Key Takeaways
TL;DR — Germany’s NIS2UmsuCG has applied since 6 December 2025. A supplier’s German entity that manufactures vehicles, parts or other transport equipment (NACE C29 or C30, Anlage 2 BSIG) and has at least 50 employees, or turnover and balance-sheet total each above EUR 10 million, is an important entity under BSI supervision. Compliance comes down to twelve evidence-backed steps: confirm scope, assign management accountability, register with the BSI, implement and document the ten §30 measures, build the 24-hour, 72-hour and one-month §32 reporting clock into incident response, train management, and keep proof. An ISO/IEC 27001 ISMS or an ISO/SAE 21434 CSMS covers part of this — neither registers you, reports for you, nor covers plants left outside its scope.
- 1.The NIS2UmsuCG has applied since 6 December 2025; vehicle and parts manufacturing (NACE C29) and other transport equipment (C30) sit in Anlage 2 BSIG, so in-scope suppliers are important entities supervised by the BSI.
- 2.The size test is at least 50 employees, or annual turnover and balance-sheet total each above EUR 10 million — run it for each German legal entity separately.
- 3.Registration runs through Mein Unternehmenskonto and the BSI portal; the day-one deadline of 6 March 2026 has passed, but the duty continues.
- 4.§30 lists ten minimum risk-management measures and requires their documentation; §32 sets a 24-hour, 72-hour and one-month reporting clock.
- 5.Management must implement and oversee the measures and train regularly under §38 — accountability cannot be parked with IT.
- 6.An ISO/IEC 27001 ISMS maps onto much of §30 and a CSMS contributes incident, vulnerability and supplier processes; NIS2 still covers the enterprise, not the vehicle.
At a Glance
- One-Sentence Answer
- German automotive suppliers in scope of the NIS2UmsuCG can work through twelve steps — scope, accountability, BSI registration, the ten §30 measures, §32 reporting, training and documentation — reusing an ISO/IEC 27001 ISMS or ISO/SAE 21434 CSMS where they overlap.
- Who This Is For
- Product-security, compliance, ISMS and supplier-quality leads at German and EU Tier-1 and Tier-2 suppliers with German legal entities.
- Last Reviewed
- October 2026
- Primary References
- BSIG as amended by the NIS2UmsuCG (§§2, 28, 30, 32, 33, 38, 62, 65 and Anlage 2); BSI NIS-2 checklist and FAQ; Directive (EU) 2022/2555; ISO/IEC 27001:2022; ISO/SAE 21434.
- Practical Use
- Use it as a project plan and evidence index — one owner and one evidence folder per step.
Editorial Process: Written and reviewed by Agnile engineers working day-to-day in automotive cybersecurity and safety. AI tooling is used to assist with drafting, outlining, and copy-editing; every claim, standards reference, and technical statement is verified by a human engineer before publication.
Our background guide to NIS2 for automotive suppliers explains why a German Tier-1 or Tier-2 is now a regulated entity under the recast BSI-Gesetz (BSIG), how the registration deadline played out, and how NIS2 differs from UNECE R155 and TISAX. This post is the working list that follows from it: twelve steps, each with what to do, the paragraph of the BSIG it answers to, and the evidence to keep on file. It is process guidance for the people who have to turn the law into a plan — not legal advice. Confirm your entity’s position with counsel.
One distinction runs through every step. NIS2 regulates the enterprise — the IT, production and engineering systems the legal entity uses to provide its services — not the vehicle or the ECU you ship. That is why an ISO/SAE 21434 cybersecurity management system helps but does not finish the job, and why the reuse table below matters as much as the checklist.
The 12-Step Checklist
Paragraph references are to the BSIG as amended by the NIS2UmsuCG, which implements Directive (EU) 2022/2555. The order matters: steps 1 to 3 are cheap and have hard legal edges; steps 4 to 12 are the substance and take months.
1. Confirm scope, entity by entity
Assess each German legal entity separately. Take the NACE Rev. 2 code of its main activity, then apply the size test: at least 50 employees, or an annual turnover andan annual balance-sheet total each above EUR 10 million. Anlage 2 lists vehicle and parts manufacturing (C29) and other transport equipment (C30), but also electronics (C26), electrical equipment (C27) and machinery (C28) — an ECU or sensor maker classified under one of those is still in scope. §28 also contains rules on negligible activities and on when data of partner or linked enterprises can be left out; that is where counsel earns its fee. The BSI’s online scope check gives a first view that it describes as not legally binding.
