Whether an organisation will soon need to take additional protective measures depends on two factors: the industry and the size; the NIS-2 Implementation Act defines several categories. The website of the German Federal Office for Information Security (BSI) provides initial pointers regarding company obligations and affected organisations (see links).

A key objective of the new laws is to create more transparency alongside minimum security requirements. As such, incidents must be reported. Reporting must be done securely and be accessible only to authorised stakeholders. Reporting must occur within 24 hours, and for significant incidents, you must notify your customers. Failure to comply can result in severe sanctions; senior management cannot delegate this responsibility.

Whether or not an organisation belongs to critical infrastructure, senior management is responsible for avoiding unreasonable risks. In practice, this means establishing an information security management system. This also applies to data protection risks.

To protect the individual rights of people whose data the organisation processes, specific tasks must also be implemented, such as responding to requests for information, releasing, correcting, and deleting data after the retention period has expired.