NIS2 advice has an incentive problem

Our impression is that NIS2 advice in Germany has an incentive problem: whoever establishes that a company is in scope often sells the audit right along with it. The bill is paid by companies NIS2 does not cover at all.

An example. One provider markets NIS2 audits to tax advisory firms from 3,590 euro, citing annex 1 of the BSI Act. It lists managed service providers and managed security service providers under 6.1.10 and 6.1.11, but only where a company provides such services on the market itself. A tax practice does not. Legal advice, tax advice, auditing and notarial services appear in neither annex.

The supply chain argument is upside down. Being part of a regulated company's supply chain does not make you subject to NIS2 yourself. It makes you the object of your client's supplier requirements. The duty sits with them; the pressure reaches you through a contract. And a contract can be negotiated, a supervisory authority cannot. An audit with no supervisory counterpart discharges none of those duties, because there are none.

There are plenty of cases where the obligation genuinely applies: manufacturing appears in annex 2, healthcare providers in annex 1. The charge is not that scope is wrongly claimed, but that it is asserted rather than derived. Where it applies, two sentences with the number and the threshold will show it.

The damage exceeds the invoice. A security budget is finite. Spent on an audit that discharges no duty, it is missing from backups, patch levels and multi-factor authentication, which is where incidents actually begin. What is left is a document in a cupboard and the same attack surface as before.

Checking costs nothing. Open annex 1 and annex 2 of the BSI Act and look for your own activity; section 28(2) refers expressly to both for important entities. An essential entity, under section 28(1) no. 4, is one that falls under a type of entity in annex 1 and has at least 250 employees, or an annual turnover above 50 million euro and a balance sheet total above 43 million euro. An important entity, under section 28(2) no. 3, is one that falls under a type of entity in annexes 1 or 2 and has at least 50 employees, or an annual turnover and a balance sheet total each above 10 million euro. Operators of critical installations are covered irrespective of these thresholds.

If your business model appears in neither annex, a customer who is in scope themselves does not change that. What remains are supplier requirements from contracts, and those belong in a negotiation rather than an audit.

We are a provider too, and this criticism applies to our own business model just as much. That is why we keep the scope assessment separate from everything that follows it: you get a written assessment from us citing the relevant number and threshold, even where the result is that you are not in scope. It is part of our assessment.

Ask your provider when they last told a prospect they were not in scope. The answer tells you more about the advice than any reference list.