Insights
NIS2 Registration with the BSI Is Mandatory. Many German Entities Have Not Done It.
Germany’s NIS2 implementation is now in force, and one obligation that may still catch companies off guard is registration with the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI).
Under the German NIS2 framework, in-scope entities include organisations in energy, transport, financial market infrastructure, healthcare, digital infrastructure, and several other sectors. Each German legal entity that falls within scope must assess and fulfil its own registration obligation, including entities within international groups.
Registration is separate from the broader cybersecurity risk management requirements introduced by NIS2. In-scope entities must also implement appropriate technical and organisational measures, report significant incidents within specified timeframes, and ensure that management approves and oversees cybersecurity risk management.
For international companies with German subsidiaries in scope, the challenge is a familiar one: a group-wide programme does not remove the obligations of each qualifying German entity. Its registration details, risk management documentation and incident reporting arrangements must address the local legal entity.
Managing directors of in-scope German entities are not insulated from this. The German framework places responsibility on management to implement and oversee the required cybersecurity risk management measures.
At Greenfields, our Compliance as a Service offering supports German entities in meeting regulatory obligations of this kind, including registration coordination and ongoing compliance administration. We help our clients navigate regulatory requirements that are subject to increasing scrutiny and enforcement.
