Purpose
The NIS2 Implementation Act (NIS2UmsuCG) entered into force on 06.12.2025 and restructured the BSIG. The risk management obligations are now located in § 30 BSIG (new version) — no longer in the old §§ 8a/8b BSIG. § 30 BSIG implements Art. 21 NIS2 Directive and requires an all-hazards approach with ten minimum measures. This Skill provides the gap analysis against this catalog and anchors proportionality.
Inputs
- Classification of the entity (particularly important / important — § 28 BSIG)
- Sector and size class (risk and proportionality benchmark)
- Existing ISMS (e.g. ISO 27001, BSI IT-Grundschutz)
- Inventory of critical systems and supply chains / service providers
- Existing emergency, backup and crisis concepts
- Status of management involvement (§ 38 BSIG)
Sub-agent architecture
Three conceptual roles. A catalog agent checks each of the ten minimum measures of § 30 BSIG / Art. 21 NIS2 Directive individually against the current state and flags gaps. A proportionality agent calibrates the scope and depth of each measure to the size, risk exposure and sector of the entity. A governance agent links the measures with the management's approval and monitoring duty (§ 38 BSIG) and the reporting duty (§ 32 BSIG). The roles produce a prioritized measures roadmap; approval is given by management.
Procedure
1. Applicability and all-hazards approach (§ 30 BSIG)
- Obligated addressees: particularly important and important entities (§ 28 BSIG).
- The benchmark is the all-hazards approach: protection against all hazards to network and information systems, including the physical environment.
- Measures must correspond to the state of the art.
2. The ten minimum measures (Art. 21 NIS2 Directive / § 30 BSIG)
| # | Measure |
|---|---|
| 1 | Risk analysis and security concepts for information systems |
| 2 | Handling of security incidents (incident handling) |
| 3 | Business continuity, backup management, crisis management |
| 4 | Security of the supply chain (incl. service providers) |
| 5 | Security in the acquisition, development and maintenance of systems |
| 6 | Assessment of the effectiveness of risk measures |
| 7 | Cyber hygiene and training |
| 8 | Cryptography and encryption |
| 9 | Personnel security, access control, asset management |
| 10 | Multi-factor authentication, secured communication/emergency communication |
3. Proportionality (Section 30(1) BSIG)
- Scope depends on risk exposure, the size of the entity, and the likelihood and severity of incidents.
- Proportionality justifies gradation, but not the omission of any of the ten categories of measures.
4. Supply chain dimension
- The supply chain is a separate mandatory category: the security quality of direct suppliers and service providers must be assessed and secured contractually.
5. Interlinking governance and reporting
- Measures under Section 30 BSIG must be approved and monitored by the management board (Section 38 BSIG).
- Failures may be subject to fines under Section 65 BSIG.
Risks / typical mistakes
- All-hazards approach narrowed to IT alone — physical security, personnel and the supply chain are part of it.
- Proportionality misunderstood as a free pass — it scales the depth, but does not permit the omission of any of the ten measures.
- Supply chain disregarded — incidents at service providers are a separate mandatory category (Measure 4).
- Management board not involved — Section 38 BSIG requires active approval and monitoring of the measures under Section 30.
Sources
Statutes
- Section 30 BSIG (new version) — risk management measures
- Section 38 BSIG (new version) — duties of the management board
- Section 65 BSIG (new version) — fine provisions
- Directive (EU) 2022/2555 (NIS2) — Art. 20 NIS2 Directive, Art. 21 NIS2 Directive
Secondary literature
- Eckhardt, NIS2, 1st ed. 2024
- Voigt/Schmitz, Cybersicherheitsrecht, 2nd ed. 2024
Output format
NIS2-RISIKOMANAGEMENT — <Einrichtung> — <Datum>
I. Einordnung (§ 28 BSIG) [besonders wichtig / wichtig]
II. All-Hazards-Reife (§ 30 BSIG / Art. 21 NIS2-RL)
1 Risikoanalyse [🟢/🟡/🔴]
2 Incident Handling [🟢/🟡/🔴]
3 Business Continuity [🟢/🟡/🔴]
4 Lieferkette [🟢/🟡/🔴]
… bis Maßnahme 10
III. Verhältnismäßigkeit [Maßstab: Größe/Risiko]
IV. Verzahnung Geschäftsleitung (§ 38 BSIG) [Billigung erfolgt? Ja/Nein]
V. Bußgeldrisiko (§ 65 BSIG) [Hinweis]
Roadmap:
Sofort: <…> Mittelfristig: <…>