Is Your Company Actually NIS2-Ready?

NIS2 (Directive (EU) 2022/2555) significantly broadens the original NIS Directive’s scope. In Germany alone, the number of companies in scope expands from roughly 4,500 to an estimated 29,500, across sectors far beyond the traditional critical-infrastructure list — energy, transport, health, digital infrastructure, manufacturing, postal services, waste management, and more. Germany’s implementing law (NIS2UmsuCG) came into force on December 6, 2025, with no transitional period for putting technical and organizational measures in place, and a registration deadline that fell just three months later. If your organization is newly in scope, the grace period is already behind you.

Two things make NIS2 different from earlier cybersecurity rules. Incident-reporting timelines are tight: a 24-hour early warning, a 72-hour detailed notification, and a final report within a month — timelines that assume your organization already knows what counts as a reportable incident and who owns that process. And management liability is now personal: management bodies must approve and oversee cybersecurity risk-management measures, and can be held personally liable — including, for essential entities, a temporary ban from management functions — if they don’t.

This dedicated session goes deep on NIS2 specifically:

• Who’s actually in scope now, and what changed with Germany’s NIS2UmsuCG
• Incident-reporting timelines, and what “reportable” actually means in practice
• Management liability: what oversight and documentation management needs to be able to show
• How the osapiens HUB supports NIS2 risk management and incident documentation
• Q&A