{"id":31058,"date":"2026-08-04T10:02:10","date_gmt":"2026-08-04T08:02:10","guid":{"rendered":"https:\/\/zmi.de\/nis2-and-access-control-requirements-and-checklist\/"},"modified":"2026-10-23T15:35:37","modified_gmt":"2026-10-23T13:35:37","slug":"nis2-and-access-control-requirements-and-checklist","status":"publish","type":"post","link":"https:\/\/zmi.de\/en\/nis2-and-access-control-requirements-and-checklist\/","title":{"rendered":"NIS2 and Access Control: Requirements and Checklist for Affected Companies"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"31058\" class=\"elementor elementor-31058 elementor-30718\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dad75cf e-flex e-con-boxed e-con e-parent\" data-id=\"dad75cf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-72c525b elementor-widget elementor-widget-text-editor\" data-id=\"72c525b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b style=\"background-color: transparent;\">&nbsp;<br><\/b><b style=\"background-color: transparent;\">&nbsp; &nbsp; &nbsp;NIS2 and Access Control<br\/>    Here&#8217;s what it&#8217;s all about:<\/b><\/p>\n<ul>\n<li><span style=\"background-color: transparent;\">Whether a company is affected depends on the type of organization, the sector <br\/>, and the statutory size thresholds\u2014not solely on the number of employees <br\/>or revenue.<\/span><\/li>\n<li><span style=\"background-color: transparent;\">Suppliers may also be indirectly affected if customers impose NIS2 requirements on their supply chain.<\/span><\/li>\n<li><span style=\"background-color: transparent;\">Access control alone does not make a company NIS2-compliant, but it is an <\/span> <span style=\"background-color: transparent;\">important component of a comprehensive risk management strategy.<\/span><\/li>\n<\/ul>\n<div>\n<p><span style=\"background-color: transparent;\">&nbsp;<\/span><\/p>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4374fd9 e-flex e-con-boxed e-con e-parent\" data-id=\"4374fd9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-02c7895 elementor-widget elementor-widget-text-editor\" data-id=\"02c7895\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 affects numerous medium-sized and large companies in critical and particularly relevant sectors, including energy, healthcare, transportation, digital infrastructure, and parts of the manufacturing industry. In Germany, the requirements have been in effect since December 6, 2025, under the new BSI Act. The required risk management measures also include access control, personnel security, and the protection of critical systems. Digital access control can make a significant contribution in this regard.     <a href=\"https:\/\/zmi.de\/en\/access-control\/\">Here: Access control by ZMI.<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-11cd30c e-flex e-con-boxed e-con e-parent\" data-id=\"11cd30c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a30e88b elementor-widget elementor-widget-heading\" data-id=\"a30e88b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">  NIS2 has been mandatory in Germany since December 2025<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-348631c e-flex e-con-boxed e-con e-parent\" data-id=\"348631c\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3841296 elementor-widget elementor-widget-text-editor\" data-id=\"3841296\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The European NIS2 Directive significantly expands the scope of regulated entities. In Germany, it was implemented through the new BSI Act. This law took effect on December 6, 2025, and distinguishes, in particular, between critical infrastructure entities and important infrastructure entities.  <\/p><p>Companies must <b>verify for themselves whether<\/b> they meet the legal requirements. A specific request from the authorities is generally not required. Instead, affected organizations must register through the BSI portal and report significant security incidents via the designated reporting channels.  <\/p><p>For small and medium-sized enterprises, NIS2 is relevant not only because of the direct regulatory requirements. Even companies that do not themselves fall into any statutory category may be indirectly affected through customer contracts, audits, and security requirements within the supply chain. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0cebc93 e-flex e-con-boxed e-con e-parent\" data-id=\"0cebc93\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2b7f912 elementor-widget elementor-widget-heading\" data-id=\"2b7f912\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83e\uddd0 Impact Check: Which companies are subject to NIS2?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-0b78dca e-flex e-con-boxed e-con e-parent\" data-id=\"0b78dca\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-67fd17c elementor-widget elementor-widget-text-editor\" data-id=\"67fd17c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The extent of the impact cannot be determined solely by the number of employees. The key factor is the combination of: <\/p><p>\ud83e\udd1d the specific type of facility<\/p><p>\ud83e\udd1d the corresponding sector<\/p><p>\ud83e\udd1d Company size<\/p><p>\ud83e\udd1d Possible special provisions<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e3664e2 e-flex e-con-boxed e-con e-parent\" data-id=\"e3664e2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c5f2e20 elementor-widget elementor-widget-heading\" data-id=\"c5f2e20\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Step 1: Does the company fall under a recognized type of institution?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5727817 elementor-widget elementor-widget-text-editor\" data-id=\"5727817\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The BSI Act contains two appendices listing the sectors, industries, and types of facilities covered. It is not sufficient for a company to operate generally in a sector such as \u201cmanufacturing\u201d or \u201cenergy.\u201d What matters is whether its specific activities correspond to a type of facility defined by law.