NIS2 does not end when the gaps have been identified.
Germany's revised BSI Act (BSIG) has been in force since 6 December 2025.
An assessment can tell you what is missing.
Management still has to decide what matters first, who owns the response and how it will know that the required measures are actually being implemented.
I help organisations turn NIS2 requirements into clear management responsibility, accountable ownership, prioritised action and evidence of oversight.
Independent advice · Management-focused · Business-first
The assessment is finished. Now the difficult part starts.
There are findings across security, suppliers, incident response, continuity and access.
Some require investment.
Some require new ownership.
Some cross several departments.
Management asks a reasonable question:
What do we need to do first?
Who is responsible for getting it done?
How do we know it has actually happened?
That is the difference between identifying an NIS2 gap and governing the response to it.
NIS2 is not only an IT implementation exercise.
For important and particularly important entities under the German BSI Act, management has explicit responsibilities.
Section 38 requires management to implement the risk-management measures required under Section 30 and monitor their implementation. It also requires management to participate regularly in training sufficient to recognise and assess cybersecurity risks and understand their impact on the services the organisation provides.
That changes the leadership question.
It is no longer enough to ask:
“Has IT dealt with NIS2?”
Management needs sufficient visibility to understand:
- what material risks remain,
- which measures are being implemented,
- who owns them,
- where progress is blocked,
- and when a decision needs to come back to leadership.
The technical work matters.
So does the governance around it.
Start with what the business needs to keep working.
Section 30 requires appropriate, proportionate and effective technical and organisational risk-management measures.
The law covers areas including risk analysis, incident handling, business continuity and crisis management, supply-chain security, effectiveness reviews, training, access control and authentication. Organisations must also document compliance with the obligation to implement the required measures.
But a list of requirements does not tell leadership which weakness matters most to this organisation.
I start with questions such as:
Which services cannot tolerate prolonged disruption?
Which suppliers could stop them?
Where is risk concentrated?
Which weaknesses create the greatest business exposure?
Which decisions need management involvement?
Then the regulatory requirements provide structure around those answers.
The framework should inform the decision. It should never become the decision.
From NIS2 findings to governed action.
Scope & Applicability
Establish whether the organisation is in scope under the current German BSI Act and what follows from that classification. Scope depends on sector, entity type, size and statutory exceptions. Scope should be determined by reference to Section 28, not reduced to a generic employee-count checklist.
Management Governance
Translate regulatory obligations into something leadership can actually oversee. That means making clear what management needs visibility of, which responsibilities sit where, what needs escalation and how implementation will be monitored.
Prioritised Remediation
A long findings register is not a strategy. I help separate what is urgent from what is merely unfinished, connect remediation to business impact and establish a sequence the organisation can realistically execute.
Ownership & Accountability
A control without an owner tends to remain a finding. For material actions, establish who owns the business risk, who is responsible for implementation, who can make the required decision and what evidence shows that action has been completed.
Evidence & Oversight
NIS2 readiness should be evident in practice, not merely stated in policy. I help establish the management information, governance rhythm and evidence needed to show that important measures are being implemented and monitored.
Typical engagements
- NIS2 Governance Readiness Review: A structured assessment of management responsibility, ownership, implementation governance and the evidence available to demonstrate oversight.
- Executive NIS2 Governance Workshop: A focused session to clarify management’s role, the information it needs and the appropriate oversight and escalation paths.
- Prioritised NIS2 Implementation Roadmap: A sequenced plan covering priorities, owners, required decisions and supporting evidence.
A findings register does not create a list of priorities.
A readiness review identifies issues across suppliers, technology, processes and governance.
Several require investment.
Others depend on the same people.
Some can be addressed quickly.
Others require leadership to accept a trade-off.
The budget and delivery capacity will not cover everything at once.
The organisation now has a prioritisation problem, not an assessment problem.
Leadership needs to understand which exposures could materially affect the business, which actions reduce material risk most effectively and which decisions cannot wait.
That is where a compliance exercise becomes a management decision.
Some NIS2 obligations are already time-bound.
Registration is not something to defer.
Under Section 33, particularly important and important entities generally must register with the BSI within three months of first qualifying—or qualifying again—as one of those entities. For organisations already in scope when the revised BSIG took effect, that initial statutory window has passed. Organisations that newly become subject to the law continue to have the statutory three-month period.
The BSI provides the BSI Portal for NIS2 registration and incident reporting.
For significant security incidents, Section 32 establishes a staged reporting process:
- an early notification within 24 hours of becoming aware of a significant security incident,
- a fuller incident notification within 72 hours,
- and ordinarily a final report no later than one month after the 72-hour notification.
Those deadlines make one governance question especially important:
Who knows when the clock has started?
Reporting readiness therefore belongs in the operating model, not in a document somebody searches for after an incident begins.
The goal is not to turn NIS2 into another programme nobody owns.
I begin with what already exists.
- Existing security controls.
- Existing risk management.
- Existing incident processes.
- Existing supplier governance.
- Existing management reporting.
Then we identify what can be strengthened, what is genuinely missing and where a decision or named owner is still needed.
Depending on the situation, the work may result in:
- a readiness assessment,
- a prioritised remediation roadmap,
- a management briefing,
- a clear ownership structure,
- a governance cadence,
- a decision and escalation model,
- an evidence map,
- or an executive tabletop exercise.
The deliverable follows the decision. Not the other way around.
Management can see where the organisation stands without becoming the security team.
The organisation understands whether it is in scope.
Material gaps have named owners.
Actions are prioritised according to business risk rather than checklist order.
Leadership receives information it can actually use.
Incident-reporting responsibilities are understood before an incident occurs.
Important suppliers and dependencies are visible.
Progress can be demonstrated.
And when management asks:
“Are we doing what we said we would do?”
there is evidence behind the answer.
Governance has to survive contact with the business.
My work focuses on the space between technical requirements and management decisions.
I bring more than 20 years of experience across technology, security and leadership, including over a decade supporting operations for the Defense Commissary Agency (DeCA), a component of the U.S. Department of Defense.
I am a CISM, ISACA author and two-time Cyber Leadership Institute Capstone Winner, having won both its Cyber Leadership Program and Cyber Strategy & Transformation Program Capstones.
More About André →If you know the gaps but not the next decision, start there.
You may already have:
- an assessment,
- a risk register,
- an audit report,
- or an internal NIS2 programme.
If the remaining problem is deciding what matters first, who owns it and how management should oversee progress, that is a useful place for us to begin.
No generic compliance presentation. A practical conversation about the decisions, ownership and evidence behind your NIS2 readiness.