporting processes. Organizations that are not yet compliant are effectively considered to be in default.

Identity & Access Management (IAM) is central to NIS2 compliance because it enables secure access control, auditability, and risk reduction. IAM ensures that only authorized users can access systems and data according to the principle of least privilege, supports Multi-Factor Authentication (MFA), provides comprehensive audit trails, and enables the immediate suspension of accounts in the event of a security incident. Without IAM, meeting the core requirements of NIS2 is extremely difficult.

Newsletter

Stay Informed

Subscribe to our newsletter to receive regular insights into Identity & Access Management.

    By submitting this form, I consent to the processing of the data I have provided for the purpose of handling my enquiry.
    I may withdraw this consent at any time with future effect. Further information: Privacy Policy.
    Read More

    Related Articles

    Ready for an Initial Consultation?

    Let's assess together how resilient and future-ready your Identity & Access Management strategy really is.

    vertrieb­@secusys.de

    Request a Strategy Meeting