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-59909e6 e-flex e-con-boxed e-con e-parent\" data-id=\"59909e6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t<div class=\"elementor-element elementor-element-21b81bf e-con-full e-flex e-con e-child\" data-id=\"21b81bf\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2feec54 e-n-tabs-mobile elementor-widget elementor-widget-n-tabs\" data-id=\"2feec54\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;horizontal_scroll&quot;:&quot;disable&quot;}\" data-widget_type=\"nested-tabs.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"e-n-tabs\" data-widget-number=\"50261076\" aria-label=\"Tabs. Open items with Enter or Space, close with Escape and navigate using the Arrow keys.\">\n\t\t\t<div class=\"e-n-tabs-heading\" role=\"tablist\">\n\t\t\t\t\t<button id=\"e-n-tab-title-502610761\" data-tab-title-id=\"e-n-tab-title-502610761\" class=\"e-n-tab-title\" aria-selected=\"true\" data-tab-index=\"1\" role=\"tab\" tabindex=\"0\" aria-controls=\"e-n-tab-content-502610761\" style=\"--n-tabs-title-order: 1;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tWaste Management\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610762\" data-tab-title-id=\"e-n-tab-title-502610762\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"2\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610762\" style=\"--n-tabs-title-order: 2;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tWastewater\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610763\" data-tab-title-id=\"e-n-tab-title-502610763\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"3\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610763\" style=\"--n-tabs-title-order: 3;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tBanking\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610764\" data-tab-title-id=\"e-n-tab-title-502610764\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"4\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610764\" style=\"--n-tabs-title-order: 4;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tChemistry\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610765\" data-tab-title-id=\"e-n-tab-title-502610765\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"5\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610765\" style=\"--n-tabs-title-order: 5;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tDigital Providers\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610766\" data-tab-title-id=\"e-n-tab-title-502610766\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"6\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610766\" style=\"--n-tabs-title-order: 6;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tDigital Infrastructure\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610767\" data-tab-title-id=\"e-n-tab-title-502610767\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"7\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610767\" style=\"--n-tabs-title-order: 7;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tEnergy\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610768\" data-tab-title-id=\"e-n-tab-title-502610768\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"8\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610768\" style=\"--n-tabs-title-order: 8;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tFinancial Market Infrastructures\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-502610769\" data-tab-title-id=\"e-n-tab-title-502610769\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"9\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-502610769\" style=\"--n-tabs-title-order: 9;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tResearch\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107610\" data-tab-title-id=\"e-n-tab-title-5026107610\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"10\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107610\" style=\"--n-tabs-title-order: 10;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tHealth Care\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107611\" data-tab-title-id=\"e-n-tab-title-5026107611\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"11\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107611\" style=\"--n-tabs-title-order: 11;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tFood\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107612\" data-tab-title-id=\"e-n-tab-title-5026107612\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"12\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107612\" style=\"--n-tabs-title-order: 12;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tPublic Administration\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107613\" data-tab-title-id=\"e-n-tab-title-5026107613\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"13\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107613\" style=\"--n-tabs-title-order: 13;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tPostal and Courier Services\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107614\" data-tab-title-id=\"e-n-tab-title-5026107614\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"14\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107614\" style=\"--n-tabs-title-order: 14;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tTransportation and Traffic\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107615\" data-tab-title-id=\"e-n-tab-title-5026107615\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"15\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107615\" style=\"--n-tabs-title-order: 15;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tDrinking Water\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107616\" data-tab-title-id=\"e-n-tab-title-5026107616\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"16\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107616\" style=\"--n-tabs-title-order: 16;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tManufacturing