Registered is not implemented

On 31 July, the BSI sets its final deadline: around 29,500 organizations that fall under NIS2 must have registered by then. A good half have done so by now. The uncomfortable figure sits right next to it: by most accounts, only about a third have actually implemented the requirements. The real subject lies between those two numbers.

The deadline is about signing up, not about security

Registering with the BSI is a form. It states that an organization is in scope, not that it is secure. Whoever signs up and considers the topic handled confuses the notification with the obligation behind it. The deadline creates activity at exactly the point that takes the least work, and distracts from the rest.

NIS2 is an operating state, not a project

What the directive requires in Article 21 does not end with registration: risk management that is actually lived. Reporting paths that manage a first notice within 24 and a full report within 72 hours. A supply-chain view that also covers service providers. And above all, evidence that none of this exists on paper only. That is not a project with an end date, but a state you have to hold. Personal liability for management and fines of up to 500,000 euros turn a formality into a boardroom matter.

What counts after 31 July

isidaten bundles exactly the parts that remain after registration: a risk register with measures and effectiveness tracking, a reporting system with the NIS2 deadlines, supplier management and an asset inventory as the basis for all of it. In one place, from Germany, auditable. Not to make the sign-up faster, but so that what comes after holds up in an audit.

What NIS2 requires in concrete terms, and how to produce the evidence, is shown on the NIS2 solution page. The official registration and deadlines are listed by the BSI. If you want to know where you stand, talk to us.