- Legal hook
- §28 Abs. 2 to 4 BSIG; Anlage 2 Nr. 5.2 to 5.6.
- Evidence to keep
- A signed scope memo per entity: NACE code, headcount and financial figures, the reasoning on negligible activities and group data, and a review date.
2. Name accountable management and a coordinating role
Management must implement the §30 measures and oversee their implementation; the topic cannot simply be handed to IT. Minute a decision that adopts the programme, names an owner and sets how often status comes back to management. The BSI’s own checklist recommends designating and enabling at least two people to coordinate information security. Where a product CSMS exists, its cybersecurity manager is a natural co-owner, but the enterprise ISMS lead usually holds the pen.
- Legal hook
- §38 Abs. 1 and 2 BSIG (implement, oversee, liability under company law).
- Evidence to keep
- Management resolution, role descriptions, a responsibility chart for security, and minutes of the management reviews that follow.
3. Register with the BSI
Registration is a two-stage online process: obtain an ELSTER organisation certificate through the federal “Mein Unternehmenskonto” service (it requires a German tax number), then register in the BSI portal with entity data, sector, contact details and IP address ranges. The statutory deadline for entities in scope from day one passed on 6 March 2026; otherwise the clock runs three months from the date an entity first falls into scope. A missed deadline does not end the duty, and changes to registered data must be notified within two weeks.
4. Fix the boundary of the systems in scope
§30 covers the IT systems, components and processes the entity uses to provide its services. For a supplier that means enterprise IT, plant networks and OT, the engineering and build environment, and the infrastructure that holds product secrets — code-signing keys, key-injection stations, diagnostic tooling. An ISMS scoped to office IT with the plants left out is a common starting point; under NIS2 that boundary has to be justified, not assumed.
- Legal hook
- §30 Abs. 1 Satz 1 BSIG; asset management under §30 Abs. 2 Nr. 9.
- Evidence to keep
- Asset inventory, network-zone diagram, list of critical systems with owners, and the documented scope boundary with its rationale.
5. Run the risk analysis and set the security concept
Assess the risks to those systems and set policies proportionate to them. The law names the factors that drive proportionality: risk exposure, the size of the entity, implementation cost, and the likelihood and severity of incidents, including their societal and economic impact. Write that reasoning down — it is the answer when someone asks why a control was scaled the way it was.
- Legal hook
- §30 Abs. 1 Satz 2 and Abs. 2 Nr. 1 BSIG.
- Evidence to keep
- Risk register, information-security policy, risk-treatment plan, and the written proportionality rationale.
6. Make incident handling meet the §32 clock
Significant incidents go to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK): an early warning within 24 hours of becoming aware, a notification with an initial assessment within 72 hours, interim reports on request, and a final report no later than one month after the 72-hour notification. Define “significant” internally against the statutory definition — serious operational disruption or financial loss for the entity, or considerable damage to others — and decide in advance who submits. Registered entities report through the BSI portal.
- Legal hook
- §30 Abs. 2 Nr. 2, §32 BSIG; §2 Nr. 11 (definition).
- Evidence to keep
- Incident-response plan with the §32 timeline, severity criteria, an on-call roster, a pre-filled reporting template, and records of at least one exercise.
7. Prove the business can keep running
Backups that are tested by restoring them, recovery plans for plant and engineering systems, and a crisis-management structure. For a just-in-time supplier, the question an OEM customer will ask is how long its line stops if your manufacturing-execution or EDI systems are down.
- Legal hook
- §30 Abs. 2 Nr. 3 BSIG.
- Evidence to keep
- Business-continuity plan, restore-test logs, recovery-time targets per critical system, and the crisis-team contact list.
8. Secure the supply chain — in both directions
Downstream, address security in your relationships with direct suppliers and service providers: managed IT, cloud, engineering-tool vendors, contract manufacturers, remote-maintenance providers for plant equipment. Upstream, OEM customers that are regulated entities carry the same duty, so expect their NIS2-driven requirements to arrive in purchasing terms next to the product-level evidence requests in cybersecurity interface agreements with German OEMs. Run one supplier-risk process for both.
- Legal hook
- §30 Abs. 2 Nr. 4 BSIG.
- Evidence to keep
- Supplier inventory with criticality, security clauses in contracts, assessment results (questionnaires, certificates, TISAX labels where relevant), and review dates.
