NIS-2 Directive to enhance cybersecurity across the European Union

Dallmeier supports affected NIS-2 entities in meeting the requirements of the European NIS-2 Directive with cybersecure video security solutions.

What is NIS-2?
The NIS-2 Directive (Network and Information Security Directive 2) is an EU-wide piece of legislation aimed at strengthening cybersecurity. It entered into force in January 2023, replacing the previous NIS-1 Directive. Its objective is to raise and harmonize the overall level of security of network and information systems across the European Union. NIS-2 expands the scope of previously affected entities – namely operators of critical facilities (referred to as “CRITIS operators”) – to include a broader group of so-called “essential and important entities”. The directive imposes more stringent requirements in areas such as cyber risk management, business continuity, vulnerability management, documentation and evidence obligations, incident reporting, and penalties. In addition to extending the range of affected organizations and their obligations, NIS-2 also introduces mandatory supply chain security. This means that compliance requirements are extended beyond a company’s own operations to include manufacturers, upstream suppliers, and service providers. Failure to comply with the directive may result in significant financial penalties for the organization, as well as personal liability for executive management of NIS-2 entities.

EU member states are required to transpose the NIS-2 Directive into national legislation. Most countries failed to meet the original deadline of October 18, 2024. In Germany, for example, the national implementation law – titled “Act to Implement the NIS-2 Directive and to Regulate Key Aspects of Information Security Management in the Federal Administration” – did not enter into force until December 6, 2025. As an omnibus act, this German legislation amends several existing laws, most notably the BSI Act, which is the key legal framework governing the responsibilities of the German Federal Office for Information Security (BSI) and the cybersecurity of regulated entities. As a result, the number of organizations under the BSI’s regulatory supervision will increase from approximately 4,500 (including CRITIS operators, companies of special public interest, and other specific cases) to around 30,000.

Why NIS-2?
The years 2025 and 2026 mark a period of intensified regulation for essential and important entities – not only in the area of information and cybersecurity, but increasingly also in terms of physical security. This development is driven by a continuous rise in cyberattacks, physical security threats, and an increasingly tense and volatile geopolitical security environment. As the market has proven largely incapable of sufficiently regulating IT security on its own – a case of market failure – governments are stepping in to introduce stricter regulations. This is especially true for critical, essential, and important entities that are vital to the functioning of public life. A disruption or impairment of these organizations could result in severe supply shortages or threats to public security. A growing number of EU and international regulations, directives, and legislative initiatives are therefore aimed at strengthening both the cyber resilience and physical resilience of these entities.

The Whitepaper is designed to serve not only as an information resource for our customers and prospects, but also to position Dallmeier as a reliable technology and supply chain partner and as a trusted advisor. We hope you find it both informative and engaging to read.

Download the whitepaper: