Implementing NIS2 with common sense

Klaus Kilvinger of Opexa Advisory eases the fear of NIS2 over regulation and implementation fatigue. He argues that the basics are already existing in many companies, and that dealing with cyber risks is just another pillar of regular risk management practices the management has always been responsible for.

Duration:

26 min

Guest in this episode:

Klaus Kilvinger

CEO Opexa Advisory

FAQ

Facts on the topic

What is the NISUmsuCG, and which companies are affected?

The NISUmsuCG is the German national implementation of the EU's NIS2 Directive. Generally, companies in 18 critical sectors with 50 or more employees fall under its scope. A key point: there is no external source that officially notifies companies of their status. Organizations must evaluate their own eligibility and complete their registration with the BSI by March 5, 2026.

‍

What is the liability risk for management under NIS2?

While the liability risk for management isn't entirely new, NIS2 makes it much more explicit. Management is legally required to approve and oversee the implementation of cybersecurity measures. Since cyber risks can pose an existential threat to business continuity, managing them is a core duty of executive leadership. A notable addition is the mandatory training for board members, ensuring they can assess cyber risks effectively without needing to be IT experts.

Can existing ISO 27001 or TISAX certifications be used for NIS2?

Yes, definitely. The principle here is "recycling." If an organization has already implemented an Information Security Management System (ISMS) based on ISO 27001 or TISAX (common in the automotive industry), they have already covered a significant portion of the requirements. NIS2 can be built upon these existing structures. The best approach is a gap analysis to identify and fill the specific legal requirements not covered by current certifications.

‍

What are the first steps for NIS2 implementation for beginners?

For companies starting their compliance journey, experts recommend three initial steps:

Check Eligibility: Use official tools like the BSI checklist to determine if your sector and company size are regulated.
Conduct a Gap Analysis: Compare your current security posture against the legal mandates.
Risk & Incident Management: Focus on preventive measures (like Multi-Factor Authentication) and establish an emergency response plan to ensure compliance with strict reporting obligations.