Does NIS2 apply to you?
The check takes 30 seconds.
Three questions about your sector and size. You get an initial assessment right away, with no email and no obligation.
This assessment does not replace legal advice. The official BSI applicability check is authoritative. NIS2 obligations can also arise through the supply chain (Section 30 of the BSI Act, BSIG) if you supply affected companies.
The facts about NIS2.
The act was promulgated on December 6, 2025 and has applied directly since then. There is no grace period for the technical and organizational measures.
The NIS2UmsuCG amends the German BSI Act (BSIG). Obligations under Section 30 BSIG apply from day one.
“Important” and “essential” entities in 18 sectors are affected.
Personal liability of management. Duty to undergo training and to approve and oversee the measures.
Early warning within 24h, incident notification within 72h, final report to the BSI after one month.
The 10 mandatory measures
under §30 BSIG.
NIS2 prescribes a minimum set of risk management measures. We support you with each of them, from analysis to proof of compliance.
Risk analysis
Policies for assessing risks to your IT and OT systems.
Incident handling
Processes for detecting, responding to and reporting security incidents.
Backup & recovery
Business continuity, emergency management and crisis management.
Supply chain security
Security in relationships with service providers and suppliers.
Secure acquisition
Security in the development, procurement and maintenance of systems.
Effectiveness assessment
Procedures for assessing risk management measures (e.g. pentests).
Cyber hygiene & training
Basic practices and awareness training for all employees.
Cryptography
Policies for encryption and the use of cryptography.
Access control
Human resources security, asset management and access policies.
Multi-factor authentication
MFA and secured communications as a mandatory standard.
How SinCera Tech
protects you.
From the first status check to ongoing monitoring, in four phases that build on each other.
Phase 1: Applicability and gap analysis
We determine with legal certainty whether and how NIS2 affects you, and compare your current state against the 10 obligations.
- Scope & sector classification
- Gap assessment §30 BSIG
- Prioritized action plan
Phase 2: Building the ISMS and measures
We build the required security management system, pragmatically and aligned with ISO 27001, without unnecessary bureaucracy.
- Policies & processes
- MFA, backup, access policies
- Supply chain security
Phase 3: Proof through pentest and incident response
The effectiveness assessment requires evidence. Our penetration tests and incident response readiness provide it.
- Penetration tests & vulnerability scans
- Incident response plan & reporting channels
- Security awareness training
Phase 4: Ongoing operation with ARGUS24
NIS2 does not end with the project. ARGUS24 monitors continuously and keeps your compliance status up to date.
- 24/7 vulnerability orchestration
- AD/identity posture & deception
- Audit-proof evidence at the push of a button
Clarity in 30 minutes,
in a free initial consultation.
In the NIS2 consultation, we clarify whether NIS2 applies to you, your liability risk and the three most important next steps. No obligation, with a concrete roadmap.
↻ Response within 24h · GDPR-compliant · Made & hosted in NRW