What NIS2 requires in Germany
Why suppliers are affected without being regulated
Is your company itself in scope?
What customers will ask, and what to prepare
Statistics that explain the pressure
NIS2, the Cyber Resilience Act and DORA together
A supplier security pack
How we work
FAQ
Does NIS2 apply to software development companies?
What do NIS2 companies have to require from their suppliers?
How quickly must a supplier report an incident to its customer?
Is ISO 27001 mandatory for suppliers under NIS2?
What are the NIS2 fines in Germany?
Do we need an SBOM?
Sources
NIS2 for Software Suppliers: What Your Customers Will Ask You in 2026
Short answer (October 2026). Germany's NIS2 implementation act has been in force since 6 December 2025 and covers about 29,500 companies; by 30 September 2026, 20,141 of them had registered with the BSI. Each must manage the security of its supply chain under § 30 BSIG, so their software suppliers now receive security questionnaires and new contract clauses even when the law does not apply to them directly. Expect questions about incident notification "without undue delay", vulnerability handling, rules for subcontractors, the right to audit, multi-factor authentication, secure development and, increasingly, an SBOM. A software company can also be in scope itself: if it installs, operates, maintains or administers client systems with real technical access, it is a managed service provider under NIS2 from 50 employees or €10 million in turnover and balance sheet. Prepare one supplier security pack that answers the recurring questions, and decide your own status in writing.
This guide is for software development companies and IT service providers whose customers fall under NIS2, and for the procurement and security teams on the customer side who need to know what to ask.
What NIS2 requires in Germany
The NIS2 implementation act (NIS2UmsuCG) rewrote the BSI Act; the new BSIG has applied since 6 December 2025. The BSI expects about 29,500 supervised entities, up from about 4,500 before.
- Who is in scope (§ 28 BSIG). Important entities have at least 50 employees or more than €10 million in both annual turnover and balance sheet; particularly important entities have at least 250 employees or more than €50 million turnover and €43 million balance sheet, in the sectors listed in the annexes.
- Registration (§ 33). At the latest three months after an entity first falls under the law, which for most meant 6 March 2026, via a company account and the BSI portal. By 30 September 2026, 20,141 entities had registered: 13,252 important and 6,837 particularly important.
- Measures (§ 30). Ten areas, from risk analysis and incident handling to backup, cryptography, access control and multi-factor authentication. Two concern suppliers directly: number 4, "security of the supply chain, including security-related aspects of the relationships with direct suppliers or service providers", and number 5, security in the acquisition, development and maintenance of IT systems, "including management and disclosure of vulnerabilities".
- Incident reporting (§ 32). An early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report one month later.
- Management duties (§ 38). Management must implement the risk management measures and supervise their implementation, attend regular training, and is liable to its own company for breaches.
- Fines (§ 65). Up to €10 million for particularly important and €7 million for important entities; for companies with more than €500 million turnover, up to 2% or 1.4% of worldwide turnover.
Why suppliers are affected without being regulated
The BSI puts it plainly: the law does not oblige all suppliers and service providers indirectly, but regulated entities "may no longer be able to work with every company without risking a breach of their obligations". A software supplier with access to a customer's systems, code base or data is part of that customer's supply chain risk, and the customer has to show that it manages it.
How customers do that is already standardised. For digital service providers, the EU's Implementing Regulation 2024/2690 spells out supply chain security in detail, and the BSI's supply chain checklist from June 2025 translates the same ideas into concrete requirements. In ENISA's 2023 survey of supply chain practice, 61% of organisations already required security certification from their suppliers.
Is your company itself in scope?
NIS2 lists "managed service providers" in the sector of digital infrastructure. The definition covers services related to "the installation, management, operation or maintenance" of ICT products, networks, applications or systems, "via assistance or active administration", on the customer's premises or remotely (§ 2 No. 26 BSIG).
The BSI's FAQ narrows it down: managed service provision requires "a certain degree of actual access" and is to be distinguished from pure consulting; a minimum number of customers is not required; user support without technical access does not count, and pure web hosting usually does not either. In our reading that gives three practical cases:
- Project development only, handing over code that the customer runs: not a managed service provider. Your customers will still treat you as a supplier.
- Development plus operation, maintenance or administration of client systems with admin access, as in a support contract or managed DevOps: likely a managed service provider, and in scope from the size thresholds of an important entity. There is no special size exemption for managed service providers.
- Occasional, minor operation work may count as a negligible part of the business under § 28(3), but document the reasoning.
Check your case with a lawyer; the consequences of being in scope include registration, all of § 30 and the reporting duties.
What customers will ask, and what to prepare
Questionnaires differ in form but converge on the same contract points, which Implementing Regulation 2024/2690 (Annex, point 5.1.4) lists for digital service providers and the BSI checklist repeats:
| Customers will ask about | Where it comes from | What to prepare |
|---|---|---|
| Your security requirements and how you meet them | 2024/2690, 5.1.4 (a); § 30 BSIG | a short security policy: access control, MFA, encryption, backups, logging |
| Staff training and qualifications | 5.1.4 (b) | training records, roles with privileged access |
| Background checks | 5.1.4 (c) | what you check for people with access to client systems |
| Incident notification to the customer | 5.1.4 (d): "without undue delay"; BSI checklist | a process and a named contact; the hours you can commit to |
| Right to audit or audit reports | 5.1.4 (e); BSI checklist: audit or certificate once a year or more | an ISO 27001 certificate, an audit report, or a standing offer of a customer audit |
| Vulnerability handling | 5.1.4 (f); § 30 No. 5 | how you track dependencies, patch and disclose; SBOM on request |
| Subcontractors | 5.1.4 (g); BSI checklist: customer approval | a list of subcontractors and sub-processors, approval process |
| Termination and exit | 5.1.4 (h) | handover of code and data, deletion, revocation of access |
| Secure development | 2024/2690, 6.2; § 30 No. 5 | code review, dependency scanning, separation of environments, secrets management |
Two points cause most friction:
- "Without undue delay" is the law; hours are the contract. Neither the BSIG nor the Implementing Regulation fixes how fast a supplier must tell its customer about an incident. Customers translate it into a number of hours that fits their own 24-hour reporting duty. Agree on a number you can meet around the clock, not the smallest one in the draft.
