Energy is Annex I. A sector of high criticality.

Most likely yes, if you operate in the energy subgroups (electricity, district heating, oil, gas, hydrogen) and have at least 50 employees, or annual turnover and balance sheet total each above 10 million euros. That makes you an important entity (wichtige Einrichtung). You are an essential entity (besonders wichtige Einrichtung) from 250 employees, or with annual turnover above 50 million euros and a balance sheet total above 43 million euros. NIS-2 is not built on KRITIS thresholds but on company size and sector membership. The legally binding evaluation remains a matter for counsel. We provide the expert classification in the risk check.

NIS-2 is sector-broad (different energy subgroups), KRITIS is plant-oriented (e.g. supply assets above certain thresholds). KRITIS operators are usually also NIS-2-affected. NIS-2-affected entities are not automatically KRITIS. The obligations overlap but differ in detail. In OdySecure, the KRITIS umbrella act and the IT security catalogue energy sit in the same catalogue as the NIS-2 obligations.

Yes, smart-meter gateways are also subject to § 22 of the German metering law (MsbG), read together with the BSI protection profiles and technical guidelines. That is a separate regulatory layer alongside NIS-2 and KRITIS. In the NIS-2 context, smart-meter infrastructure is part of the risk analysis and needs documented crypto concepts.

On a cybersecurity incident, the legal basis of the report depends on the type of entity. Operators of energy supply networks and installations under § 5c EnWG report significant incidents under § 5d EnWG to the reporting office under § 32 BSIG; the BSI takes measures in consultation with the Bundesnetzagentur and forwards relevant findings to it. § 28 (5) BSIG exempts those activities from the BSIG reporting duties. For entities to which this exemption does not apply, the staggered reporting duty under § 32 BSIG applies: 24-hour initial report to the BSI, 72-hour follow-up, one-month final report. Depending on the incident, further reporting duties may arise, for example to the data-protection authority on a data breach; a reporting system should map these paths in a documented way.

NIS-2 makes supply chain security a minimum measure: Article 21(2) explicitly lists supply chain security and security in the acquisition, development and maintenance of network and information systems, including the relevant IT and OT systems; in Germany this is transposed via Section 30 of the BSI Act. For energy suppliers this concretely means: contracts with IT, OT and maintenance providers should contain security requirements, the provider’s duties to inform and report in case of incidents, audit rights, rules for subcontractors, and exit and reintegration provisions. For grid operators, the IT security catalogue of the Federal Network Agency applies on top. It is important to include existing contracts, not just new ones: a model clause alone does not yet evidence a documented, ongoing vendor process.

What holds up is what is documented and current: a register of providers with criticality rating, the associated contracts with their security-relevant clauses, verified provider evidence (such as ISO 27001 certificates), and a defined reporting chain for incidents at the provider. In OdySecure, the TPRM module carries this documentation: vendor assessment, a contract register with security-relevant mandatory fields, and the link between incidents, risks and the respective provider, so the evidence emerges from ongoing operations instead of a binder assembled before the audit date.

For providers with generation and network infrastructure, typically 12 to 16 weeks for audit-ready NIS-2 readiness, depending on OT complexity and KRITIS status. Multi-asset operators need 20 to 26 weeks. The exact cost estimate comes from the risk check.