Complying with the German NIS2 Implementation Act (NIS2UmsG): A Guide for Essential and Important Entities

As organizations across Germany's essential and important sectors face rising cyber threats and stricter state oversight, compliance with the NIS2 Implementation Act (NIS-2-Umsetzungsgesetz, NIS2UmsG) has become a core operational requirement rather than a documentation exercise. Enacted as a fully rewritten Act on the Federal Office for Information Security (BSIG), the law establishes a framework for risk management measures, tiered incident reporting, registration, and direct accountability for senior management across the systems that keep essential services running, with heightened expectations around threat detection, response, and evidence. Organizations must show that risk management measures are in place, that significant incidents are reported within tight deadlines, and that system activity is continuously monitored and available for supervision by the Federal Office for Information Security (BSI). This guide breaks down the regulation's essential requirements and shows how ManageEngine solutions help your organization implement, operationalize, and strengthen NIS2UmsG compliance with confidence.

What you’ll learn

• What the NIS2UmsG covers and why it matters to essential and important entities operating in Germany.
• The difference between essential and important entities, and how their risk management, reporting, and supervision expectations change.
• How risk management measures, attack detection for critical installations, and proof-of-compliance duties support compliance.
• What the incident reporting duties mean in practice, including the 24-hour, 72-hour, and one-month deadlines, registration with the BSI, and management liability.
• How identity governance and security monitoring help strengthen access control, threat detection, and incident reporting.