NIS2 Directive (EU) 2022/2555

That depends on sector and size. Directive (EU) 2022/2555 applies to public or private entities of a type referred to in Annex I or II that are at least medium-sized enterprises. Annex I covers, among others, energy, transport, health and water, Annex II among others manufacturing, for instance mechanical engineering. Managed service providers are also covered.

In Germany, the new BSI Act has implemented the Directive. It was promulgated on 5 December 2025 (2025 I No. 301) and has applied since the following day. Section 28 distinguishes two groups. The German Act calls essential entities “besonders wichtige Einrichtungen”. They include companies in the sectors of Annex 1 with at least 250 employees, or with an annual turnover above 50 million euros and a balance sheet total above 43 million euros. Important entities are companies in the sectors of Annexes 1 and 2 with at least 50 employees, or with annual turnover and balance sheet total each above 10 million euros. Anyone covered must register with the BSI under section 33 within three months at the latest.

Three checks are enough to start: assigning your main activity to a type of entity in the annexes, the number of employees together with turnover and balance sheet total, and the state of the registration. Put the result in writing in the compliance file.

For covered entities, service companies with remote access are part of the supply chain, and the supply chain is on the mandatory list. Under Article 21 of the Directive, essential and important entities must take appropriate and proportionate measures that include at least supply chain security, including the relationships with direct suppliers or service providers. In choosing measures, they must take into account under Article 21(3) the vulnerabilities specific to each direct supplier and the cybersecurity practices of their suppliers.

In Germany this is in section 30 of the BSI Act. The measures are to meet the state of the art and must be documented. They include security in the acquisition, development and maintenance of IT systems including vulnerability management, as well as concepts for access control and multi-factor authentication. A remote maintenance access touches every one of these points.

In practice, the operator needs an inventory of which service company may access which plant by which route, who enables the accesses and how access is logged. A permanently open VPN connection that several technicians use with a shared account is hard to square with the requirements on access control and multi-factor authentication. This is shaped through the service contract and technical rules, such as enabling access for a limited time per job. vi shows for each asset which service company has remote access.

Not merely because it is a service provider to a covered operator. The duties attach to the entity itself, to its sector and size. A company offering maintenance and installation of machinery is not in the annexes of the Directive with that activity. Annex II lists the manufacture of machinery (division 28 of the NACE classification) under manufacturing, but not repair and installation (division 33). The service company can still be covered if it also manufactures machinery, operates in another sector listed in the annexes, or counts as a managed service provider.

The Directive defines a managed service provider as an entity providing services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, on customers' premises or remotely. Managed service providers are in Annex I. If you permanently operate or remotely maintain customers' IT or control-system infrastructure, check whether the description fits your offering and, at the required size, register with the BSI.

Independently of that, the service company is bound by contract. Covered customers are likely to pass security requirements on to it, even though the law does not apply to it directly.

Covered entities must report significant incidents in stages. Under Article 23(4) of the Directive, an early warning is due within 24 hours of becoming aware, a notification with an initial assessment within 72 hours, an intermediate report on request of a CSIRT, and a final report not later than one month after the notification. In Germany section 32 of the BSI Act governs this. Reports go to a joint reporting office run by the BSI and the Federal Office of Civil Protection and Disaster Assistance.

An incident is significant if it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or if it has affected or is capable of affecting other persons by causing considerable material or non-material damage.

The CRA brings a second, separate reporting duty. Since 11 September 2026, the manufacturer of a product with digital elements must report actively exploited vulnerabilities and severe incidents, with the same deadlines of 24 and 72 hours. A vulnerability in a gateway can therefore set off two reporting chains: the manufacturer reports through the ENISA platform, the affected operator to the BSI. Contracts should therefore settle who informs whom, and how quickly, about incidents involving plants and remote access.

Responsibility lies with the leadership. Under Article 20 of the Directive, the management bodies of essential and important entities must approve the risk-management measures, oversee their implementation and can be held liable for infringements. The German Act implements this in section 38 of the BSI Act. The management must implement the measures and oversee their implementation. If it culpably breaches this duty, it is liable to the entity for the damage caused under the rules of company law. Under the BSI Act itself, it is liable only if company law contains no liability rule.

There is also a training duty: managements must take part in training regularly in order to assess risks and risk-management practices in IT security and to judge their effect on the services provided. Delegating to the IT department does not release them from it.

For violations, section 65 of the BSI Act provides for fines. For essential entities the range reaches up to ten million euros, for important entities up to seven million euros. For companies with a total turnover above 500 million euros, a percentage of turnover, up to 2 and 1.4 percent respectively, can be applied in certain cases. The Directive prescribes a maximum of at least 10 million euros or 2 percent of worldwide annual turnover for essential entities and at least 7 million euros or 1.4 percent for important ones, whichever is higher.

An operator cannot pass its duties on to the service company, but it can secure them with it. Section 30 of the BSI Act requires measures that meet the state of the art and must be documented. From the list in paragraph 2, two items are most relevant for remote maintenance: security measures in the acquisition, development and maintenance of IT systems including vulnerability management, and multi-factor authentication and secured communication. Access control and supply chain security come on top.

A catalog for the contract follows: which accesses are used, over which connection and with what authentication, personal instead of shared accounts, access enabled for a limited time per job, logging of sessions and how long the logs are kept, duties in security incidents with reporting deadlines that fit the operator's own 24 and 72 hours, evidence of the service company's training and security measures, and the operator's right to block accesses immediately. For changes to safety controllers, the rules of the Machinery Regulation apply as well.

Termination and liability rules belong there too, in case the service company does not meet the security requirements. When reviewing existing service contracts, start with the remote access clauses, because that is where details on authentication and logs are missing most often.