Mandatory Cybersecurity Regulations for Companies to Begin in 2026

The German government is set to implement the EU's NIS2 directive, which mandates essential cybersecurity measures for critical infrastructure and businesses, by early 2026. Claudia Plattner, President of the Federal Office for Information Security (BSI), emphasized the urgency of this initiative, stating that efforts to establish the legal framework are underway.

The proposed legislation will require companies and institutions to conduct risk assessments and report security incidents. According to the Interior Ministry, discussions with the federal states and relevant associations took place in early July to gather input on the draft.

As part of the new regulations, approximately 29,000 organizations will be obligated to adopt specific security protocols aimed at safeguarding against cyber threats. This initiative aims to enhance cybersecurity measures for essential sectors such as energy, transportation, water supply, food production, wastewater management, and telecommunications. The rationale behind this requirement is that any disruption to these sectors due to cyberattacks could have serious consequences for the general public.

Currently, the BSI oversees around 4,500 critical infrastructure operators who must comply with existing cybersecurity standards. However, the upcoming regulations will extend these requirements significantly. The BSI has made available an online NIS2 compliance assessment tool, which has already been utilized over 200,000 times, allowing entities to determine their obligations under the new rules.

Despite these efforts, Plattner noted that many organizations may not yet fully grasp the implications of the forthcoming requirements. The deadline for EU member states to adopt the NIS2 directive into national law was October 17, 2024, a deadline that Germany and several other countries failed to meet. Following the breakdown of the coalition government, the proposed legislation lost its momentum in the Bundestag.

Plattner stressed the necessity for swift action, advocating for prompt implementation of the directive to mitigate cybersecurity risks effectively. The BSI is currently monitoring numerous supply chain attacks, where hackers target service providers to gain access to their clients, which can include government entities and political institutions. The nature of these attacks often blurs the line between criminal and state-sponsored activities.

Recently, a significant cyberattack caused major IT disruptions at the German health company Ameos, highlighting the vulnerabilities within public institutions. Additionally, several websites of ministries in Saxony-Anhalt were temporarily inaccessible due to a denial-of-service attack attributed to a pro-Russian hacker group.

In terms of compliance with the NIS2 directive, Plattner indicated that the effort required will vary among organizations. Companies with established IT departments and existing cybersecurity measures may find it easier to adapt, while those new to the cybersecurity landscape will face a steeper learning curve. The BSI is committed to providing support through information and consultation services to help organizations meet the new requirements as seamlessly as possible.