CONSULTING · NIS2 · CYBERSECURITY
NIS2 consulting.
Understand requirements. Implement security
High Knowledge helps translate cybersecurity requirements into technical and organisational measures, with a structured baseline assessment, clear priorities and a transparent implementation plan.
From European requirements to everyday operation.
NIS2 is the European directive for a high common level of cybersecurity. Germany's NIS2 implementation law has been in force since 6 December 2025. Affected entities must particularly consider the requirements of the revised BSI Act.
We assess your existing safeguards, technical dependencies and operational processes. Together with your responsible teams, we identify the gaps to close and how to integrate measures into ongoing operation.
Source on implementation in Germany: BSI information on NIS2.
Clarify applicability and scope first.
Whether an organisation falls within scope depends on its activities, entity type, size and specific statutory criteria, among other factors. Describing a business as an SME, enterprise or critical infrastructure operator is not sufficient for classification.
We support the structured collection of the necessary information and coordinate the technical scope with your legal and compliance teams. Additional European requirements apply to digital services: section 30(3) BSIG refers to prevailing technical and methodological requirements, including those for data centre service providers.
Binding decisions require assessment of current law, special provisions and the specific organisational structure.
Risk management needs more than a checklist.
Section 30 BSIG requires appropriate technical and organisational measures. These include risk analysis, incident handling, recovery, supply-chain security, vulnerability management and access protection. Implementation and effectiveness must be demonstrable.
We connect these requirements with your infrastructure, from administrative access, network segmentation and backups to dependencies on power, cooling and service providers. Existing structures are incorporated to make security sustainable in everyday operation.
Legal basis: Section 30 BSIG.
Responsibilities and decision paths
We help define responsibilities, approvals and escalation paths clearly. Management must ensure and oversee the implementation of risk-management measures; section 38 BSIG also establishes training obligations.
Prepare for incidents and recovery
A robust process connects detection, assessment, escalation and recovery. We support technical and organisational preparation so that your responsible teams can initiate required reporting and responses within the applicable deadlines.
A prioritised roadmap instead of isolated measures.
We structure the agreed scope into clear deliverables: baseline and gap analysis, assessed risks, measures with named owners and a coordinated implementation sequence. Evidence and regular testing are considered from the outset.
An existing information security management system is an important foundation. Certification alone, however, does not replace an assessment of all applicable NIS2 or BSIG requirements. We connect security organisation and technical implementation with our experience in data centres and critical infrastructure.
Critical infrastructure and physical resilience → · Data centre planning →
How we work with you.
- Define the framework: establish the scope of services, systems, sites and interfaces.
- Assess the current position: review documentation, technical measures and operating processes.
- Prioritise gaps: make risks and implementation effort transparent.
- Support implementation: agree technical requirements, responsible owners and milestones.
- Evidence and effectiveness: embed appropriate testing and regular updates.
The project starts with a clearly agreed scope. Legal classification, regulatory decisions and formal assessments are distinguished from technical implementation support.
Frequently asked questions
Is NIS2 a regulation?
No. NIS2 is an EU directive. In Germany, it is implemented primarily through the BSI Act. Certain digital services are also subject to directly applicable European implementing rules.
Does it only affect large enterprises?
No. Medium-sized businesses may also fall within scope. Statutory criteria determine applicability, with special rules for certain entity types.
Is NIS2 finished after one project?
Cybersecurity is an ongoing responsibility. Changes to systems, service providers and risks must be assessed, and measures reviewed regularly. The implementation project establishes the foundation.
Which NIS2 measures should you prioritise?
Let us discuss your current position and technical dependencies. We will help you develop a structured, practical roadmap.