Industry\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t<button id=\"e-n-tab-title-5026107617\" data-tab-title-id=\"e-n-tab-title-5026107617\" class=\"e-n-tab-title\" aria-selected=\"false\" data-tab-index=\"17\" role=\"tab\" tabindex=\"-1\" aria-controls=\"e-n-tab-content-5026107617\" style=\"--n-tabs-title-order: 17;\">\n\t\t\t\t\t\t<span class=\"e-n-tab-title-text\">\n\t\t\t\tSpace\t\t\t<\/span>\n\t\t<\/button>\n\t\t\t\t\t<\/div>\n\t\t\t<div class=\"e-n-tabs-content\">\n\t\t\t\t<div id=\"e-n-tab-content-502610761\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610761\" data-tab-index=\"1\" style=\"--n-tabs-title-order: 1;\" class=\"e-active elementor-element elementor-element-e8c4c68 e-con-full e-flex e-con e-child\" data-id=\"e8c4c68\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2578900 elementor-widget elementor-widget-text-editor\" data-id=\"2578900\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: Companies <\/b>whose primary business is waste management<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610762\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610762\" data-tab-index=\"2\" style=\"--n-tabs-title-order: 2;\" class=\" elementor-element elementor-element-d9d48b2 e-con-full e-flex e-con e-child\" data-id=\"d9d48b2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-cec9529 elementor-widget elementor-widget-text-editor\" data-id=\"cec9529\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p>\n<p><b>Typical examples: Operators <\/b>of wastewater treatment facilities<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610763\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610763\" data-tab-index=\"3\" style=\"--n-tabs-title-order: 3;\" class=\" elementor-element elementor-element-3b5078f e-con-full e-flex e-con e-child\" data-id=\"3b5078f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-bf2b5b1 elementor-widget elementor-widget-text-editor\" data-id=\"bf2b5b1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: Financial institutions <\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610764\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610764\" data-tab-index=\"4\" style=\"--n-tabs-title-order: 4;\" class=\" elementor-element elementor-element-8e0b4bd e-con-full e-flex e-con e-child\" data-id=\"8e0b4bd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-530578f elementor-widget elementor-widget-text-editor\" data-id=\"530578f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: Manufacturers <\/b>and importers of certain chemical substances and mixtures<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610765\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610765\" data-tab-index=\"5\" style=\"--n-tabs-title-order: 5;\" class=\" elementor-element elementor-element-853fb2f e-con-full e-flex e-con e-child\" data-id=\"853fb2f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-61123ba elementor-widget elementor-widget-text-editor\" data-id=\"61123ba\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: online marketplaces <\/b>, search engines, social networks<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610766\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610766\" data-tab-index=\"6\" style=\"--n-tabs-title-order: 6;\" class=\" elementor-element elementor-element-2ea2c0e e-con-full e-flex e-con e-child\" data-id=\"2ea2c0e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-35ddbc0 elementor-widget elementor-widget-text-editor\" data-id=\"35ddbc0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: data centers <\/b>, cloud services, DNS services, telecommunications networks<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610767\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610767\" data-tab-index=\"7\" style=\"--n-tabs-title-order: 7;\" class=\" elementor-element elementor-element-f4fa4de e-con-full e-flex e-con e-child\" data-id=\"f4fa4de\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2d29322 elementor-widget elementor-widget-text-editor\" data-id=\"2d29322\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: electricity suppliers <\/b>, grid operators, energy producers, district heating providers<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610768\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610768\" data-tab-index=\"8\" style=\"--n-tabs-title-order: 8;\" class=\" elementor-element elementor-element-455f43f e-con-full e-flex e-con e-child\" data-id=\"455f43f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a5c2666 elementor-widget elementor-widget-text-editor\" data-id=\"a5c2666\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: trading venues <\/b>, central counterparties<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-502610769\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-502610769\" data-tab-index=\"9\" style=\"--n-tabs-title-order: 9;\" class=\" elementor-element elementor-element-3f87bdc e-con-full e-flex e-con e-child\" data-id=\"3f87bdc\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d9b7a57 elementor-widget elementor-widget-text-editor\" data-id=\"d9b7a57\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: designated <\/b>research institutions<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107610\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107610\" data-tab-index=\"10\" style=\"--n-tabs-title-order: 10;\" class=\" elementor-element elementor-element-99bda04 e-con-full e-flex e-con e-child\" data-id=\"99bda04\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6213876 elementor-widget elementor-widget-text-editor\" data-id=\"6213876\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: hospitals <\/b>, laboratories, certain pharmaceutical and medical device companies<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107611\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107611\" data-tab-index=\"11\" style=\"--n-tabs-title-order: 11;\" class=\" elementor-element elementor-element-d8684a1 e-con-full e-flex e-con e-child\" data-id=\"d8684a1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8ede3af