- An SBOM is becoming normal. The BSI checklist recommends a software bill of materials in a recognised standard, and from 11 December 2027 the Cyber Resilience Act makes one mandatory for manufacturers of products with digital elements.
Statistics that explain the pressure
- In its 2025 situation report, the BSI counted 119 new vulnerabilities a day, about 24% more than a year earlier, and about 80% of the attacks reported to the police were directed at small and medium-sized companies.
- In a TÜV Rheinland survey of 500 IT managers in June 2026, only 14.3% said their company had fully implemented NIS2, 21.6% said they were not affected, and 30.8% did not know.
- Among German companies, the share that consider themselves very well prepared for attacks fell to 43% in Bitkom's 2026 economic protection survey, down from 50% a year earlier.
NIS2, the Cyber Resilience Act and DORA together
- Cyber Resilience Act. If you sell software products rather than services, the CRA's duty to report actively exploited vulnerabilities has applied since 11 September 2026 (24 hours, 72 hours, and a final report within 14 days of a fix), and its main obligations, including security by design, an SBOM and security updates for the support period, from 11 December 2027.
- DORA. Banks, insurers and other financial entities follow DORA instead of most of the BSIG; since 17 January 2025 they keep a register of all ICT third-party contracts, and their questionnaires to suppliers are usually stricter. In November 2025 the European supervisory authorities designated the first critical ICT third-party providers.
A supplier security pack
- Decide in writing whether you are a managed service provider and, if so, whether you are registered.
- A two-page security overview mapped to § 30 BSIG.
- Certificates or audit reports, or an offer of a customer audit.
- An incident process with a 24/7 contact and the notification time you commit to.
- A vulnerability and patch process; an SBOM for the software you deliver.
- A list of subcontractors and sub-processors.
- Access rules: individual accounts, MFA, least privilege, access removed when people leave.
- An exit plan: handover, deletion, revocation.
- Standard contract clauses you can accept, so each questionnaire does not become a negotiation.
How we work
Our security and compliance framework describes how we handle access, roles, secrets and environments on client projects, and our legal documents, including the master service agreement, SLA and data processing terms, are public. For operations we offer fully managed DevOps with the logging and incident processes that NIS2 customers ask for. If you need to answer a customer's NIS2 questionnaire about software we built or run, we prepare the technical part with you.
This article explains the regulation; it is not legal advice.
FAQ
Does NIS2 apply to software development companies?
Not as such. A company that only develops software for customers is not in scope by that activity. If it also installs, operates, maintains or administers client systems with real technical access, it is likely a managed service provider, which NIS2 covers from 50 employees or €10 million in turnover and balance sheet.
What do NIS2 companies have to require from their suppliers?
They must manage the security of their supply chain under § 30 BSIG. In practice that means security requirements in contracts, incident notification without undue delay, vulnerability handling, rules for subcontractors, the right to audit and rules for the end of the contract, as listed in Implementing Regulation 2024/2690.
How quickly must a supplier report an incident to its customer?
The law says without undue delay; the number of hours is agreed in the contract. Customers have to send an early warning to the BSI within 24 hours, so they will ask for a short window.
Is ISO 27001 mandatory for suppliers under NIS2?
No. It is the most common evidence customers accept, and the BSI recommends an information security management system based on ISO 27001 or BSI standard 200-1, but an audit report or a customer audit can also serve.
What are the NIS2 fines in Germany?
Up to €10 million for particularly important and €7 million for important entities; for companies with more than €500 million turnover, up to 2% or 1.4% of worldwide turnover.
Do we need an SBOM?
The BSI's supply chain checklist recommends one, and the Cyber Resilience Act requires one from 11 December 2027 for manufacturers of products with digital elements. Customers increasingly ask for it already.
Sources
- BSI Act 2025 (BSIG), in particular § 28, § 30, § 32, § 33, § 38 and § 65
- BSI, NIS-2-Umsetzungsgesetz in Kraft, December 2025, and NIS-2 in Zahlen, September 2026
- BSI, NIS-2 FAQ, Sichere Lieferkette and supply chain checklist, June 2025
- Commission Implementing Regulation (EU) 2024/2690, October 2024
- ENISA, Good Practices for Supply Chain Cybersecurity, June 2023
- BSI, Die Lage der IT-Sicherheit in Deutschland 2025
- TÜV Rheinland, NIS2 survey, June 2026
- Bitkom, Wirtschaftsschutz 2026, August 2026
- European Commission, Cyber Resilience Act; EBA, ESAs designate critical ICT third-party providers, November 2025
Categories
About the author
CEO & Co-Founder at Software Development Hub. Innovation-driven expert with 20+ years of experience. A business practitioner with experience in creating and launching startups, an innovator and progressive-minded specialist, who helps turn raw ideas into profitable results.
Share
Need a project estimate?
Drop us a line, and we provide you with a qualified consultation.