In brief: Nearly 30,000 German SMEs must align their cybersecurity with NIS2 standards by October 2024, which represents a significant resource and organizational challenge for many.
Following the transposition of the NIS2 Directive into German law, approximately 29,500 small and medium-sized enterprises will newly fall within the scope of regulation. For CISOs, this means a significant expansion of their area of responsibility and new compliance requirements.
The European Union’s NIS2 Directive substantially broadens the circle of regulated companies. While the previous NIS1 Directive focused primarily on operators of essential services and digital service providers, NIS2 will now also capture companies above a certain size in critical sectors such as energy, transport, water, health, and digitalization.
The Federal Republic has transposed the Directive into national law, with the result that a total of 29,500 SMEs are newly obligated to take compliance measures. These companies must adapt their cybersecurity infrastructure to the standards of the NIS2 Directive – including requirements for incident reporting, cybersecurity governance, risk management systems, and security culture.
For Chief Information Security Officers, this represents an organizational and financial challenge. The new requirements demand not only technical measures, but also documented processes, employee training, and enhanced cooperation with management and authorities. Many SME CISOs report limited resources and must accordingly prioritize.
The transition period ends on 19 October 2024, after which the compliance requirements become fully applicable. National authorities such as the BSI and the Bundesnetzagentur monitor compliance and can impose sanctions in case of violations.
Source: news.google.com · Published 29 July 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.