Home / Notes

Regulation · IT security · SMEs

NIS2 for small IT companies and freelancers: thresholds, deadlines, duties

The German NIS2 implementation act has been in force since 6 December 2025. Whether a company is directly affected depends on sector and size – but small firms feel it as suppliers too.

Serge Zabolotny · 2026-10-27

• NIS2
• IT-Sicherheit
• BSI
• Compliance
• Backup
• Lieferkette

The key facts

Important: size alone does not decide. Only the combination of a threshold and a sector makes a company a regulated entity. When unsure, the BSI’s self-assessment helps – and, if in doubt, legal advice.

And if I am below the thresholds?

A freelancer or micro-company is usually below 50 employees and therefore not directly affected – that is my reading of the thresholds, not legal advice. NIS2 still becomes noticeable through the supply chain: affected customers have to keep an eye on risks at their service providers and will ask for evidence, for example on access control, backups and incident handling. A commentary on the draft bill (usd, 2024) explicitly lists supply-chain security, vulnerability handling, backup and business continuity, access control and multi-factor authentication among the measures; whether the final wording says the same should be checked in the law.

Practical evidence worth having anyway

• Backups with a tested restore: see backup the 3-2-1 way and the restore test.
• Access control and multi-factor login: how I do it in the homelab, see zero trust for the homelab.
• Traceable delivery: a documented CI/CD pipeline shows how changes reach production.
• A plan for security incidents: who is informed when? Closely related to the CRA reporting duty.

Sources and limits

• ADVISORI: NIS2 implementation act (consultancy blog; entry into force, thresholds, deadlines, fines)
• usd: NIS-2, the key points (commentary on the 2024 draft, used only for the list of measures)
• The Federal Law Gazette is binding; neither source is an official text.

Keep reading