NIS2 Implementation: Your Roadmap to Compliance

NIS2 moves away from the old “KRITIS or not” logic. Instead, companies are now classified as “important entities” or “essential entities.”

1. Thresholds (Size Factor)

You are generally affected if your company operates in one of the 18 regulated sectors and meets the following criteria:

Important entities

• At least 50 employees, or
• Annual turnover or balance sheet total of more than €10 million

Essential entities

• At least 250 employees, or
• Annual turnover of more than €50 million (with a balance sheet total above €43 million)

2. Sectors (Relevance Factor)

Sectors of high criticality

• Energy
• Transport
• Banking
• Healthcare
• Drinking water and wastewater
• Digital infrastructure
• Public administration
• Space

Other critical sectors

• Postal and courier services
• Waste management
• Chemicals
• Food production
• Manufacturing (e.g. mechanical engineering, automotive)
• Digital providers (marketplaces, search engines)
• Research

Important: Certain providers (e.g. DNS services, trust service providers) are regulated regardless of company size.

NIS2 is the “sharp sword” of cybersecurity regulation – with enforcement mechanisms comparable to the GDPR.

• Severe fines: For essential entities fines can go up to €10 million or 2% of global annual turnover, whereas for important entities: up to €7 million or 1.4% of global annual turnover
• Personal liability for management: Executives can be held personally liable for compliance failures. The law explicitly allows recourse claims by the company against its management.
• Mandatory training: Managing directors must regularly attend cybersecurity training. Lack of knowledge is explicitly not a defense.
• Mandatory registration: Since 6 January 2026, the new BSI registration portal has been live. Failure to register can already result in the first fine.

Before diving into the phases, let’s be clear: NIS2 is not just about firewalls.

It directly affects:

• Executive liability
• Supply chain security
• Business continuity

Ignoring these requirements doesn’t just risk fines – it puts customer trust, partner relationships, and operational stability at stake.

Phase 1: Scoping – Where Do We Stand?

We start with the basics. Not every company needs to implement everything.

What we do

• Assess applicability (are you an important or essential entity?)
• Clarify registration obligations
• Bring management on board

Your benefit: A clearly defined scope. No wasted effort on requirements that don’t apply to you.

Phase 2: Risk Assessment – Your Digital Map

We identify what really needs protection.

What we do

• Inventory your assets and systems
• Conduct a structured risk analysis
• Identify vulnerabilities and potential impact scenarios

Your benefit: Full transparency about your risks – and a clear priority list for action.

Phase 3: Control Design – Building Your Shield

Now it gets concrete.

What we do

• Develop policies and governance structures
• Implement technical and organizational controls
• Assess supply chain risks
• Prepare incident response and crisis management processes

Your benefit: A tailored security framework that actually fits your business.

Phase 4: Monitoring – Does It Work in Practice?

Compliance is a marathon, not a sprint.

What we do

• Conduct internal audits
• Track KPIs and effectiveness
• Provide regular management reviews

Your benefit: Continuous proof that you are meeting your obligations – invaluable during audits or investigations.

Phase 5: Handover – You Take Control

We don’t leave you alone – but we make you independent.

What we do

• Structured handover of all documentation
• Training for your domain owners
• Clear role and responsibility definitions

Your benefit: An audit-ready repository and a team that knows exactly what to do.

NIS2 may sound like a massive compliance monster — but with the right partner, it’s absolutely manageable.

At heyData, our goal is to make the process efficient, transparent, and business-oriented, so you can focus on what you do best: running your business.