The sector covers electricity, district heating, oil, gas and hydrogen. How strict the obligations become depends on company size. For KRITIS operators, the German threshold regulation and BSIG obligations add up. OdySecure, the security platform by Cybervize, covers ISMS, OT assessment and KRITIS reporting in one solution.
Book the NIS-2 risk checkStandard case under § 28 of the German BSIG. "Wichtige Einrichtung" is the standard tier, "besonders wichtige Einrichtung" the stricter tier; the figures are annual values. Calculating them in annual work units, attributing partner and linked enterprises, special cases and the final classification under German law all require a case-by-case legal review. The reporting deadlines require a significant incident (§ 32 BSIG). The exception: §§ 30, 31, 32, 35, 36, 38, 39, 61 and 62 BSIG do not apply to energy supply networks, energy installations and digital energy services subject to §§ 5c to 5e of the EnWG, the German energy industry act, and only for those activities; where operating an energy installation is a mere ancillary activity, the exception does not apply.
Few sectors carry as many parallel rulebooks. Grid operation, metering and the protection of critical assets each follow their own system. In OdySecure they sit in one catalogue instead of separate evidence trails.
NIS-2 is added where the thresholds of § 28 BSIG apply. That classification is set out below.
Additionally, the KRITIS regulation typically applies once asset-related thresholds are exceeded. Four consequences of this classification for a typical energy provider. Sector alone is not enough: KRITIS status and NIS-2 classification additionally depend on size thresholds and concrete supply scope. The legally binding evaluation remains a matter for counsel.
From 250 employees, or at annual turnover above €50M and annual balance sheet total above €43M, an Anlage-1 entity is in the stricter tier: highest sanction level, active BSI supervision, faster intervention rights. Operators of critical installations reach it regardless of size. On findings, the BSI does not just send a notice; it arrives on site.
Whoever exceeds KRITIS thresholds (e.g. 500,000 supplied persons for electricity) becomes additionally a KRITIS operator. Obligations overlap but are not identical. NIS-2 is broader in sector scope, KRITIS is deeper on plant requirements.
For a significant incident, the staggered reporting under § 32 BSIG applies: initial report 24 hours, follow-up 72 hours, final report within one month, plus potential customer notification obligations. For EnWG-regulated activities under the § 28 Abs. 5 BSIG exception, § 5d EnWG applies instead: reports also go to the reporting office under § 32 BSIG, and the BSI takes measures in consultation with the Bundesnetzagentur, the German federal network agency.
Operational technology is the dominant attack surface in the energy sector. Control rooms, SCADA connections, smart-meter-gateway infrastructure and maintenance access need segmented architecture and continuous monitoring.
Five of the ten minimum measures per §30, translated into energy practice.
OT and IT risks assessed jointly, covering smart grid connections, control rooms and generation assets. Smart metering and market communication form their own risk landscape.
BSI-compliant crypto concepts for smart-meter gateways, control communication and remote-maintenance tunnels. Key management central and audit-ready.
Supplier audits for SCADA vendors and maintenance service providers. Remote-maintenance access documented, patch management for controllers aligned with maintenance windows.
MFA for control-room access, privileged accounts separated, role model for OT distinct from office IT RBAC. Emergency access documented.
BCM plans for generation outages, grid restoration exercises, black-start capability. Plus crisis communication to regulators and end customers.
OdySecure covers ISMS, BCM, Assessment and supplier risk in one solution. For energy providers, KRITIS reporting and OT modules are additionally relevant.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn moreISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn moreThe platform, permanent CISO function bookable as an add-on. For organisations without an in-house CISO.
Learn moreGap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Industry experience in energy and KRITIS from 25 years of ISMS practice at PwC, Deloitte and KPMG. ISO 27001 Lead Auditor since 2006, BSI IT-Grundschutz auditor. Methodology built for audit-ready evidence towards the BSI.
Most likely yes, if you have at least 250 employees, or annual turnover above 50 million euros and a balance sheet total above 43 million euros and operate in the energy subgroups (electricity, district heating, oil, gas, hydrogen). NIS-2 is not built on KRITIS thresholds but on company size and sector membership. The legally binding evaluation remains a matter for counsel. We provide the expert classification in the risk check.
NIS-2 is sector-broad (different energy subgroups), KRITIS is plant-oriented (e.g. supply assets above certain thresholds). KRITIS operators are usually also NIS-2-affected. NIS-2-affected entities are not automatically KRITIS. The obligations overlap but differ in detail. OdySecure maps both control sets together.
Yes, smart-meter gateways are additionally subject to § 22 of the German metering law (MsbG), read together with the BSI protection profiles and technical guidelines. That is a separate regulatory layer alongside NIS-2 and KRITIS. In the NIS-2 context, smart-meter infrastructure is part of the risk analysis and needs documented crypto concepts.
On a cybersecurity incident, the legal basis of the report depends on the type of entity. Operators of energy supply networks and installations under § 5c EnWG report significant incidents under § 5d EnWG to the reporting office under § 32 BSIG; the BSI takes measures in consultation with the Bundesnetzagentur and forwards relevant findings to it. § 28 (5) BSIG exempts those activities from the BSIG reporting duties. For entities to which this exemption does not apply, the staggered reporting duty under § 32 BSIG applies: 24-hour initial report to the BSI, 72-hour follow-up, one-month final report. Depending on the incident, further reporting duties may arise, for example to the data-protection authority on a data breach; a reporting system should map these paths in a documented way.
NIS-2 makes supply chain security a minimum measure: Article 21(2) explicitly lists supply chain security and security in the acquisition, development and maintenance of network and information systems, including the relevant IT and OT systems; in Germany this is transposed via Section 30 of the BSI Act. For energy suppliers this concretely means: contracts with IT, OT and maintenance providers should contain security requirements, the provider’s duties to inform and report in case of incidents, audit rights, rules for subcontractors, and exit and reintegration provisions. For grid operators, the IT security catalogue of the Federal Network Agency applies on top. It is important to include existing contracts, not just new ones: a model clause alone does not yet evidence a documented, ongoing vendor process.
What holds up is what is documented and current: a register of providers with criticality rating, the associated contracts with their security-relevant clauses, verified provider evidence (such as ISO 27001 certificates), and a defined reporting chain for incidents at the provider. In OdySecure, the TPRM module carries this documentation: vendor assessment, a contract register with security-relevant mandatory fields, and the link between incidents, risks and the respective provider, so the evidence emerges from ongoing operations instead of a binder assembled before the audit date.
For providers with generation and network infrastructure, typically 12 to 16 weeks for audit-ready NIS-2 readiness, depending on OT complexity and KRITIS status. Multi-asset operators need 20 to 26 weeks. The exact cost estimate comes from the risk check.
Free risk check with indicative NIS-2 classification, KRITIS threshold indicator, top-5 gaps and path recommendation. Ideally with CISO or IT security leadership plus management board present.
Book the NIS-2 risk checkIf the classification above fits your organisation, the path starts by determining where you stand, not with a project: once it is clear which obligations apply and where the gaps are, the modules that close them follow.
See the journey in five stationsMemberships, programmes and partnerships
Many companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
The cyber security market is full of promises. What separates substance from marketing is a track record you cannot fake. Why we turned 25 years of audit and implementation practice into a platform, not the other way around.
At Germany's industry summit, one line landed: security, innovation and competitiveness belong together. It sounds like consensus. It is actually an invoice. Nobody settles it in Berlin. You settle it on Monday, in your leadership meeting. One question reveals whether the line holds in your company.
Structured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn moreThe ten regulated sectors OdySecure runs in.
Learn more