9. Cover acquisition, development, maintenance and vulnerabilities
Set security requirements for buying and building systems, run patch and vulnerability management for enterprise and OT assets, and give outsiders a way to report vulnerabilities. If a product PSIRT already runs ISO/SAE 21434 Clause 8 vulnerability management, extend its intake and triage to enterprise and plant assets instead of building a second pipeline.
- Legal hook
- §30 Abs. 2 Nr. 5 BSIG (including management and disclosure of vulnerabilities).
- Evidence to keep
- Patch policy with target times, scan and triage records, a published vulnerability-reporting contact, and change records.
10. Close the access, cryptography and authentication basics
Personnel-security, access-control and asset-management concepts; a cryptography concept; multi-factor or continuous authentication; and secured voice, video and text communication, with secured emergency communication where appropriate. MFA on remote access, administrator accounts and engineering systems is the first thing to check.
- Legal hook
- §30 Abs. 2 Nr. 8, 9 and 10 BSIG.
- Evidence to keep
- Access-control policy, joiner-mover-leaver records, MFA coverage report, cryptography standard, and privileged-account inventory.
11. Train management and staff
Management must take part in training regularly so it can recognise and assess risks and risk-management practices; staff need basic training and awareness. The law does not fix an interval — set one and keep to it.
- Legal hook
- §38 Abs. 3 BSIG (management); §30 Abs. 2 Nr. 7 (staff).
- Evidence to keep
- Training plan, attendance records with dates and content, and awareness-campaign records.
12. Measure effectiveness and keep the file ready
Compliance with §30 must be documented, and the measures need a way of checking that they work: internal audits, metrics, management review. Important entities do not submit audits routinely; the BSI can step in where facts suggest that §30, §32 or the management-training duty is not being met, and can then demand evidence. Build the evidence index now, so a BSI request becomes a retrieval exercise rather than a project.
- Legal hook
- §30 Abs. 1 Satz 3 and Abs. 2 Nr. 6; §62 BSIG.
- Evidence to keep
- Internal-audit reports, a metrics dashboard, management-review minutes, and an evidence index mapping each of these twelve steps to its documents.
How Much of ISO/IEC 27001 and Your CSMS Can You Reuse?
The BSI’s answer is that a certification alone does not satisfy the BSIG, but an existing management system is a valuable foundation that has to be checked against the §30 list and supplemented. In a supplier, the reuse splits by object. ISO/IEC 27001 is an enterprise management system, so it maps onto most of §30 — provided its scope covers the plants. ISO/SAE 21434 is a product-engineering standard, so it contributes processes rather than scope.
| §30 Abs. 2 measure | ISO/IEC 27001:2022 | ISO/SAE 21434 CSMS | Typical NIS2 gap |
|---|---|---|---|
| Nr. 1 Risk analysis, security concepts | Clauses 6.1.2–6.1.3 (risk assessment and treatment) | TARA method (Clause 15) transfers; the product results do not | Scope must include plants and engineering systems |
| Nr. 2 Incident handling | A.5.24–A.5.28 | Incident response (Clause 13), event evaluation (Clause 8) | 24 h / 72 h / one-month §32 clock and BSI channel |
| Nr. 3 Business continuity, crisis management | A.5.29, A.5.30, A.8.13 | — | Plant recovery and crisis organisation |
| Nr. 4 Supply-chain security | A.5.19–A.5.22 | Supplier capability and interface agreements (Clause 7) | IT and OT service providers; NIS2 clauses from OEM customers |
| Nr. 5 Acquisition, development, maintenance, vulnerabilities | A.8.8, A.8.25–A.8.29 | Vulnerability analysis and management (Clause 8) | Enterprise and OT assets in the same pipeline |
| Nr. 6 Effectiveness assessment | Clauses 9.1–9.3 | Organisational cybersecurity audit (Clause 5) | Evidence index ready for BSI requests |
| Nr. 7 Training and awareness | Clauses 7.2–7.3, A.6.3 | Competence and awareness management (Clause 5) | Regular management training under §38 Abs. 3 |
| Nr. 8 Cryptography | A.8.24 | Product cryptography only | Enterprise cryptography concept |
| Nr. 9 Personnel, access control, asset management | A.5.9, A.5.15–A.5.18, A.6.1–A.6.5 | — | Shared plant and OT accounts |
| Nr. 10 MFA, secured communication | A.8.5 | — | MFA on OT remote access; emergency communication |
Three things neither standard does for you: registering with the BSI (§33), reporting to the BSI on the §32 clock, and placing management under the §38 duties. Those are pure NIS2 work and belong at the top of the plan. The mapping above is a starting point for a gap analysis, not a substitute for one — Annex A control numbers say where to look, not whether the control is operating in the plant.
