What is the difference between an "important" and an "essential" entity?

Both categories carry the same obligations (registration, risk management, incident reporting). The difference is supervision: essential entities face proactive oversight, important entities are typically checked only after an incident or a tip.

Do I need to register with the BSI if my business is small?

Only if you operate in one of the NIS2 sectors AND cross the size threshold, generally 50 employees or 10 million euros in annual revenue and balance sheet total. Micro-businesses below that threshold are usually not directly obligated to register.

What happens if I ignore NIS2 while being affected?

The BSI can impose fines, and for essential entities, management is personally liable for implementing the requirements. A missed registration usually surfaces during an audit or a security incident, at which point the full consequences apply.

By when must I register if I am affected?

No later than three months after your business first meets the criteria of an important or essential entity, through the BSI's registration portal using an ELSTER organisation certificate.

Does NIS2 apply to your business?

Q: I am not directly affected, why should I still care?

NIS2-regulated companies are legally required to assess the security of their supply chain. If you supply a larger, regulated organisation, security questionnaires and evidence requests will become part of normal procurement in the coming months.

On 6 December 2025, Germany's NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) entered into force. Since 6 January 2026, affected businesses can register with the Federal Office for Information Security (BSI) through a new portal. According to the BSI, the law newly affects around 29,500 "important" and "essential" entities in Germany, many of them small and mid-sized businesses that have never dealt with an IT security authority before.

That creates real uncertainty. The sector list is long, the wording is legal, and the European Commission already proposed in January 2026 to narrow the scope again. This article is not legal advice, but two questions give you a solid first read.

Question 1: Does your business operate in an NIS2 sector?

NIS2 does not apply across the board. It applies only to businesses in a defined list of sectors (Annexes 1 and 2 of the German BSI Act). The main examples:

Highly critical: energy, transport, banking, financial market infrastructure, healthcare, drinking water, wastewater, digital infrastructure (data centres, cloud providers, DNS services, TLD registries), ICT service management, public administration and space.
Other critical sectors: postal and courier services, waste management, chemicals manufacturing and distribution, food production and distribution, manufacturing (including medical devices, electronics, machinery and vehicles), digital services (online marketplaces, search engines, social networks) and research.

If your business is not in one of these sectors, you are generally not directly obligated under NIS2 today, regardless of size. If it is, the second question decides.

Question 2: Does your business cross the size threshold?

Within an affected sector, size is the deciding factor:

Important entity: 50 or more employees, or 10 million euros or more in annual revenue and balance sheet total.
Essential entity: 250 or more employees, or more than 50 million euros in annual revenue, or more than 43 million euros balance sheet total. Certain roles always count as essential regardless of size: operators of critical infrastructure, qualified trust service providers, TLD name registries, DNS service providers, and providers of public telecommunications networks or services with 50 or more employees.

If your business is under these thresholds, you are generally exempt from direct registration today, even if your sector is affected. For a binding assessment, the BSI provides an official decision tree (German only).

What do affected businesses actually have to do?

Register. No later than three months after first becoming affected, through the BSI portal, using an ELSTER organisation certificate and a business account.
Implement risk management measures. This includes a documented risk analysis, an incident handling process, business continuity planning, baseline controls such as multi-factor authentication and encryption, and an assessment of your own supply chain security.
Report incidents. Significant security incidents require an initial report within 24 hours, with a full report following within one month.
Take liability seriously. For essential entities, management is personally liable for implementing the risk management obligations.

And if I am not directly affected?

Two reasons this still matters. First: NIS2-regulated businesses are legally required to assess the security of their own supply chain. If you supply a larger, regulated organisation, security questionnaires and evidence requests will become part of normal procurement in the coming months, even without a registration duty of your own. Second: the European Commission proposed changes on 20 January 2026 that would adjust the scope further. The rules are still moving, a re-check in a few months is worth it.

Regardless of legal status, the underlying reality has not changed: according to the Hiscox Cyber Readiness Report 2026, 31% of German SMEs have already been successfully attacked or detected an attack attempt, 33% saw their survival significantly threatened, the average outage lasted 41.7 hours, and 29% had no insurance cover at all. NIS2 or not, the attack surface is real.

The pragmatic first step

Whether you are obligated to register or not, a current view of your own external attack surface is the most useful starting point. Noroshi automatically monitors the areas that matter both for an NIS2 risk assessment and for a real attack: HTTP security headers, TLS certificates, e-mail authentication (SPF, DKIM, DMARC), open ports, outdated software and lookalike domains that could be used to phish your brand.

Create a free account, add your domain and see your current security score within minutes. Free plan, no credit card required.

← Back to blog

Written by David Hildering, the engineer behind Noroshi. More about Noroshi.