“More new requirements,” some will sigh. Others are already one step ahead and recognize the opportunities these cyber regulations bring. Because when it comes to security, there is really no such thing as too much of it. We want to give you key insights into NIS2 and the Cyber Resilience Act—and show you how to integrate these new compliance burdens into your strategy.
A framework for protection and trust
With the NIS2 Directive and the Cyber Resilience Act, the EU has adopted two major regulatory frameworks. Both require companies to raise their cybersecurity measures to a new level—or, in some cases, to begin approaching risks in a more structured way at all. Both aim to reduce attack surfaces, secure infrastructure, and create greater transparency—one with a broader, more general scope, the other with a stronger focus on the software supply chain.
The intended result of these tighter requirements is clear: digital resilience. It is understandable that many decision-makers view the growing workload critically. In the end, however, these regulations are a gift. They help make our society—and the companies within it—better protected against cyberattacks, which, if successful, cost not only time but also a great deal of money. According to the German Federal Office for Information Security (BSI), based on several studies, the costs per incident range from €20,000 to €150,000.
NIS2 – stricter security requirements for more companies
The revised NIS2 Directive (EU 2022/2555) replaces the previous NIS Directive and introduces stricter cybersecurity requirements. The directive entered into force at the beginning of 2023, and EU member states were required to transpose it into national law by October 2024. With it, Brussels aims to strengthen cybersecurity across Europe and harmonize requirements. And yes—national implementation is lagging behind, and Germany is already beyond the formal deadline.
Under the EU Directive on Network and Information Security, as NIS2 is formally called, companies need to pay attention to several key points:
- Expanded scope:
The number of affected sectors increases to 18, including 11 critical sectors (such as energy and healthcare) and 7 important sectors (such as telecommunications and logistics). - Broader company coverage:
Companies with more than 50 employees or annual turnover above EUR 10 million also fall under the directive. - Size-independent regulation for certain operators:
Some operators, such as parts of the digital infrastructure and the public administration sector, are regulated regardless of their size. - Stricter security requirements:
Companies must introduce more comprehensive security measures, including regular risk analyses, stronger protection against cyberattacks, and detailed monitoring and reporting processes. - Tighter incident reporting obligations:
Security incidents must be reported without undue delay, with an early warning no later than 24 hours after detection. A detailed report must follow within 72 hours. - Stronger enforcement and higher penalties:
National regulatory authorities are given broader powers, and violations may lead to significant penalties.
This means that Germany’s Mittelstand—so important for Germany and Central Europe—remains very much in scope. And for companies without a security strategy and without sustainable concepts, that means a substantial amount of work lies ahead.
Cyber Resilience Act – security from the start
The Cyber Resilience Act, or CRA, is aimed at manufacturers of digital products and places a particular focus on the resilience of the software supply chain. Its goal is to prevent security vulnerabilities during development and to keep products secure throughout their entire lifecycle.
Some of the key elements of the Cyber Resilience Act include:
- Expanded scope:
The CRA applies to manufacturers of digital products such as hardware, software, and IoT devices, as well as importers of white-label goods. Medical devices and automotive safety systems are excluded. - Mandatory cybersecurity:
Manufacturers must integrate security features already during development (security by design) and meet cybersecurity requirements throughout production, marketing, and product use. - Security updates and monitoring:
Products must be monitored for at least five years, and manufacturers are required to provide free updates to address security vulnerabilities. - Incident reporting obligations:
Security incidents affecting a product must be reported to the EU cybersecurity agency ENISA. - Conformity procedures for critical products:
Products such as password managers, VPNs, or IoT devices are subject to a special assessment procedure before they can enter the market with a CE mark.
Given the specific realities of the German Mittelstand—with its wide range of cyber-physical systems involving production machines and the related or embedded software—companies in mechanical engineering, plant engineering, electronics, and electrical engineering are particularly in focus.
Recognizing and using the opportunity
With the NIS2 Directive and the Cyber Resilience Act, the EU has created a framework for stronger cybersecurity across Europe. Companies should use this opportunity not only to comply with legal requirements, but also to actively improve their digital resilience. Those who invest early protect not only their IT systems, but also strengthen the trust of customers and partners in secure, reliable collaboration.