Energy
When your power goes out, so does everyone else's.
Energy suppliers, network operators, municipal utilities, and charging infrastructure operators sit in the sector with the highest expectations attached to it. Classic control technology meets modern IT here — and both have to keep running.
Does this apply to you?
Annex 1 · Sector 1
Sector: Energy
Electricity, district heating, gas, and fuel supply — from distribution and transmission network operators through generation and storage facilities to charging point operators and hydrogen.
Entity of essential importance
at least 250 employees — or annual turnover above €50 million and an annual balance sheet total above €43 million
Applies to entity types under Annex 1 · Section 28(1), (2) BSIG
Important entity
at least 50 employees — or annual turnover and balance sheet total above €10 million
Applies to entity types under Annexes 1 and 2 · Section 28(1), (2) BSIG
Important for you: One exception worth flagging: for operators of energy supply networks and energy installations subject to Sections 5c–5e of the German Energy Industry Act (EnWG), core BSIG obligations under Section 28(5) BSIG partly do not apply. Which framework applies in your case needs a lawyer's sign-off.
Covered regardless of size: operators of critical facilities, qualified trust service providers, top-level domain registries, and DNS service providers (Section 28(1) Nos. 1, 2 BSIG); trust service providers always count as an important entity (Section 28(2) No. 1 BSIG). Employee count and financial figures are alternative thresholds (either one triggers coverage); for the financial figures, both values must be exceeded. Whether your specific company is covered is a case-by-case question — that's what lawyers are for.
What's typically in the register in this sector
These obligations decide it for you.
Section 30(2) No. 3 BSIG
Keep operating — even after the worst happens
Backup management, recovery, and crisis management aren't an IT drill here — they determine how fast grid operation and billing are back on their feet after an incident.
Section 30(2) No. 10 BSIG
Lock down remote access
Multi-factor authentication and secured communications hit exactly the point where maintenance firms and contractors reach into your systems.
Section 30(2) No. 4 BSIG
Build the supply chain in from the start
Your control-system vendor, your metering point operator, your maintenance contractor: the security-relevant aspects of these relationships need to be set out and documented.
Example (fictional): The municipal utility and the maintenance laptop
A municipal utility has its control system serviced by an outside contractor. The technician connects over a remote access channel that has run on the same password for years — no second factor. The laptop picks up malware on an unrelated client job.
What saves the utility isn't a firewall — it's a decision made six months earlier: remote access only with a second factor, contractor access time-limited, every session logged. The attack stops at the login screen. And because the incident still gets logged and documented, the reporting question is settled in minutes, not in a crisis meeting.
A freely invented example for illustration — no real customer, no legal advice
Here's how Compliverse takes this off your plate.
- 1
Your installations and control systems go into the asset register with a criticality rating — the foundation for every risk decision.
- 2
The reporting assistant counts deadlines from the moment of awareness: initial report, full report, final report (Section 32 BSIG).
- 3
Ready-made policy templates for access, remote maintenance, and operations — you adapt them, approve them, and collect read receipts.
NIS2 in Energy: frequently asked questions
Is my Energy company in scope for NIS2?
Your sector is covered by Germany's BSI Act: Annex 1 · Sector 1, sector Energy. That does not put you in scope automatically — a size threshold has to be met as well (Section 28(1), (2) BSIG). And no official notice arrives: you assess the classification yourself and register if it applies (Section 33 BSIG). Your sector also has an exception — it is set out on this page under “Are you in scope?”. Judging your individual case is a lawyer's job.
From what size does NIS2 apply to us?
You count as an essential entity from at least 250 employees — or annual turnover above €50 million and an annual balance sheet total above €43 million; as an important entity from at least 50 employees — or annual turnover and balance sheet total above €10 million (Section 28(1), (2) BSIG). Headcount and financial figures are alternatives to each other — but where the financial figures are used, both have to be exceeded. Some entity types are in scope regardless of size, among them operators of critical facilities and qualified trust service providers.
Which authority is responsible for us in Germany?
Registration and supervision sit with the Bundesamt für Sicherheit in der Informationstechnik (BSI) — Germany's Federal Office for Information Security (Section 33 BSIG). Security incidents, however, do not go there: they go to the joint reporting office of the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — early warning within 24 hours, report within 72 hours, follow-up report a month later (Section 32 BSIG). This is the most common misreading of the act — the supervisory authority and the reporting office are not the same body.
What happens if we do not implement NIS2?
The obligations do not go away: registration stays due (Section 33 BSIG), so do the risk-management measures (Section 30(2) BSIG), and reporting deadlines start running with the first significant incident (Section 32 BSIG). On top of that, Section 38 BSIG puts management personally on the hook: they have to approve the measures, oversee their implementation, and undergo training themselves. “I didn't know” does not carry here.
Find out in thirty seconds what applies to you.
Four questions, an honest first estimate — then you'll know which module to start with and what it costs.
What becomes important next
More industries
Legal status checked on 01/09/2026 · Every statement with a source · No legal advice