Tool 05 · NIS2
Are you in scope?
What this is. A pre-check under the German BSI Act (BSIG), which has implemented the NIS2 Directive in Germany since 06.12.2025. Ten inputs — establishment, sector, activity, size, special cases — giving the classification as a particularly important or important entity (§ 28 BSIG) and the obligations attached. Pure calculation, no language model. Assigning an activity to a type of entity is often more contested in the individual case than a drop-down list suggests.
The company has an establishment in Germany.For cloud, data centres, platforms, DNS and similar digital services, the main establishment in the EU counts instead.
This activity is more than a marginal part of the company’s business.§ 28(3) BSIG: business activities that are negligible relative to the whole are disregarded in the assignment.
We operate a critical facility — such as a power plant, grid, hospital or waterworks above the thresholds of the critical infrastructure ordinance.Operators of critical facilities are particularly important entities regardless of size (§ 28(1) no. 1 BSIG).
We are a financial entity within the meaning of DORA, Regulation (EU) 2022/2554.For these entities, the DORA rules on risk management and reporting largely take precedence over the BSIG.
The company belongs to a group or has partner enterprises.Their figures then count under SME Recommendation 2003/361/EC — unless your IT is independent of the group.
Where you stand — optional, does not change the classification
We are registered with the BSI.§ 33 BSIG. Registration is a duty of its own — not merely a consequence of the classification.
A reporting channel for security incidents is in place and tested.§ 32 BSIG — 24 hours, 72 hours, one month. A channel you only look for during the incident is none.
Management is trained and formally approves the risk measures.§ 38 BSIG — approval, oversight and training are duties of management personally, not of IT.
Needed next: The company has an establishment in Germany.
Belongs to: Regulation & Compliance