NIS2 (Germany)
Essential and important entities report significant incidents to the BSI in stages, starting with an early warning within 24 hours. We track every stage’s deadline and draft each report.
Significant-incident reporting under the BSIG, with energy, telecom and trust-service profiles
The duty
- Who reports
- Essential and important entities under the BSIG
- Legal basis
- § 32 BSIG; scope § 28 BSIG; registration § 33 BSIG
- 24 hEarly warning to the BSI
- 72 hNotification
- 1 monthFinal report, counted from the notification
Counted from when you become aware. There is also an intermediate report at the BSI’s request and, if the incident is still ongoing after one month, a progress report instead of the final report.
Read the explainer: NIS2 in GermanyWhat the Reporting Desk does
- The reporting stages under § 32 BSIG, each with its own clock: early warning within 24 hours of becoming aware, notification within 72 hours, intermediate report at the BSI’s request, final report one month after the notification – or, if the incident is still ongoing then, a progress report instead.
- Profiles for energy (§§ 5c, 5d EnWG), public telecommunications (§ 168 TKG) and trust service providers (eIDAS), all in the same module.
- Drafts structured like each recipient’s form, for the BSI reporting portal, the BSI’s online form for entities without registration, and the § 168 TKG reporting addresses of the Federal Network Agency and the BSI.
- A self-check questionnaire on § 28 BSIG – for orientation, not a legal assessment.
- A reminder to register with the BSI (§ 33 BSIG) while an entity’s registration is required or not yet assessed.
- Your own copy of every report, with the time you submitted it.
- Every stage cites its legal basis.
- Alerts, backup escalation, audit trail, export and hosting in Germany, as in every module.
Plans
Starter €129, Team €349, Business €790 a month, for 1, 3 or 10 legal entities. Yearly billing: 12 months for the price of 10.
For businesses only. All prices plus VAT.