NIS2 in Germany: implementing the obligations and proving them with Microsoft 365
Key takeaways
- The German NIS2 implementation act has been in force since 6 December 2025. Organisations in scope must register with the BSI, implement and document risk management measures, and report significant security incidents.
- Organisations in the covered sectors are in scope from 50 employees, or with annual turnover and annual balance sheet total each above €10 million.
- Most measures from Section 30 of the BSI Act (BSIG) can be implemented and evidenced in a Microsoft environment, for example with Conditional Access, Defender XDR, Sentinel, Intune and Microsoft 365 Backup.
- Management must implement the measures, oversee their implementation and attend regular training (Section 38 BSIG).
With NIS2, the EU has significantly widened the group of organisations that must meet binding cybersecurity obligations. In Germany, these obligations have been law since December 2025. The task now is to implement the required measures in a way that can be demonstrated. If your organisation runs on Microsoft 365 and Azure, many of the necessary tools are already in your tenant; what matters is correct configuration and evidence.
Does NIS2 already apply in Germany?
Yes. The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was passed by the Bundestag on 13 November 2025, approved by the Bundesrat on 21 November 2025, promulgated in the Federal Law Gazette on 5 December 2025 (BGBl. 2025 I No. 301) and entered into force on 6 December 2025. The obligations are set out in the revised BSI Act (BSIG). The three core obligations are registration, incident reporting and documented risk management.
Registration takes place in the BSI portal, with access via the German “Mein Unternehmenskonto” business account. The deadline is three months after an organisation first meets the criteria (Section 33 BSIG). For organisations already in scope at entry into force, that deadline passed in early March 2026; if registration is still outstanding, do it now.
Is my organisation in scope of NIS2?
Two questions are decisive. Does your organisation operate in one of the sectors listed in Annexes 1 and 2 of the BSIG, such as energy, transport, health, digital infrastructure, ICT service management or manufacturing? And does it exceed the size thresholds in Section 28 BSIG?
- Important entity: at least 50 employees, or annual turnover and annual balance sheet total each above €10 million.
- Particularly important entity (the German equivalent of an “essential entity”): at least 250 employees, or annual turnover above €50 million and annual balance sheet total above €43 million.
Some types of entity, such as operators of critical facilities, are treated as particularly important regardless of these thresholds. The BSI provides a scope check and detailed questions and answers on NIS2 (in German). The binding classification should be confirmed legally.
Which measures does Section 30 BSIG require, and how do you implement them with Microsoft?
Section 30 BSIG requires “appropriate, proportionate and effective” technical and organisational measures and names ten areas. For management, this means measures must be documented and their effectiveness verifiable. For IT, every measure needs a concrete configuration and evidence that can be produced at any time.
| NIS2 measure (Section 30(2) BSIG) | Microsoft implementation | Evidence |
|---|---|---|
| Risk analysis and effectiveness assessment (no. 1, 6) | Microsoft Secure Score, Microsoft Purview Compliance Manager | Assessed risks, list of actions with owners, history of the assessment |
| Access control and MFA (no. 9, 10) | Microsoft Entra Conditional Access with the “Phishing-resistant MFA” authentication strength, Privileged Identity Management (PIM) | Policy export, authentication methods report, PIM activation log |
| Incident handling (no. 2) | Microsoft Defender XDR, Microsoft Sentinel, unified audit log in Microsoft Purview | Incident history with timestamps, active analytics rules, log retention |
| Business continuity (no. 3) | Microsoft 365 Backup, Azure Backup with an immutable vault | Backup policies, logged restore tests |
| Supply chain security (no. 4) | Microsoft Entra External ID for guest access with access reviews, consent settings and the admin consent workflow for apps | Guest list with review results, approved app permissions |
| Security in acquisition and maintenance (no. 5) | Microsoft Intune with update rings, Microsoft Defender Vulnerability Management | Patch status per device, open vulnerabilities with age |
| Training and awareness (no. 7) | Attack simulation training in Microsoft Defender for Office 365 | Training completion, simulation results |
Three notes for implementation. First, enforce phishing-resistant MFA, meaning passkeys, FIDO2 keys or Windows Hello for Business, through an authentication strength in Conditional Access. Second, the unified audit log keeps events for 180 days in Audit (Standard); longer retention requires Audit (Premium) or an export to Sentinel. Third, not every feature is included in every licence. Attack simulation training requires Defender for Office 365 Plan 2 or Microsoft 365 E5, and PIM requires Entra ID P2 or Entra ID Governance.
Which reporting deadlines apply to a significant security incident?
Section 32 BSIG sets out a staged procedure:
- Initial report without undue delay, no later than 24 hours after becoming aware.
- Incident notification with an assessment of severity, impact and indicators of compromise, no later than 72 hours after becoming aware.
- Intermediate report on request by the BSI.
- Final report no later than one month after the notification.
For management, the key question is who decides whether an incident is “significant” and who approves the report, including at weekends. For IT, the time of awareness must be evidenced. Defender XDR and Sentinel record incidents with timestamps, ownership and handling history, which form the basis for a timely, sound report.
What does Section 38 BSIG mean for management?
Section 38 BSIG obliges management to implement the risk management measures and to oversee their implementation. Management must also attend training regularly in order to recognise and assess risks. In the event of a culpable breach of duty, management is liable to the entity under the corporate law rules of its legal form. The task can be delegated; the responsibility cannot.
Section 65 BSIG also provides for fines of up to €10 million or 2 percent of worldwide total turnover for particularly important entities, and up to €7 million or 1.4 percent for important entities, whichever is higher in each case. In practice, the more relevant question is whether management can demonstrate that it fulfilled its duties. That is what the evidence in the table above is for.
How do you approach this pragmatically?
Four steps have proven themselves:
- Clarify scope and register. Check sector and thresholds, document the result, register in the BSI portal.
- Establish the current state. Check Section 30 BSIG against the actual configuration of Entra ID, Microsoft 365, Intune and Azure.
- Prioritise by risk. Identities and privileged access first, then detection and reporting, then recovery and supply chain.
- Maintain evidence continuously. Generate and file reports from Secure Score, Compliance Manager, Sentinel and Intune regularly.
Our Gap Assessment reviews your Microsoft environment at a fixed price against the requirements of Section 30 BSIG and delivers a prioritised list of actions, each with its source of evidence. If you would like to hand over detection, response and reporting permanently, our Managed Security service operates Defender and Sentinel with audit-ready reporting.
Frequently Asked Questions
Since when has NIS2 applied in Germany?
The German NIS2 implementation act entered into force on 6 December 2025, after promulgation in the Federal Law Gazette on 5 December 2025. The obligations have applied since then. Registration with the BSI is due within three months of the date on which an organisation first meets the criteria.
Is using Microsoft 365 enough to comply with NIS2?
No. Microsoft provides tools that cover many measures technically, but they only take effect once they are configured, operated and documented. Risk analysis, the reporting process, contingency planning and management training are organisational tasks that no product takes over.
Do we have to report every security incident to the BSI?
No, only significant security incidents, meaning those that cause or can cause severe operational disruption or financial loss, or that considerably affect others. The initial report must be made no later than 24 hours after becoming aware. Decide in advance who classifies incidents and who approves the report.
What applies to suppliers and IT service providers?
They are only in scope themselves if they operate in a covered sector and exceed the thresholds. Regulated customers must, however, secure their supply chain and often pass requirements on contractually, for example on MFA, logging or reporting paths.