NIS-2 Checklist for SMEs: Managing Your Obligations

The BSI estimates that around 18,500 companies missed the March 6, 2026, NIS-2 registration deadline—more than half of all affected organizations. The NIS-2 Implementation Act has been in effect since December 2025, and regulators have announced they will be actively conducting audits.

There is a great deal of uncertainty, especially among small and medium-sized enterprises: Are we even affected? What do we need to prove, and by when? Where do we even start? This article provides concise answers to these three questions and includes our free NIS-2 checklist—a three-page working document to help you systematically address your status, obligations, and the ten minimum security measures required under § 30 BSIG.

NIS-2 is here – even if many have yet to respond

With the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG), Germany transposed the EU directive into national law in December 2025 – with no transition periods. Since then, registration, verification, and reporting obligations have applied to approximately 29,500 entities across 18 sectors, ranging from energy, transport, and healthcare to manufacturing and IT services.

The BSI launched its registration portal in January 2026, with the deadline ending on March 6, 2026. If you haven't registered yet, you are still obligated – in fact, the authority is actively identifying which companies are missing. Late registration is possible and significantly better than waiting.

Affected or not? The thresholds

NIS-2 does not just apply to large corporations and critical infrastructure operators. It is enough for your company to operate in one of the 18 regulated sectors and meet one of the two size thresholds:

- Important entity: 50 or more employees, or an annual turnover and balance sheet total of more than €10 million – fines of up to €7 million or 1.4% of total global annual turnover
- Essential entity: 250 or more employees, or an annual turnover of more than €50 million and a balance sheet total of more than €43 million – fines of up to €10 million or 2%

When in doubt, the BSI's free impact assessment tool provides clarity in just a few minutes. Document the result – even if it is negative.

These obligations apply now

You should address these three areas of obligation immediately:

1. Registration: Register your entity in the BSI portal, designate a point of contact, and ensure availability.
‍
2. Governance: Management must approve risk management measures, oversee their implementation, and undergo verifiable training. Failure to do so may result in personal liability (Section 38 BSIG).
‍
3. Reporting obligations: Significant security incidents must be reported in three stages: an early warning within 24 hours, a follow-up report within 72 hours, and a final report after one month (Section 32 BSIG). This only works with established processes in place.

The ten minimum measures under Section 30 BSIG

At the heart of the law is a catalog of ten risk management measures that every affected organization must implement:

1. Risk analysis and security concepts
2. Handling of security incidents
3. Backups, disaster recovery, and crisis management
4. Supply chain security
5. Security in procurement, development, and maintenance (including vulnerability management)
6. Assessment of the effectiveness of measures
7. Cyber hygiene and training
8. Cryptography and encryption
9. Personnel security, access control, and asset management
10. Multi-factor authentication and secure communication

The good news: If you are already working according to ISO 27001 or operating an ISMS, you already cover much of this. For everyone else, the rule is: prioritize, don't paralyze.

Where you can achieve the fastest impact

It is striking how many of the ten measures focus on the same topic: privileged access. Access control (9), MFA (10), securing service providers in the supply chain (4), and comprehensive documentation for compliance and reporting obligations can all be addressed in one step with a Privileged Access Management solution.

With VISULOX, external and internal privileged access is routed through a central gateway – featuring MFA, just-in-time approvals, and audit-proof session recording, implemented agentlessly in under two days. Our PAM Beginner's Guide shows you how it works in detail.

The checklist: three pages, three steps

To ensure you don't have to start from scratch, we have summarized the most important to-dos in a compact PDF checklist:

Step 1 – Assess impact:** sector, thresholds, BSI impact assessment, classification
‍
Step 2 – Registration & Governance:** BSI portal, point of contact, management responsibilities
‍
Step 3 – Implement measures:** all ten § 30 measures to check off, plus an emergency reporting chain

Print, check off, identify gaps – and move forward with clear implementation priorities.

NIS-2 is no longer a future concern; it is current law with an expired registration deadline. SMEs should take three steps now: clearly determine if they are affected, complete their registration, and systematically implement the ten minimum measures—starting with privileged access as the most effective quick win. Our free checklist guides you through all three steps. Download it now to get an honest overview of your NIS-2 status in just 15 minutes.

‍

‍