elementor-widget elementor-widget-text-editor\" data-id=\"8ede3af\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: certain <\/b>manufacturers, processors, and wholesalers<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107612\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107612\" data-tab-index=\"12\" style=\"--n-tabs-title-order: 12;\" class=\" elementor-element elementor-element-6f3083f e-con-full e-flex e-con e-child\" data-id=\"6f3083f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ef7f2b1 elementor-widget elementor-widget-text-editor\" data-id=\"ef7f2b1\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: in particular <\/b>, federal government agencies<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107613\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107613\" data-tab-index=\"13\" style=\"--n-tabs-title-order: 13;\" class=\" elementor-element elementor-element-793a390 e-con-full e-flex e-con e-child\" data-id=\"793a390\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-75dcd7e elementor-widget elementor-widget-text-editor\" data-id=\"75dcd7e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: Postal service providers <\/b>and courier services<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107614\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107614\" data-tab-index=\"14\" style=\"--n-tabs-title-order: 14;\" class=\" elementor-element elementor-element-fe08b9d e-con-full e-flex e-con e-child\" data-id=\"fe08b9d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ba97169 elementor-widget elementor-widget-text-editor\" data-id=\"ba97169\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical or, in some cases, Other Critical<\/p><p><b>Typical examples: air transport <\/b>, rail transport, shipping, road transport, postal and courier services<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107615\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107615\" data-tab-index=\"15\" style=\"--n-tabs-title-order: 15;\" class=\" elementor-element elementor-element-f08efd4 e-con-full e-flex e-con e-child\" data-id=\"f08efd4\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7af8626 elementor-widget elementor-widget-text-editor\" data-id=\"7af8626\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: Water utilities <\/b><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107616\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107616\" data-tab-index=\"16\" style=\"--n-tabs-title-order: 16;\" class=\" elementor-element elementor-element-a1c18d0 e-con-full e-flex e-con e-child\" data-id=\"a1c18d0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-231ad4e elementor-widget elementor-widget-text-editor\" data-id=\"231ad4e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Other <\/b>Critical Issues<\/p><p><b>Typical examples: selected <\/b>manufacturers, such as those in the mechanical engineering, automotive, or electronics industries<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div id=\"e-n-tab-content-5026107617\" role=\"tabpanel\" aria-labelledby=\"e-n-tab-title-5026107617\" data-tab-index=\"17\" style=\"--n-tabs-title-order: 17;\" class=\" elementor-element elementor-element-66e7901 e-con-full e-flex e-con e-child\" data-id=\"66e7901\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-32b7de6 elementor-widget elementor-widget-text-editor\" data-id=\"32b7de6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><b>Category: Highly <\/b>Critical<\/p><p><b>Typical examples: Operators <\/b>of ground-based infrastructure for space-based services<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-40d71d7 elementor-widget elementor-widget-text-editor\" data-id=\"40d71d7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>\ud83d\udc49 The table is intended only as a general guide. A reliable classification always requires a review of the specific type of facility as defined in Annexes 1 and 2 of the BSI Act. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5aae9d2 e-flex e-con-boxed e-con e-parent\" data-id=\"5aae9d2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3a3441a elementor-widget elementor-widget-heading\" data-id=\"3a3441a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Step 2: Are the size thresholds exceeded?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4ceeefb elementor-widget elementor-widget-text-editor\" data-id=\"4ceeefb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A registered organization as defined in Appendix 1 is generally considered a <b>particularly important<\/b> entity if it:<\/p>\n<p>\u2705 employs at least 250 employees, or<\/p>\n<p>\u2705 Achieved annual revenue of more than 50 million euros and, at the same time, total assets of more than 43 million euros<\/p>\n<p>An organization listed in Appendix 1 or 2 is generally considered a <b>key<\/b> institution if it:<\/p>\n<p>\u2705 employs at least 50 employees, or<\/p>\n<p>\u2705 Achieved annual revenue of more than 10 million euros and, at the same time, total annual assets of more than 10 million euros<\/p>\n<p>The often oversimplified statement \u201cNIS2 applies to companies with ten million euros or more in revenue\u201d is therefore inaccurate. When determining the financial threshold, <b>both<\/b> revenue and total assets must generally be taken into account. <\/p>\n<p>\ud83d\udc49 Different rules may apply in some cases to telecommunications providers, trust service providers, DNS services, and top-level domain registries. Certain types of organizations fall within the scope of these rules regardless of the usual thresholds, or even when the company is smaller. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9909075 e-flex e-con-boxed e-con e-parent\" data-id=\"9909075\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9550c90 elementor-widget elementor-widget-heading\" data-id=\"9550c90\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Step 3: Is there an indirect impact via the supply chain?