Where NIS2 and R155 Meet Inside a Supplier
The same event can trigger both regimes. A compromised code-signing server is an incident on the enterprise’s systems — potentially reportable to the BSI under §32 — and, at the same moment, a product-security event your OEM customers expect to hear about under their interface agreements, because it touches the trust chain of vehicles already in the field. Build one incident process with two output channels: the BSI clock on one side, the contractual notification times to customers on the other. The product side of that picture — evidence OEMs request under ISO/SAE 21434 Clause 7 — is covered in our supplier evidence checklist for German OEM interface agreements.
Take-Aways
Do steps 1 to 3 this month: they are quick, they carry hard legal edges, and a late registration is still better than none. Then work the ten §30 measures from the overlap with your existing ISMS and CSMS outward, documenting as you go. If OEM customers ask for TISAX labels as well, keep that assessment’s evidence in the same index — our TISAX guide for automotive suppliers covers how the two relate.
Primary sources: BSIG on gesetze-im-internet.de; BSI NIS-2 checklist; BSI overview of NIS-2 duties; BSI NIS-2 FAQ (all in German).
This checklist is process guidance, not legal advice. Paragraph references reflect the BSIG as published on gesetze-im-internet.de at the time of review; confirm your entity’s classification and obligations with qualified counsel. Agnile Technologies works on the product side of automotive cybersecurity — TARA, CSMS processes and UNECE R155 evidence — and holds ISO 9001:2015 and ISO/IEC 27001:2022 certification.
Frequently Asked Questions
Is an automotive supplier in Germany covered by NIS2?
Usually, if it is not a small company. A German legal entity carrying out NACE Rev. 2 division C29 or C30 activities falls under Anlage 2 BSIG once it has at least 50 employees, or an annual turnover and balance-sheet total each above EUR 10 million. It is then an important entity (wichtige Einrichtung) under BSI supervision. Electronics, electrical-equipment and machinery makers (C26 to C28) are listed in Anlage 2 as well.
What are the NIS2 incident reporting deadlines in Germany?
Under §32 BSIG a significant incident needs an early warning without undue delay and at the latest within 24 hours of becoming aware, a notification with an initial assessment within 72 hours, interim reports if the BSI asks, and a final report no later than one month after the 72-hour notification. If the incident is still ongoing then, a progress report is due instead and the final report follows once it is handled.
Does ISO 27001 certification satisfy NIS2 in Germany?
Not on its own. The BSI states that a certification alone does not meet all BSIG requirements, although an existing ISMS is a valuable foundation. Check it against the ten §30 measures, widen its scope to plants and engineering systems if they were excluded, and add what the standard does not do for you: BSI registration, the §32 reporting clock and the §38 management duties.
Can our ISO/SAE 21434 CSMS be reused for NIS2?
Partly. A CSMS contributes processes — incident response, vulnerability management and supplier management under ISO/SAE 21434 Clauses 13, 8 and 7 — that can be extended to enterprise and plant assets. It does not contribute scope: NIS2 covers the systems the company uses to operate, not the vehicle or ECU it ships, so the product TARA and cybersecurity case do not transfer.
Does management have personal duties under NIS2 in Germany?
Yes. §38 BSIG requires the management of an in-scope entity to implement the §30 risk-management measures, oversee their implementation and attend training regularly. Managers who breach these duties are liable to their entity for culpably caused damage under the company-law rules of its legal form. Execution can be delegated; the accountability stays with management.
What fines apply to important entities under the BSIG?
For important entities, breaches of the §30 risk-management duty, its documentation requirement or the §32 reporting duties can be fined up to EUR 7 million — or, where the undertaking's worldwide turnover exceeds EUR 500 million, up to 1.4 percent of that turnover. Failing to register under §33 can be fined up to EUR 500,000. The BSI can also issue binding orders.
Need Help Applying This to a Real Programme?
Agnile supports engineering teams from architecture and requirements through implementation, validation, release, and evidence preparation.