Anyone who does not protect their IT systems well is taking a big risk.

After numerous delays, the German federal government plans to enshrine the rules adopted by the European Union for protecting important facilities and companies from cyberattacks in law by the beginning of 2026. "The Federal Ministry of the Interior is currently pushing this issue forward at full speed," Claudia Plattner, President of the Federal Office for Information Security (BSI), told the German Press Agency. "I hope we can make it come into force at the beginning of 2026." According to the Interior Ministry, the states and affected associations were consulted on the draft at the beginning of July.

The implementation of the European NIS 2 Directive is intended to improve cybersecurity for companies and institutions. Major enterprises in the energy, transport, drinking water, food production, wastewater, and telecommunications sectors are considered important institutions within the meaning of the law. The idea behind it is that if they were no longer able to operate—for example, because a hacker had encrypted their data or blocked access to it—this would have a significant impact on the population.

The obligation to implement certain security measures to defend against and respond to cyberattacks is expected to affect an estimated 29,000 companies in the future, significantly more than before. The BSI currently supports approximately 4,500 operators of critical infrastructure that must meet certain cybersecurity standards.

A "NIS-2 Impact Test" has been online for about four months. This allows anyone to find out whether the planned stricter regulations apply to them or not. According to the BSI, the test has already been used more than 200,000 times. Nevertheless, Plattner feels that "many of those affected are still not fully aware of the requirements that will be imposed on the affected companies and institutions."

The deadline for the NIS 2 Directive expired on October 17, 2024. All EU member states were required to transpose the directive into national law by that date. Germany and numerous other EU member states missed the deadline. The "traffic light" coalition had passed a corresponding bill in the cabinet in July 2024. However, after the coalition of the SPD, the Greens, and the FDP collapsed, there was no longer a majority for it in the Bundestag. "Because we didn't manage to do this in the last legislative period, we really need to move fast," warns the BSI President.