Not legal advice: this article gives an overview from an IT perspective, as of November 2026. Whether and how your business is affected, please clarify with legal counsel, your chamber of commerce or your trade association.
When your customer suddenly sends a questionnaire on IT security, there is often an abbreviation behind it: NIS2. Many tradespeople, suppliers and service providers then ask themselves: does this concern me at all? I am only a small business.
The short answer: larger companies in certain sectors are more likely to be directly affected. Small businesses can however be indirectly affected, namely when their customers fall under the law and demand proof of security from them.
What is NIS2?
NIS2 is an EU directive on cybersecurity. In Germany it was transposed into national law by the NIS2 Implementation Act, dated 2 December 2025 (Federal Law Gazette 2025 I No. 301), promulgated on 5 December 2025 and in force since 6 December 2025. Among other things it restructures the BSI Act. The aim is that important companies and institutions protect their systems better against attacks and report significant security incidents. Those affected must register with the Federal Office for Information Security (BSI) no later than three months after they fall under the law (§ 33 BSIG). Significant security incidents must be reported without delay, at the latest within 24 hours of becoming aware (initial report). Within 72 hours a report with a first assessment follows, at the latest one month later a final report (§ 32 BSIG). This reporting obligation applies at the earliest from the establishment of the reporting channel. Violations can be punished with fines: for particularly important entities up to 10 million euros, for important entities up to 7 million euros (for very large groups alternatively a percentage of turnover; § 65 BSIG).
Who is directly affected?
The law distinguishes "particularly important" and "important" entities. What matters are the sector (for example energy, transport, health, digital infrastructure, parts of manufacturing, chemicals or food) and the size. According to § 28 BSIG a company from a covered sector counts as "important" if it employs at least 50 people or has an annual turnover and annual balance sheet total each above 10 million euros. It counts as "particularly important" from at least 250 employees or over 50 million euros annual turnover with at the same time over 43 million euros balance sheet total. Affiliated companies are counted according to EU Recommendation 2003/361/EC, with exceptions. Special rules apply to individual sectors and operators of critical facilities, partly regardless of size.
A one-person business or a trades business with a few employees is as a rule below these sizes. The binding classification nevertheless belongs in the hands of legal counsel. A first, non-binding orientation is offered by the BSI applicability check.
Why small businesses hear about it anyway
Affected companies must also consider the security of the supply chain as part of their risk management, including relationships with direct providers and service providers (§ 30 para. 2 no. 4 BSIG). In practice this means: they ask their suppliers for a minimum level of IT security. This can look like this:
- a questionnaire on passwords, updates, backup and access rights,
- a contract clause that regulates security measures and reporting channels in case of incidents,
- a request for proof, for example regarding data backup or the securing of e-mail and remote access.
Whether and how your customer demands this is their own decision. Legally you as a small business are not automatically obliged, but without proof an order can wobble.
What suppliers can sensibly do now
Most customer questions boil down to basics that apply to every business anyway. A pragmatic start:
- Inventory: which devices, programs, accounts and cloud services do you use? A simple list is enough.
- Updates: keep operating system, browser, router and important programs up to date, ideally automatically. Windows 10 no longer receives regular updates anyway, see Windows 10 end of support.
- Secure access: a separate password per service, password manager, two-factor login for e-mail, cloud and banking.
- Backup: back up data according to the 3-2-1 rule and test the restore once. A backup that has never been tested is a hope.
- E-mail security: recognise phishing, do not open suspicious attachments, briefly raise awareness among employees.
- Limit rights: not everyone needs administrator rights. Block former employees immediately.
- Emergency plan: who is called if something happens? Where are credentials and backups? Write it down on one page.
How to answer customer questions
Answer security questionnaires honestly and concretely. Describe what you do, not what you would like to do. If measures are required that you do not meet, say so openly and name by when you will implement them. Certificates or seals are usually not necessary for small businesses; if the customer demands them, clarify that directly with them. Rather have contracts with security clauses reviewed legally once before you sign.
Where we can help
As an IT service provider from Liebenscheid we look together with you at where your business stands on the basics: updates, access, backup, e-mail, emergency plan. You get an understandable list of what is fine and what should be tackled. Permanently we take over updates, monitoring and data backup as part of IT maintenance at a fixed price or IT support for businesses. A first conversation is free. We do not offer certification or legal advice.
Sources
- Federal Law Gazette 2025 I No. 301: Act implementing the NIS-2 Directive
- § 28 BSIG: Particularly important and important entities (thresholds)
- § 30 BSIG: Risk management measures (incl. supply chain security)
- § 32 BSIG: Reporting obligations (24 hours, 72 hours, one month)
- § 33 BSIG: Registration obligation
- § 65 BSIG: Fine provisions
- BSI: NIS-2 applicability check
Statutory text and deadlines may change (the BSI Act was already amended again after promulgation). Authoritative are the Federal Law Gazette, the current version on gesetze-im-internet.de and the information from the BSI.