NIS2 asks for evidence. We deliver it technically.
NIS2 has applied in Germany since 6 December 2025 — with no transition period. §30 BSIG requires not only measures but an assessment of their effectiveness. A penetration test is the most defensible way to provide it. We deliver it in audit-ready form, from €3,500.
The binder is full. The effectiveness is untested.
Most NIS2 programmes stop where it hurts least: policies, procedures and a management system on paper. That work is necessary — but it does not answer the question the law actually asks. §30 (2) no. 6 BSIG requires concepts for assessing the effectiveness of risk management measures. Translated: does what you documented hold up against a real attacker? No document answers that — only a test does. That is where we come in: technical, evidenced, repeatable.
Where things stand
NIS2 in Germany, the hard facts
Not a forecast, not a draft. The law is in force and the registration deadlines have passed.
This page places NIS2 in technical context and describes which of our services address which requirement. It is not legal advice. Whether and in which category your company is in scope is a question for your legal counsel.
- 6 December 2025 — no transition periodThe German NIS2 implementation act (NIS2UmsuCG) was passed on 13 November 2025 and entered into force the day after promulgation. The obligations have applied since then.
- Around 29,500 organisations in GermanyMembership of one of the sectors listed in the BSIG plus, as a rule, at least 50 employees, or more than €10m annual turnover and more than €10m balance sheet total (§ 28 BSIG).
- No later than 3 months after becoming subject to the law — 6 March 2026 for existing entitiesThe BSI expected outstanding registrations to be completed by the end of July 2026 — that was not a statutory grace period. A missed registration can be penalised in its own right. If you are still not registered, fix that first — before booking a pentest.
- 24 hours early warning · 72 hours report · 1 month final reportApplies to significant security incidents. The 24-hour clock starts when you become aware — not when analysis is complete.
- Up to €10m (essential) or €7m (important entities)The turnover-based caps of 2% and 1.4% of worldwide turnover only apply to entities with more than €500m total turnover (§ 65 BSIG). A missed registration carries up to €500,000.
- BSI — unannounced audits possible for essential entitiesThe BSI can request evidence, run audits and order security assessments. Having nothing to show at that point is the weakest possible position.
- Management implements, oversees and is liableManagement must implement the risk management measures and oversee their implementation, and is liable to the entity for culpably caused damage under company law. It must also attend training regularly (§ 38 BSIG).
Are you in scope?
The second question often matters more: are you pulled in through your customers?
Essential entities
Larger organisations in particularly critical sectors — energy, transport, health, water, digital infrastructure, IT service providers. Unannounced BSI audits are explicitly foreseen here.
Important entities
As a rule from 50 employees, or more than €10m turnover and balance sheet — including mechanical and automotive engineering, medical devices, electronics, chemicals, food, postal services, waste management and research. Supervision is triggered by cause.
Suppliers and service providers
The most underestimated point: §30 (2) no. 4 BSIG obliges in-scope companies to manage the security of their supply chain. That requirement is passed on contractually — including to companies not themselves in scope.
Software and product manufacturers
In scope twice: as an entity under NIS2 and as a manufacturer under the Cyber Resilience Act. Both require working vulnerability management — the technical basis is the same.
Management personally
Implementation of measures, oversight of implementation, regular training. NIS2 makes information security explicitly a leadership duty — not an IT topic.
Not sure whether you qualify?
You are in good company — classification is the most common point of dispute. We clarify the technical side in the intro call and will tell you plainly if you need legal advice before a pentest.
§30 BSIG in practice
Which requirement we answer with what
All ten measure areas in §30 (2) BSIG are mandatory. These are the ones that can be tested technically — and that is what we do.
| Requirement under §30 (2) BSIG | What we deliver |
|---|---|
| Policies on risk analysis and information system security | The penetration test shows which risks are actually exploitable — not just which ones appear in the risk matrix. The result is a CVSS-prioritised list with a real attack path instead of an estimate. |
| Incident handling | The assumed-breach assessment tests the real case: we start from an assumed foothold and measure how far we get — and whether your detection fires before we reach the objective. |
| Supply chain security | External interfaces, third-party integrations and exposed supplier access belong in the pentest scope. Attack surface monitoring keeps that picture current afterwards. |
| Security in acquisition, development and maintenance — including vulnerability handling | Secure SDLC review: how do vulnerabilities enter your software, and what catches them? Pipeline, dependencies, secrets, review practice — with measures your team can actually implement. |
| Policies to assess the effectiveness of risk management measures | The core of this page: a recurring penetration test with a re-test after remediation is a dated, traceable proof of effectiveness. Planned as a retainer instead of improvised once a year. |
| Cyber hygiene practices and security training | Developer workshop based on your own findings. In our experience one real vulnerability from your own code lands harder than any generic awareness deck. |
| Cryptography and encryption | TLS configuration, certificate management, transport security and handling of keys and secrets — a standard part of the security audit and of attack surface monitoring. |
| Access control and personnel security | Role and permission testing in every pentest: horizontal and vertical privilege escalation, insecure direct object references, forgotten administrative accounts. |
| Multi-factor authentication and secured communications | MFA bypass testing, review of recovery and emergency access paths and of session handling — the point where MFA most often fails in practice. |
From obligation to evidence
A plannable path instead of a compliance fire drill
We clarify your technical starting point, the trigger — audit, customer requirement, supervision, incident — and what realistically comes first.
