NIS2 implementation plan: steps, sequence and a sample plan

Last updated: 2026-11-06

Which obligations essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen) have is covered in the overview of NIS2 requirements; what the ten areas of measures require in detail is on the page on Section 30 BSIG, with a checklist.

Do we have twelve months to implement?

No. The BSIG entered into force with the NIS2 implementation act on 6 December 2025 and has no general transition period; according to the BSI, the Federal Office for Information Security, entities in scope must in principle meet their obligations immediately. A plan does not change this. It is the tool you use to close existing gaps in an orderly way and to show management and the supervisory authority that you are doing so.

The NIS2 Directive also requires member states to ensure that an entity which finds that it does not comply with the measures takes all necessary corrective measures without undue delay (Article 21(4) of Directive (EU) 2022/2555). The BSIG does not contain this wording; professionally, it is the right yardstick. For the plan this means: whatever is quick and effective comes immediately, even if the overall project takes longer.

Which immediate measures come first?

The immediate package contains obligations with short deadlines, management responsibility and technical safeguards that work without lengthy concept work. The selection is our recommendation; the law does not prescribe an order.

Immediate measure	Why first	Provision	More
Check the classification and record it in writing	The BSI does not tell you whether you are in scope; the entity classifies itself. Everything else depends on it.	Section 28 BSIG	applicability
Check registration and catch up if it is outstanding	Deadline three months after coming into scope; for entities in scope on 6 December 2025 it has passed, and the BSI calls for immediate registration.	Section 33 BSIG	registration
Set up the reporting chain: who detects, who decides, who reports, who deputises	The early warning is due no later than 24 hours after becoming aware; the BSI expects alerting routes outside business hours as well.	Section 32 BSIG	incident reporting
Management body approves plan, roles and budget	The management body must implement the measures and oversee their implementation; without a decision, both are missing.	Section 38(1) BSIG	management body
Schedule training for the management body	Every member of the management body must be trained regularly; the BSI recommends a thorough initial training.	Section 38(3) BSIG	management training
Quick safeguards: MFA for remote access and administrator accounts, check that backups are stored separately	Both fall under Section 30(2) no. 10 and no. 3 respectively and close known attack routes before the risk analysis is finished (professional recommendation).	Section 30(2) BSIG	Section 30 BSIG

According to the BSI, an entity that suffers a significant incident before registering reports it through an online form in the reporting and information portal (Melde- und Informationsportal, MIP). The reporting chain should therefore not wait for registration.

Diagram “NIS2 implementation plan in four phases”, example. Phase 0, immediate package in weeks 1 to 4: record the classification, check registration, reporting chain, management approves the plan, quick safeguards. Phase 1, foundations, months 2 to 3: scope, inventory, risk analysis. Phase 2, core measures, months 3 to 9: incident handling, operations and backup, supply chain, access, vulnerabilities, training, cryptography. Phase 3, effectiveness and evidence, months 9 to 12: control tests, metrics, report to management. Phases overlap at the month boundaries. A band above all phases: obligations apply from 6 December 2025; the plan is an improvement plan and sets no deadline. — Tap the graphic to open it at full size.Sample sequence of a NIS2 implementation plan. Own illustration, our professional recommendation; obligations under the BSIG as amended on 22 October 2026.

In what order do the further steps follow?

Three phases follow the immediate package. The order results from dependencies: no risk analysis without an inventory, no reasoned choice of measures without a risk analysis. Section 30(1) sentence 2 measures proportionality by, among other things, risk exposure; the risk analysis provides the basis for this.

Foundations: define the scope (the entire entity), inventory of systems, services and service providers, risk analysis with treatment plan.
Core measures: the ten areas under Section 30(2), prioritised according to the treatment plan.
Effectiveness and evidence: control tests, metrics, report to the management body, update of the plan.

What depends on what?

Step	requires	because
Risk analysis	inventory of systems, processes and service providers	only known assets can be assessed
Choice and scope of measures	risk analysis with treatment plan	proportionality must be justifiable
Adjusting supplier contracts	supplier register with criticality	contracts are prioritised by the supplier’s importance
Reporting exercise	incident process with roles and reporting chain	an exercise tests a documented procedure
Restore test	backup concept and recovery objectives	the test needs a target to measure against
Effectiveness assessment	measures that have been running for a while	what is assessed is day-to-day operation
Report to the management body	status per work package with evidence	oversight under Section 38(1) relies on it

Who is responsible?

Legally, the management body is responsible (Section 38(1)). The other roles are our recommendation for companies with a small IT team:

Role	Task in the plan
Management body	approves plan and budget, signs off the status monthly or quarterly, decides on the risks that remain
Person responsible for information security	steers the plan, maintains the risk analysis and evidence register, reports to the management body; internal or as an external information security officer
Head of IT or IT service provider	technical implementation, backup, access, patches, MFA
Purchasing	supplier register, security clauses in contracts
HR	joiners and leavers, staff training
Business units, production	assess the impact of outages, contribute to emergency plans

An IT service provider can also be authorised to report to the BSI. According to the BSI, responsibility for the incident and the content of the report remains with the entity.

How do you know a work package is done?