<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-287b39c elementor-widget elementor-widget-text-editor\" data-id=\"287b39c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A supplier does not automatically become a critical or highly critical infrastructure entity simply because its customer is subject to NIS2.<\/p><p>However, affected companies must explicitly take into account the security of their supply chain and security-related aspects of their collaboration with direct suppliers and service providers. For this reason, NIS2 requirements are increasingly being incorporated into contracts, supplier audits, and information security questionnaires. <\/p><p>\ud83d\udea8 For medium-sized suppliers, this can result in a de facto obligation: Those who cannot demonstrate adequate security measures risk losing orders or having important contracts not renewed.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-036a083 e-flex e-con-boxed e-con e-parent\" data-id=\"036a083\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1005131 elementor-widget elementor-widget-heading\" data-id=\"1005131\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83e\udd14 What does NIS2 require in terms of physical security and access control?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4395dca e-flex e-con-boxed e-con e-parent\" data-id=\"4395dca\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-872b32c elementor-widget elementor-widget-text-editor\" data-id=\"872b32c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 is not merely a set of rules governing firewalls or cybersecurity. The BSI Act requires a cross-threat approach to protect the availability, integrity, and confidentiality of the IT systems, components, and processes in use. <\/p><p>The explicitly mentioned risk management measures include policies for personnel security, access control, and the management of ICT systems. Access control should <b>not<\/b> be understood <b>exclusively<\/b> in physical terms. It also encompasses logical access to applications, systems, and data. However, physical access controls become relevant as soon as unauthorized access to premises could jeopardize the protected IT systems.   <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-db4293a e-flex e-con-boxed e-con e-parent\" data-id=\"db4293a\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-49f5f61 elementor-widget elementor-widget-heading\" data-id=\"49f5f61\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Traceable access logs<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2731b74 elementor-widget elementor-widget-text-editor\" data-id=\"2731b74\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In safety-critical areas, the following should be traceable:<\/p><p>\ud83d\udd35 Which person entered an area<\/p><p>\ud83d\udd35 When entry occurred<\/p><p>\ud83d\udd35 Which account was used<\/p><p>\ud83d\udd35 whether an access attempt was denied<\/p><p>These logs support both the prevention and the subsequent reconstruction of a security incident. The retention period and access to the logs must be justified and limited in accordance with data protection laws. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4095c96 e-flex e-con-boxed e-con e-parent\" data-id=\"4095c96\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9e9b9a9 elementor-widget elementor-widget-heading\" data-id=\"9e9b9a9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Role-Based Access Rights<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae90818 elementor-widget elementor-widget-text-editor\" data-id=\"ae90818\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Blanket access permissions based on the principle that \u201call employees have access everywhere\u201d are hardly compatible with a risk-based security approach. Access rights should be determined by job function, area of responsibility, work location, and actual need. Examples include:  <\/p><p>\ud83d\udd35 IT administrators are granted access to the server room<\/p><p>\ud83d\udd35 Production employees may only enter designated production areas<\/p><p>\ud83d\udd35 External technicians are granted temporary access permissions<\/p><p>\ud83d\udd35 Employees who have left the company are immediately blocked<\/p><p>\ud83d\udd35 Protection of particularly critical areas<\/p><p>A higher level of protection is particularly advisable in the following areas:<\/p><p>\ud83d\udd35 Server and equipment rooms<\/p><p>\ud83d\udd35 Network Splitter<\/p><p>\ud83d\udd35 Control Rooms<\/p><p>\ud83d\udd35 Production Control Systems<\/p><p>\ud83d\udd35 Rooms with security and backup systems<\/p><p>\ud83d\udd35 Archives containing security-related documents<\/p><p>A mechanical key can restrict access, but it usually does not provide reliable evidence of who actually entered a room and when. Whether a digital system is necessary depends on the specific risk. For critical areas, it generally offers better control and audit trail capabilities.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e7d9a81 e-flex e-con-boxed e-con e-parent\" data-id=\"e7d9a81\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-b3f9ef6 elementor-widget elementor-widget-heading\" data-id=\"b3f9ef6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Rapid Response to Security Incidents<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b3563f6 elementor-widget elementor-widget-text-editor\" data-id=\"b3563f6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>If there is suspicion of compromised access cards, lost transponders, or unauthorized access, it must be possible to revoke access privileges at short notice. Digital systems allow for centralized revocation without having to replace entire locking systems. <\/p><p>However, access control alone does not make a company NIS2-compliant. It is one component of a comprehensive risk management strategy that includes, among other things, incident response, backup management, supply chain security, training, cryptography, and multi-factor authentication. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e66f05e e-flex e-con-boxed e-con e-parent\" data-id=\"e66f05e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-421286c elementor-widget elementor-widget-heading\" data-id=\"421286c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83c\udd98 Reporting Requirements for Security Incidents<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-3c98b4f e-flex e-con-boxed e-con e-parent\" data-id=\"3c98b4f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-741f81f elementor-widget elementor-widget-text-editor\" data-id=\"741f81f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A significant security incident must generally be reported in several stages:<\/p><p>\ud83d\udca5 Within 24 hours: initial report<\/p><p>\ud83d\udca5 Within 72 hours: detailed incident report<\/p><p>\ud83d\udca5 No later than one month after the incident is reported: a closure report or a progress report if the incident is still ongoing<\/p><p>The 24- and 72-hour time limits begin when the significant security incident is discovered.<\/p><p>Unauthorized access is not automatically reportable. However, it can trigger a significant security incident if, for example, it results in the tampering of production control systems, the shutdown of systems, the theft of data, or the disruption of essential services. <\/p><p>\ud83d\udc49 In this case, analyzable access data helps reconstruct the sequence of events, identify the affected areas, and present the impact to the BSI in a transparent manner.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-90ec33d e-flex e-con-boxed e-con e-parent\" data-id=\"90ec33d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9b68d3b elementor-widget elementor-widget-heading\" data-id=\"9b68d3b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83d\udc54 Sanctions and Management Responsibility<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-729523e e-flex e-con-boxed e-con e-parent\" data-id=\"729523e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-75e7001 elementor-widget elementor-widget-text-editor\" data-id=\"75e7001\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Violations of risk management, documentation, or reporting requirements can result in <b>substantial fines<\/b>.<\/p><p>For particularly important organizations, the German BSI Act provides for fines of <b>up to 10 million euros<\/b> for certain violations. For companies with total global revenue exceeding 500 million euros, a fine of <b>up to 2 percent of global annual revenue<\/b> may be imposed instead. <\/p><p>For major organizations, fines for such violations can be as high as seven million euros. For companies with global annual revenue exceeding 500 million euros, fines can amount to up to 1.4 percent of annual revenue. <\/p><p>Management must implement the required risk management measures and monitor their implementation. In the event of culpable breaches of duty, management may be liable to its own organization in accordance with the applicable corporate law provisions. In addition, management is required to undergo regular training.  <\/p><p>The BSI is generally the central supervisory authority for important and particularly important facilities in Germany.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-383ff3f e-flex e-con-boxed e-con e-parent\" data-id=\"383ff3f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-80d0100 elementor-widget elementor-widget-heading\" data-id=\"80d0100\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\u270d\ufe0f Practical Implementation with Access Control Software<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b43616b e-flex e-con-boxed e-con e-parent\" data-id=\"b43616b\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ef867e5 elementor-widget elementor-widget-text-editor\" data-id=\"ef867e5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>An access control system should do more than just open and close doors. The following functions are particularly important for a risk-based security strategy: <\/p><p>\u2705 Custom and role-based permissions<\/p><p>\u2705 Time-limited access rights<\/p><p>\u2705 Centralized blocking of lost identification cards<\/p><p>\u2705 Traceable logging<\/p><p>\u2705 Quick analysis of security incidents<\/p><p>\u2705 Documented changes to permissions<\/p><p>\u2705 Separation of particularly critical security areas<\/p><p>Combining access control and time tracking can also offer organizational benefits. Master data and permissions do not need to be maintained in separate systems. An employee\u2019s hire, department transfer, or resignation can be processed in a consistent manner.    <a href=\"https:\/\/zmi.de\/en\/access-control\/\">Learn more.<\/a><\/p><p>\ud83d\udc49 Access and working-time data must continue to be processed for specific purposes. Technical integration does not automatically justify every type of analysis. Role-based access controls and data deletion policies, as well as the involvement of data protection officers and, where applicable, the works council, remain necessary.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-da6599d e-flex e-con-boxed e-con e-parent\" data-id=\"da6599d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4e66227 elementor-widget elementor-widget-heading\" data-id=\"4e66227\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\u2705 Checklist: Is your company affected by NIS2?