Assessment against the technically testable requirements of §30 (2) BSIG. Output: gap list, prioritised action plan, management summary — for €2,900.
We agree which systems are tested, with which methodology and in which window. Written test authorisation included.
Manual testing to OWASP, PTES and BSI standards. Critical findings are reported immediately, not held back for the final report.
Management summary for leadership, technical section for your team, CVSS scoring, reproduction steps, remediation guidance — ready to present to an auditor or supervisor.
Your team implements, or we take it on. As a software company that is not a foreign body for us but day-to-day work.
Verification of remediated findings plus a closing document. The proof of effectiveness is then not only produced but evidenced.
What we do, and what we don't
NIS2 compliance is more than technology. We cover the technical part, and we tell you where our role ends.
- Technical readiness check against the testable requirements of §30 BSIG
- Penetration tests as proof of effectiveness: external, on the internal network and in Active Directory, repeatable and dated
- Assumed-breach assessment to test detection and response
- Attack surface monitoring as ongoing evidence between tests
- Secure SDLC review and developer workshop
- Reports in audit-ready form including remediation tracking
- Technical support for your ISMS consultant or auditor
- Legal advice on whether and how you are in scope
- Registering with the BSI on your behalf
- ISO 27001 certification — we are not a certification body
- Building a full ISMS including the policy framework
- Reporting security incidents to authorities on your behalf
- 24/7 monitoring in the sense of a SOC
For the items on the right we work with specialist partners — law firms, ISMS consultants, certification bodies. Tell us what is missing and we will refer you rather than improvise it ourselves.
Pricing for your NIS2 evidence
Transparently calculated — without a compliance surcharge
NIS2 readiness check
The fast entry point
- Assessment against §30 (2) BSIG (technical scope)
- Prioritised gap list
- Action plan with effort estimates
- Management summary for leadership
- Recommendation for the testing scope
Penetration test
The actual proof of effectiveness
- Web, API, cloud, internal network and Active Directory
- Testing to OWASP, PTES and BSI
- CVSS-prioritised findings
- Management summary and technical report
- Re-test after remediation included
- Price verifiable upfront in the calculator
Security Cycle retainer
Evidence that does not expire
- Attack surface monitoring included
- One penetration test per year
- Two consulting days per year
- Re-tests after remediation
- Ongoing evidence documentation
- Priority scheduling around audits
Frequently asked questions on NIS2 and penetration testing
Technical context — not legal advice
Not in those words. §30 (2) no. 6 BSIG requires concepts for assessing the effectiveness of risk management measures without prescribing a specific method. In practice the penetration test is the most common and most defensible way to demonstrate that effectiveness to auditors, customers and supervisors. Pointing only to internal vulnerability scans is the weaker position.
The law names no interval. Established practice is a full test once a year plus additional testing after material changes — a new application, a new interface, a significant architecture change, a migration. Between tests, attack surface monitoring closes the gap by making changes visible instead of leaving them unnoticed until the next test window.
Because the requirement arrives through the supply chain. §30 (2) no. 4 BSIG obliges in-scope companies to manage the security of their suppliers and service providers — and that pressure is passed on contractually. We increasingly see tenders and framework agreements that name a current pentest report as a precondition. Having one keeps you in the running.
From €3,500 for a small web application. For a typical mid-market scenario — medium-sized application, several roles, some cloud, personal data — we usually land between €6,000 and €10,000. For comparison, €7,500 to €15,000 is typical in Germany for comparable scopes. You can model your own scope upfront in the pentest calculator.
On its own, unlikely. A scanner finds known patterns but not logic flaws, not privilege escalation across roles, and not attack chains built from individually harmless weaknesses. Those combinations are what real incidents exploit. Scans are a useful continuous baseline between tests — as the sole proof of effectiveness they are weak.
Registration first, technology second. For existing entities the deadline passed on 6 March 2026; the BSI expected outstanding registrations by the end of July 2026 — that was not a statutory grace period. The omission can be penalised in its own right and is not improved by having a pentest report. Complete the registration, ideally with legal support, and build the technical evidence in parallel.
Usually within two to three weeks for the readiness check; plan two to four weeks of lead time for a full penetration test. If you have a hard trigger — a customer audit with a date, a supervisory request, an incident — say so in the intro call: prioritised slots are possible with a surcharge.
NIS2 already applies
Get the evidence before somebody asks for it
A 30-minute intro call: we place your current state, name the technical gaps and tell you honestly whether a readiness check or a penetration test is the right next step.
Yen Ngoc Phan · Manuel Gruschka