# Décision NIS2 au Bundestag : la pression s'accentue sur les entreprises

> The article explains the German Bundestag's decision of 13 November 2025 to transpose the EU NIS2 Directive into national law and what it means for affected organisations. Swiss GRC describes how its GRC Toolbox supports NIS2 compliance.

- URL: https://swissgrc.com/fr/decision-nis2-bundestag-pression-entreprises/
- Éditeur: SwissGRC®
- Publié: 2025-11-17
- Dernière mise à jour: 2025-11-17

## Points clés

- The German Bundestag passed the Implementation and Cybersecurity Strengthening Act, which transposes the EU NIS2 Directive (Directive (EU) 2022/2555), on 13 November 2025.
- An estimated 29,000 to 30,000 companies and public institutions fall under the regulation, which is more than twice as many as before.
- The reporting requirements consist of a 24-hour early warning notice, a 72-hour interim report and a final report within 30 days.
- The Federal Office for Information Security (BSI) receives expanded supervisory authority, and a new function called CISO for the Federal Government is created.
- The law introduces the classifications important and highly important entities, which affect many organisations that were previously outside the regulatory perimeter.
- Swiss GRC offers the GRC Toolbox, which provides governance and accountability structures, NIS2-aligned risk assessment, incident and reporting workflows, and continuous compliance evidence.

**The implementation of the EU NIS2 Directive into German law fundamentally reshapes the cybersecurity requirements for thousands of organizations across the country. Those who act now will not only secure compliance, but also significantly strengthen their overall cyber resilience.**

With the adoption of the law transposing the NIS2 Directive, the German Bundestag has laid a decisive foundation for the modernisation of the national cybersecurity framework. On 13 November 2025, the so-called Implementation and Cybersecurity Strengthening Act was passed — a measure that raises security requirements for a vast share of the German economy to an unprecedented level ([bundestag.de](https://www.bundestag.de/dokumente/textarchiv/2025/kw46-de-nis-2-1123138?utm_source=chatgpt.com)). Not only operators of critical infrastructure are affected; NIS2 expands the scope dramatically and introduces explicit supervisory, reporting, and governance obligations.

Why NIS2 matters

The NIS2 Directive (Directive (EU) 2022/2555) represents the EU’s primary legal instrument to enhance cybersecurity and cyber resilience. It is a response to an evolving threat landscape characterised by interconnected supply chains, geopolitical tension, and increasingly strategic cybercrime. The Directive demands modern security, governance, and risk management structures — with clear accountability at senior management level and significant sanctions in the event of non-compliance ([de.wikipedia.org](https://de.wikipedia.org/wiki/NIS-2-Richtlinie?utm_source=chatgpt.com)).

Put simply: cybersecurity is no longer seen as a purely technical issue, but as a central leadership and governance priority.

New legal requirements and why time is short

With the Bundestag decision, NIS2 is formally integrated into German law. The core elements of the legislation include:

- **Significant expansion of scope:** An estimated 29,000–30,000 companies and public institutions will fall under the regulation — more than twice as many as before ([security-insider.de](https://www.security-insider.de/bundestag-beschliesst-nis-2-umsetzungsgesetz-a-6b67d5b503bf7404553cc5de4f0dbbb0/?utm_source=chatgpt.com)).
- **Tightened reporting requirements:** 24-hour early warning notice, 72-hour interim report, and a final report within 30 days (csoonline.com).
- **Stronger supervision and enforcement:** The Federal Office for Information Security (BSI) receives expanded authority.
- **New “CISO for the Federal Government”:** A centralised function to support information security within federal administration ([bundestag.de](https://www.bundestag.de/dokumente/textarchiv/2025/kw46-de-nis-2-1123138?utm_source=chatgpt.com)).
- **New entity classifications:** “Important” and “highly important” entities — affecting many organisations previously outside the regulatory perimeter.

Experts warn that organisations face intense time pressure because the implementation deadline at EU level has already been exceeded
([becon.de](https://www.becon.de/bundestag-beschliesst-verspaetetes-nis-2-umsetzungsgesetz-auswirkungen-chancen-und-klare-handlungsempfehlungen-fuer-unternehmen/?utm_source=chatgpt.com)).

Obligations — but also opportunities

Organisations that view NIS2 as a purely regulatory burden risk missing the strategic benefits. The Directive supports a resilient, holistic security culture and opens opportunities for long-term competitive advantage:

| Regulatory challenge | Strategic benefit when implemented effectively |
| --- | --- |
| Reporting & notification obligations | Faster incident response & reduced business impact |
| Risk management requirements | Structured prioritisation & transparency in security posture |
| Board-level accountability | Clear ownership & long-term investment security |
| Supply chain security | Resilience across the entire value ecosystem |
| Catalogue of technical & organisational measures | Higher cyber defence capacity & reduced operational risk |

NIS2 demands what many organisations already need: **integrated cybersecurity, governance, risk and compliance — not isolated technical controls.**

The path to cyber resilience: beyond compliance

The key challenge is not simply achieving NIS2 conformity, but embedding cybersecurity permanently into processes, organisational structures, and technology. This requires:

- Visible executive accountability and governance structures
- Strategic integration of cybersecurity with risk and compliance management
- Digitalisation and automation of security processes
- Reportable, audit-ready documentation at any time
- Continuous monitoring rather than periodic assessments

Success depends not on the quantity of technical security tools — but on a **platform that connects all security, governance, risk, and compliance elements in one system**.

NIS2 compliance with a system: How Swiss GRC supports organisations

The implementation of the NIS2 Directive is not just a regulatory development. It is an essential step toward future-proofing organisations in an increasingly hostile cyber landscape. Those who invest early strengthen not only compliance but resilience, competitiveness and ultimately, the security of the wider economy. Swiss GRC enables companies to comply with the EU NIS2 Directive efficiently and without organisational overload, while establishing a foundation for long-term cybersecurity excellence. The **GRC Toolbox** provides:

- Clear governance and accountability structures
- Risk assessment and monitoring aligned with NIS2 requirements
- Incident and reporting workflows with full transparency
- Continuous compliance evidence and audit-readiness
- Seamless integration into existing security and IT ecosystems

In other words: compliance becomes not a hurdle, but a driver of cyber resilience and sustainable security.

👉 Learn more:
**[https://swissgrc.com/en/network-information-security-directive-nis2/](https://swissgrc.com/en/network-information-security-directive-nis2/)**

## Questions fréquentes

### When did the Bundestag pass the NIS2 implementation law?

The Bundestag passed the Implementation and Cybersecurity Strengthening Act on 13 November 2025. It integrates the EU NIS2 Directive formally into German law.

### How many organisations in Germany are affected by NIS2?

An estimated 29,000 to 30,000 companies and public institutions fall under the regulation. This is more than twice as many as before, and not only operators of critical infrastructure are affected.

### What are the NIS2 reporting deadlines?

Organisations must send a 24-hour early warning notice and a 72-hour interim report. A final report is due within 30 days.

### Why is time short for organisations to implement NIS2?

Experts warn of intense time pressure because the implementation deadline at EU level has already been exceeded. The article therefore recommends acting early.

### How does Swiss GRC support NIS2 compliance?

Swiss GRC provides the GRC Toolbox, which covers governance and accountability structures, risk assessment and monitoring aligned with NIS2, incident and reporting workflows, and continuous compliance evidence with audit-readiness. It connects security, governance, risk and compliance in one system.