Resources
Glossary
NIS2

What does the 
NIS2 Directive regulate?

The NIS2 Directive (Network and Information Security Directive 2) sets binding minimum standards for technical and organizational security measures. Its key points include:

  • comprehensive risk management
  • clear reporting obligations for security incidents
  • active risk oversight by company management

The focus is on protecting critical processes, which can be threatened both by attacks on OT components and by vulnerabilities in traditional IT systems.

Who is affected 
by NIS2?

NIS2 significantly expands existing cybersecurity requirements. In addition to traditional operators of critical infrastructure, the following sectors are now covered as well:

  • Chemical industry,
  • Food supply chains,
  • Automotive industry,
  • other manufacturing sectors.

Small and medium-sized enterprises with at least 50 employees or €10 million in revenue may also fall under the directive. In Germany alone, an estimated 29,500 companies are affected.

What exactly 
does NIS2 require?

It mandates comprehensive risk management, including:

  • Backup and recovery concepts
  • Supply chain security
  • Patch management
  • encrypted communications
  • Multi-factor authentication

Executive management is explicitly accountable. They must actively oversee cybersecurity risks and demonstrate control.

What happens in the event 
of noncompliance?

In the event of a security incident, a three-tier reporting regime applies:

Initial report: within 24 hours
Detailed report: within 72 hours
Final report: within 30 days

All reports must be submitted to the BSI. Within the federal administration, the new "Federal CISO" is responsible for coordinating the implementation of these requirements.

Noncompliance may result in fines of up to €10 million or 2% of a company's global annual revenue. In extreme cases, an organization’s operating license may be revoked.

Why is 
NIS2 important?

Cyberattacks cause enormous economic damage. According to Bitkom, the German economy lost around €266 billion in 2024, and projections estimate losses of €289 billion in 2025. Therefore, the German federal government has set a long-term goal of reducing this figure to €50 billion.

NIS2 is a key component in achieving this goal. The directive is designed to strengthen the resilience of Europe’s digital infrastructure and effectively prevent outages, attacks, and manipulation. Consequently, IT networks and OT systems in production and operations will become more robust and less susceptible to disruption.

Modern OT-Security solutions like Octoplant help companies implement these requirements efficiently and minimize downtime.

You can find more details in our white paper on NIS2 compliance.