NIS2 in Practice: From Reporting Duty to Defensible Evidence

Since 6 December 2025, NIS2 is law in Germany. The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was passed by the Bundestag on 13 November 2025, confirmed by the Bundesrat on 20 November, and entered into force with no transition period. Around 29,500 companies across 18 sectors are in scope. The BSI registration deadline on 6 March 2026 has passed; late registration remains possible and is advisable.

Many organisations treated the rollout as a registration and documentation task. The harder part begins afterwards: being able to prove, when it counts, what actually happened.

The clock runs in hours, not weeks

The reporting duties (Section 32) are staggered and tightly timed. For a significant incident: an early warning within 24 hours, a notification within 72 hours, a final report within one month. These deadlines can only be met if an incident is detected quickly and reconstructed traceably. Whoever notices only while writing the report that the necessary data is missing has effectively already missed the deadline.

What the regulator wants to see

Section 30 requires risk-management measures: monitoring, logging, incident handling, business continuity and supply-chain security. The decisive difference lies between “we run monitoring” and “we can prove what happened, and when”. A supervisory authority does not accept a statement of intent, it wants evidence.

Evidence is defensible when it has three properties:

• Gapless: detection, escalation and response are continuously timestamped, with no dark phases in the timeline.
• Unalterable: logs and incident histories are append-only, not quietly correctable after the fact.
• Reconstructable: from the trail, the incident chronology can be derived in a way that maps onto the 24-hour, 72-hour and one-month deadlines.

This is exactly where many setups fail: monitoring exists, but the data is scattered, overwritable, or cannot be assembled into an audit-proof chronology.

Responsibility cannot be delegated away

Section 38 puts management on the hook to approve the measures and oversee their implementation. That responsibility cannot be handed off to IT. Section 65 sets the frame with fines of up to 10 million euros. This shifts NIS2 from a technical task to a leadership one.

What makes sense now

Three steps pay off immediately: map your own obligations cleanly onto Sections 30 and 32; set up detection so that the 24-hour early warning is realistically achievable; and move logging onto unalterable, sufficiently long-retained trails. A single rehearsed reporting run quickly reveals where the chronology breaks.

In our Perstat module, monitoring, security posture and an append-only audit trail are connected so that NIS2 evidence can be produced on demand. The point itself, though, is independent of any tool, namely to run detection and logging so that what remains at the end is an audit-proof chronology and not a pile of scattered log lines.

NIS2 does not ask whether you run monitoring. It asks whether you can prove it.