NIS2 directive

The NIS2 directive replaces the first NIS directive and considerably widens the circle of organisations in scope. The full text is on EUR-Lex.

In Germany, the NIS2 implementation act transposes the directive; it has been in force since December 2025 (BSI, in German). Companies in scope count as important or particularly important entities.

#Who is in scope

As a rule, medium-sized and large companies in these sectors are covered. Some entities are in scope regardless of size. Whether your organisation is covered needs to be checked case by case.

#The duties

#The supply chain and customer service

For an energy supplier or a hospital, a contact centre platform is an ICT service provider. Under NIS2 you include its security in your risk management: contracts, evidence, reporting lines for incidents.

During an incident, customer service becomes the crisis channel. Handling many calls at once takes prepared announcements, callbacks and proactive notifications.

#What you need from providers

For your risk management you need reliable answers from every important provider: how is operation secured? How quickly will it report incidents that affect you? Which evidence, such as audit reports under BSI C5, can it provide?

Record those answers in the contract, not just in a slide deck.

#NIS2 and Univerx

Univerx is designed to support your NIS2 duties with documents on supply chain, reporting lines and evidence of secure operation. Which documents are available, we tell you on request.

Details in the Trust Center under NIS2 and Security & availability. On communicating during an outage: When everyone calls at once.