NIS2 Software
for compliance and risk management

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It obliges important and essential entities to take risk management measures, to report significant security incidents and to register, and it holds management accountable. In Germany the NIS2 implementation act (German: NIS2-Umsetzungsgesetz) has implemented it in the BSI Act (BSIG), which has applied in its new version since 6 December 2025.

NIS2 software maps the duties of NIS2 in one data model — scope, assets, requirements, risks, measures, security incidents and evidence — and links them to each other. In substance it is ISMS software that comes with the NIS2 requirement catalogue: instead of keeping spreadsheets consistent by hand, you maintain every object once, and reports and dashboards are generated from the data.

Software for NIS2 implementation does not replace the work, it puts it in order: the NIS2 requirements are available as a catalogue, and each one is assessed, justified and backed with evidence. Risks and measures are attached to the assets they concern; deadlines and owners are recorded. This way NIS2 compliance can be documented and the state reported at any time — without anyone merging spreadsheets.

Complaica supports the whole NIS2 implementation: the ten risk management measures under § 30 BSIG; for the types of entity it covers, Implementing Regulation (EU) 2024/2690 with Art. 1–⁠14 and the 13 subject areas of its Annex; the management of security incidents with the reporting deadlines under § 32 BSIG; and the view for management under § 38 BSIG. The catalogues are assessed on your asset tree.

§ 30 BSIG names ten areas that the measures must cover as a minimum: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, security in acquisition, development and maintenance, assessment of effectiveness, training, cryptography, human resources security and access control, and multi-factor authentication and secured communications. The measures must be appropriate, proportionate and effective, and compliance with them must be documented.

It spells out the NIS2 Directive. Art. 1 and 2, together with the Annex, lay down the technical and methodological requirements for the risk management measures; Art. 3 and 4 determine when a security incident counts as significant; Art. 5 to 14 do so for individual types of entity — from DNS service providers through cloud computing and data centre services to trust service providers. The regulation applies directly only to these types of entity.

Implementing Regulation (EU) 2024/2690 applies directly only to the types of entity it names itself: DNS service providers, TLD name registries, cloud computing service providers and data centre service providers, content delivery network (CDN) providers, managed service providers and managed security service providers, providers of online marketplaces, of online search engines and of social networking services platforms, and trust service providers. For all other important and essential entities, the duties from the BSIG apply; the regulation can serve them as orientation, but it is not binding on them.

Under § 32 BSIG, significant security incidents must be reported to the joint reporting office of BSI and BBK: with an early warning, a notification and a final report, and additionally with intermediate reports at the request of the BSI. Complaica manages security incidents with timestamps, owners and deadlines and records every step with author and date. You submit the report itself to the reporting office.

Both deadlines run from the moment the entity becomes aware of a significant security incident. The early warning is due within 24 hours, and within 72 hours the notification, which confirms or updates the initial information. The final report follows no later than one month after that notification; if the incident is still ongoing, a progress report takes its place.

Service providers and suppliers are managed as assets and linked to the business processes and services that depend on them. Per service provider, requirements can be assessed, supplier risks identified and treated, and evidence stored. Dependency graph and matrix show which service depends on which provider.

Under § 38 BSIG, management must implement the risk management measures, oversee their implementation and take part in training regularly. Dashboards and reports in Complaica are therefore designed for the management view: the level of fulfilment, the biggest risks and the open measures on one page.

Every requirement receives an implementation status. Complaica cumulates it bottom-up — from the requirement through the subject area to the organisation — and shows it in dashboards: as an overall value, per subject area, per site and compared with the previous month. The level of fulfilment is an evaluation by Complaica of your own assessments, not a metric defined by an authority.

Applicability follows from sector, size and activity. Covered are entities in the sectors of Annexes 1 and 2 to the BSIG — such as energy, transport, health, digital infrastructure, ICT services or manufacturing — as a rule from 50 employees or more than 10 million euros in annual turnover and annual balance sheet total; some entities fall under it regardless of their size. We will gladly check with you whether your company is affected.

NIS2 is law, ISO 27001 a standard for the ISMS — in substance the two overlap in many topics, from risk management to access control. In Complaica, NIS2 and ISO 27001 are assessed on the same scope model and use the same assets, risks, measures and evidence. The same goes for TISAX, BSI IT-Grundschutz, DORA, GDPR and ISO 22301: what is already documented can — where it fits in substance — be used for every framework it concerns.

It covers a substantial part of the requirements in § 30 BSIG, but replaces neither registration nor the reporting and evidence duties. In Complaica both sets of rules use the same assets, risks, measures and evidence; the gap appears as a list of open requirements.

No. NIS2 is a law, not a certification standard: there is neither an NIS2 certificate for entities nor one for software. The entity must implement the measures and be able to prove that at the request of the supervisory authority; whether the duty is met is judged by the competent authority. Complaica keeps the evidence for that ready on the object it proves.

Yes. Complaica is available as SaaS and on-premises: the SaaS variant is hosted in Germany; on-premises you run the NIS2 compliance software in your own infrastructure. The licence costs the same either way.

Yes. Complaica imports and exports data from and to Excel, over the REST API and from other ISMS tools; migrating your data is free and accompanied by our specialists. So you evaluate the tool on your own data set rather than on demo data.

Over the REST API, asset management and CMDB systems such as i-doit, GLPI, FNT Command and others, as well as Jira, SAP and Microsoft Azure. Application data is available through data marts for external analysis and reporting systems, and an AI assistant can be connected over MCP.

For a defined scope, the first defensible status reports are typically available after a few weeks — depending on existing documentation and available resources. With prepared content and consulting, smaller organisations sit at the lower end.