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-70d0abb e-flex e-con-boxed e-con e-parent\" data-id=\"70d0abb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-102c874 elementor-widget elementor-widget-text-editor\" data-id=\"102c874\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>1\ufe0f\u20e3 Determine whether the specific activity corresponds to a type of facility listed in Annex 1 or 2 of the BSI Act<\/p><p>2\ufe0f\u20e3 Determine the number of employees, annual revenue, and total assets based on the statutory criteria<\/p><p>3\ufe0f\u20e3 Review special regulations for telecommunications, DNS, trust services, or critical infrastructure<\/p><p>4\ufe0f\u20e3 Record the direct and indirect requirements of key customers and clients<\/p><p>5\ufe0f\u20e3 Designate a person responsible for NIS2 and information security<\/p><p>6\ufe0f\u20e3 Fully document risk management measures<\/p><p>7\ufe0f\u20e3 Identify Critical Areas and Physical Access Risks<\/p><p>8\ufe0f\u20e3 Assign access rights based on roles and review them regularly<\/p><p>9\ufe0f\u20e3 Establish a reporting process for significant security incidents with 24- and 72-hour deadlines<\/p><p>\ud83d\udd1f Check registration requirements and reporting options on the BSI portal<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e799a8d e-flex e-con-boxed e-con e-parent\" data-id=\"e799a8d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-40b3437 elementor-widget elementor-widget-heading\" data-id=\"40b3437\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83e\udd13 Conclusion: Access Control as Part of a Comprehensive Security Strategy<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e53b86d e-flex e-con-boxed e-con e-parent\" data-id=\"e53b86d\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8f4800c elementor-widget elementor-widget-text-editor\" data-id=\"8f4800c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>NIS2 requires affected companies to implement a documented, risk-based security management system. In addition to traditional IT security, this also addresses the question of who has physical access to critical systems and areas. <\/p><p>Digital access control can manage access permissions in a traceable manner, make it possible to reconstruct security incidents, and simplify the process of providing evidence to customers, auditors, and regulatory authorities. However, it <b>does not replace<\/b> <b>either<\/b> the impact assessment <b>or<\/b> a comprehensive information security strategy. <\/p><p>Even small and medium-sized businesses that are not directly subject to regulation should assess what requirements their key customers will place on suppliers in the future. Particularly in the energy, healthcare, transportation, public administration, and industrial production sectors, information security is increasingly becoming a prerequisite for long-term business relationships. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4796fe2 e-flex e-con-boxed e-con e-parent\" data-id=\"4796fe2\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7414275 elementor-widget elementor-widget-heading\" data-id=\"7414275\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">\ud83d\udca1FAQ: NIS2 and Access Control<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-8c24aa1 e-flex e-con-boxed e-con e-parent\" data-id=\"8c24aa1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f350498 elementor-widget elementor-widget-n-accordion\" data-id=\"f350498\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;default_state&quot;:&quot;expanded&quot;,&quot;max_items_expended&quot;:&quot;one&quot;,&quot;n_accordion_animation_duration&quot;:{&quot;unit&quot;:&quot;ms&quot;,&quot;size&quot;:400,&quot;sizes&quot;:[]}}\" data-widget_type=\"nested-accordion.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"e-n-accordion\" aria-label=\"Accordion. Open links with Enter or Space, close with Escape, and navigate with Arrow Keys\">\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2550\" class=\"e-n-accordion-item\" open>\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"1\" tabindex=\"0\" aria-expanded=\"true\" aria-controls=\"e-n-accordion-item-2550\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> When does NIS2 become mandatory in Germany? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2550\" class=\"elementor-element elementor-element-d95abf6 e-con-full e-flex e-con e-child\" data-id=\"d95abf6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3038d42 elementor-widget elementor-widget-text-editor\" data-id=\"3038d42\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The German NIS2 Implementation Act and the new BSI Act contained therein entered into force on December 6, 2025. The statutory registration, risk assessment, and reporting requirements are therefore already in effect. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2551\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"2\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-2551\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> Are small craft businesses affected if they work for a NIS2 company? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2551\" class=\"elementor-element elementor-element-fa80403 e-con-full e-flex e-con e-child\" data-id=\"fa80403\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ff25618 elementor-widget elementor-widget-text-editor\" data-id=\"ff25618\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Not automatically. However, they may be contractually obligated to implement security measures because regulated customers must secure their supply chain. This results in an indirect, economically significant impact.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2552\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"3\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-2552\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> Is a conventional locking system sufficient? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2552\" class=\"elementor-element elementor-element-186627e e-con-full e-flex e-con e-child\" data-id=\"186627e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-676a976 elementor-widget elementor-widget-text-editor\" data-id=\"676a976\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>That depends on the security requirements. NIS2 does not mandate a specific electronic locking system across the board. However, for server rooms or production control systems, a digital access control system may be required or at least appropriate because it allows for individual access rights, access restrictions, and traceable logs.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2553\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"4\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-2553\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> What is the difference between facilities of particular importance and important facilities? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2553\" class=\"elementor-element elementor-element-cb7e8a6 e-flex e-con-boxed e-con e-child\" data-id=\"cb7e8a6\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7e048e elementor-widget elementor-widget-text-editor\" data-id=\"d7e048e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The categories differ primarily based on the type of institution and the size of the company. Institutions deemed particularly important are subject to more intensive oversight and, in some cases, higher fines. However, the <b>basic obligations<\/b> regarding risk management and incident reporting <b>apply to<\/b> <b>both<\/b> categories.  <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2554\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"5\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-2554\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> Does an affected company have to register itself? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2554\" class=\"elementor-element elementor-element-b5db1a1 e-flex e-con-boxed e-con e-child\" data-id=\"b5db1a1\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-24e0818 elementor-widget elementor-widget-text-editor\" data-id=\"24e0818\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Yes, affected organizations must actively register through the BSI portal. Companies should not wait to be contacted individually by the BSI. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t\t<details id=\"e-n-accordion-item-2555\" class=\"e-n-accordion-item\" >\n\t\t\t\t<summary class=\"e-n-accordion-item-title\" data-accordion-index=\"6\" tabindex=\"-1\" aria-expanded=\"false\" aria-controls=\"e-n-accordion-item-2555\" >\n\t\t\t\t\t<span class='e-n-accordion-item-title-header'><div class=\"e-n-accordion-item-title-text\"> How are NIS2 and ISO 27001 related? <\/div><\/span>\n\t\t\t\t\t\t\t<span class='e-n-accordion-item-title-icon'>\n\t\t\t<span class='e-opened' ><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-minus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h384c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t\t<span class='e-closed'><svg aria-hidden=\"true\" class=\"e-font-icon-svg e-fas-plus\" viewBox=\"0 0 448 512\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M416 208H272V64c0-17.67-14.33-32-32-32h-32c-17.67 0-32 14.33-32 32v144H32c-17.67 0-32 14.33-32 32v32c0 17.67 14.33 32 32 32h144v144c0 17.67 14.33 32 32 32h32c17.67 0 32-14.33 32-32V304h144c17.67 0 32-14.33 32-32v-32c0-17.67-14.33-32-32-32z\"><\/path><\/svg><\/span>\n\t\t<\/span>\n\n\t\t\t\t\t\t<\/summary>\n\t\t\t\t<div role=\"region\" aria-labelledby=\"e-n-accordion-item-2555\" class=\"elementor-element elementor-element-fd785bb e-flex e-con-boxed e-con e-child\" data-id=\"fd785bb\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5768d1a elementor-widget elementor-widget-text-editor\" data-id=\"5768d1a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>ISO 27001 provides a structured information security management system (ISMS) and can support many of the organizational foundations for NIS2. However, certification does not automatically replace the statutory impact assessment or the fulfillment of all obligations under the BSI Act. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/details>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ffacaa0 e-flex e-con-boxed e-con e-parent\" data-id=\"ffacaa0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-fcbf039 elementor-author-box--layout-image-left elementor-author-box--align-left elementor-widget elementor-widget-author-box\" data-id=\"fcbf039\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"author-box.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-author-box\">\n\t\t\t\t\t\t\t<a href=\"https:\/\/www.linkedin.com\/in\/jonathanmartinde\/\" class=\"elementor-author-box__avatar\" rel=\"nofollow noopener\" target=\"_blank\">\n\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/zmi.de\/wp-content\/uploads\/2026\/08\/1781093634806-300x300.jpeg\" alt=\"Picture of Jonathan Martin\" loading=\"lazy\">\n\t\t\t\t<\/a>\n\t\t\t\n\t\t\t<div class=\"elementor-author-box__text\">\n\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/www.linkedin.com\/in\/jonathanmartinde\/\" rel=\"nofollow noopener\" target=\"_blank\">\n\t\t\t\t\t\t<h4 class=\"elementor-author-box__name\">\n\t\t\t\t\t\t\tJonathan Martin\t\t\t\t\t\t<\/h4>\n\t\t\t\t\t<\/a>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-author-box__bio\">\n\t\t\t\t\t\t<p>Jonathan Martin is a managing partner at ZMI GmbH. For many years, he has been working in the fields of time tracking, HR software, access control, and the digitization of HR processes. In his articles, he provides practical insights into current developments, legal requirements, and digital solutions for businesses.  <\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>&nbsp;&nbsp; &nbsp; &nbsp;NIS2 and Access Control Here&#8217;s what it&#8217;s all about: Whether a company is affected depends on the type of organization, the sector , and the statutory size thresholds\u2014not solely on the number of employees or revenue. Suppliers may also be indirectly affected if customers impose NIS2 requirements on their supply chain. Access control [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":31049,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,157],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general","category-hr-know-how-2"],"acf":[],"_links":{"self":[{"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":3,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"predecessor-version":[{"id":31900,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/posts\/31058\/revisions\/31900"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/media\/31049"}],"wp:attachment":[{"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zmi.de\/en\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}