NIS2 & Executive Liability: Cybersecurity is now personal

With the German implementation of NIS2, cybersecurity has definitively moved from the IT department to the C-suite. Approximately 30,000 companies in Germany, these fall under the new obligations. Significantly more than ever before, including many who previously did not consider themselves as "critical infrastructure": mechanical engineers, food producers, IT service providers, and logistics companies.

What's new: personal responsibility of the management

The core of the reform lies in § 38 BSIG: The executive management must personally [determine/oversee] the cybersecurity measures of their company approve and monitor their implementationShe can be held personally liable for violations. Any waiver by the company of these claims for damages is ineffective. Implementation can be delegated, but responsibility cannot. Additionally, training is mandatory for the executive management itself.

Am I affected?

• Essential entities: including energy, healthcare, transport, digital infrastructure: from 250 employees or €50 million turnover (partially regardless of size).
• Important entities: including manufacturing, food, chemicals, digital services, and Managed Service Providers: applicable from 50 employees or €10 million in turnover.
• Indirectly affected: Suppliers and service providers of the aforementioned, regarding the supply chain requirements of their customers.

Overview of obligations

• Registration with the BSI and the designation of a contact point.
• Risk management: State of the art, ranging from access control and encryption to backup concepts and supply chain security.
• Reporting obligations in case of emergency: Initial report within 24 hoursfollow-up report within 72 hours, final report after one month.
• Fines: up to €10 million or 2% of global turnover (essential entities) or €7 million or 1.4% (important entities).

Start pragmatically instead of producing paper

NIS2 compliance is not a folder in a cabinet, but lived IT operations: patched systems, monitored networks, tested backups, trained employees, and defined processes for emergency situations. This is exactly the core of Managed IT Services. Those who have set up their operations professionally fulfill the technical requirements largely as a byproduct. The sensible starting point: a Impact analysis, then a gap analysis of existing measures against the requirements, followed by a prioritized action plan.

Note: This article is not a substitute for legal advice. It serves as an initial orientation; the binding examination of your situation should be handled by experts.

← all guides