Each package needs a verifiable completion criterion and evidence. Without both, the management body cannot oversee progress. Examples (our recommendation):

Work package	Completion criterion	Evidence
Classification	result with reasoning in writing, confirmed by the management body	classification record
Reporting chain	roles, deputies and round-the-clock availability defined, access to the reporting channel tested	reporting process, alerting list
Risk analysis	all processes in scope assessed, treatment plan approved	risk register, approval note
Backup and recovery	restore of a critical system tested, result assessed against the objective	test record
Supply chain	critical suppliers assessed, security clauses in new and renewed contracts	supplier register, contract template
Effectiveness	first control tests carried out, deviations assigned to corrective actions	audit report, metrics

Sample 12-month plan (improvement plan, no deadline)

Fictitious example, not a client. A food manufacturer with 140 employees and industrial production is classified as an important entity (Annex 2). Registration is done, otherwise little documentation exists; IT is run by two in-house employees and an external IT service company.

Important: The following plan is an improvement plan. It describes the order in which the company closes existing gaps. It sets no deadlines for the legal obligations; these have applied since 6 December 2025.

Month	Work package	Responsible	Prerequisite	Completion criterion
1	immediate package: classification record, reporting chain, MFA for remote access and administrators, backup check, plan approved	managing directors, head of IT	-	record signed, reporting chain tested, MFA report available
1-2	initial training of the managing directors	managing directors	-	attendance record per person
2-3	inventory and risk analysis	information security	approval in month 1	treatment plan approved
3-4	incident process and first reporting exercise	head of IT, information security	reporting chain	exercise record with improvements
3-6	supplier register, assessment, contract clauses	purchasing	inventory	critical suppliers assessed
4-6	emergency manual and restore test of production control	head of IT, production	risk analysis	test record
4-8	authorisation concept and review, patch and vulnerability process	head of IT, IT service company	inventory	review recorded, deadlines by severity in force
5-8	staff training and awareness	HR	-	participation rate documented
6-9	cryptography concept, rules for communication channels	head of IT	inventory	concept approved
9-11	control tests and metrics	information security	measures in operation	audit report
12	report to the managing directors, plan for the following year	information security, managing directors	audit report	decision of the managing directors

A smaller company with fewer systems progresses faster; a larger one with many sites needs longer. Duration and scope depend on the starting point, so treat the plan as a template to adapt.

Typical gaps in the implementation plan

Gap	Cause	Effect	Remedy
The plan is read as a grace period	The schedule is confused with a legal deadline.	Simple measures are left for months although the obligations apply.	Bring the immediate package forward, adopt the plan explicitly as an improvement plan.
Technology before risk analysis	Products are bought before the risks are known.	Spending without justification; gaps elsewhere remain.	Risk analysis before larger investments, immediate measures excepted.
Packages without a completion criterion	Tasks such as “improve backup” without a measurable goal.	Progress cannot be checked; oversight by the management body stays a formality.	Define a criterion and evidence for each package, report status with evidence.

This page provides general information and is not legal advice. Which obligations apply to your company and how urgent individual gaps are has to be assessed in the individual case.

Frequently asked questions

When must the NIS2 measures be in place?+

The BSIG obligations have applied since 6 December 2025 without a general transition period. There is no separate statutory date for completing individual measures. If you have gaps, close them as quickly as possible and document this in a planned way.

Does the implementation plan have to be submitted to the BSI?+

According to the BSI, companies only have to provide evidence of implementation if the BSI orders it; operators of critical facilities additionally provide evidence every three years. For essential entities, the BSI can order audits (Section 61); for important entities, it can act if facts suggest a breach (Section 62). A maintained plan with evidence helps in both cases.

Who has to approve the plan?+

The management body. It must implement the measures under Section 38(1) BSIG and oversee their implementation. A decision with roles, budget and regular reporting is an obvious way to do this.

Can we start from ISO 27001 or an existing ISMS?+

Yes. An existing ISMS can provide the inventory, the risk analysis and part of the evidence. Check its scope and the NIS2-specific obligations such as registration, reporting deadlines and management training, see NIS2 and ISO 27001.

How long does implementation take?+

That depends on the starting point, the number of systems and sites and the people available. The sample plan shows a one-year sequence for a mid-sized company; a reliable estimate for your organisation requires an assessment of where you stand.

Sources

BSI Act (BSIG), consolidated version, last amended by Article 8 of the Act of 22 October 2026 (German) (retrieved 2026-11-06)
BSIG Section 30: risk management measures (German) (retrieved 2026-11-06)
BSIG Section 32: reporting obligations (German) (retrieved 2026-11-06)
BSIG Section 38: duties of the management body (German) (retrieved 2026-11-06)
Directive (EU) 2022/2555 (NIS2 Directive), Article 21(4) (retrieved 2026-11-06)
BSI: general NIS‑2 FAQ (German) (retrieved 2026-11-06)
BSI: NIS‑2 regulated companies (overview, registration, German) (retrieved 2026-11-06)
BSI: NIS‑2 info package on reporting obligations (German) (retrieved 2026-11-06)
BSI: training for management bodies (guidance), version 1.0 (German) (retrieved 2026-11-06)

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).

Implementing NIS2 step by step: a plan that starts with immediate measures