German companies show slow NIS2 compliance progress

A study by Kertos titled ‘NIS2 Readiness Study 2026’ reveals significant gaps in the implementation of the NIS2 directive among German companies. According to the findings, only 27% of surveyed companies have registered with the Federal Office for Information Security (BSI).

Approximately 49% of the companies surveyed have either not yet begun the implementation process or are still in the phase of determining whether they are affected by the regulations. The study, which surveyed 51 German companies with 50 to 1,000 employees in sectors listed under Annex I of the NIS2 directive, indicates that progress is uneven. Specifically, 18% have not started implementation, while 31% are currently assessing their status.

Regarding organizational responsibility, the study highlights that 63% of companies designate IT management as responsible for NIS2 and information security, with 41% naming IT management as the sole responsible role. In contrast, executive management is cited by 22%, and data protection officers by 20%. Experts suggest that because § 38 of the BSIG mandates management responsibility, cybersecurity resilience must be integrated into daily business operations rather than being treated solely as an IT task.