Clarify scope
Services, type of entity, organisation size and potential exceptions form the basis for a documented scope assessment.
NIS2 Executive Governance
Understand leadership accountability for cyber risk and govern it effectively.
An interactive executive training format for leadership teams that want to assess potential NIS2 scope, risk-management duties and decision paths in a structured way.
Four-hour executive trainingOptional management tabletopBSIG sections 30, 32, 38No legal advice
For whom
When cyber risk becomes a leadership responsibility.
Prepare decisions
Business impact, risk priorities, resources and accepted residual risk need a clear management framework.
Stay capable under pressure
Roles, deputies, escalation and reporting paths need to work when time pressure has already arrived.
Leadership duties
The management mandate under section 38 BSIG.
Initiate risk management
Leadership needs to ensure the appropriate risk-management measures under section 30 BSIG are implemented, prioritised and resourced.
Monitor implementation
Reports, deviations and evidence of effectiveness must feed into regular decisions and management reviews.
Build knowledge
Leadership of in-scope entities must regularly acquire sufficient knowledge to recognise and assess cyber risks and risk-management practices.
Training programme
From scope to management decisions that can be acted on.
Scope and accountability
- Identify critical services and dependencies
- Document scope and open assessment points
- Structure delegation, reporting and escalation
Risks and measures
- Assess business impact instead of technical symptoms alone
- Structure the minimum areas in section 30 BSIG
- Classify evidence of effectiveness and management reporting
Incident and notification
- Capture events and assess materiality
- Define notification and escalation roles with deputies
- Understand the 24-hour, 72-hour and final-report logic
Transfer to the organisation
- Prioritise unresolved management decisions
- Document decisions with owner, due date and review point
- Use an optional tabletop for a realistic decision scenario
Risk management
The minimum areas of section 30 BSIG through a management lens.
Risk and governance
Risk analysis, policies, accountability and reasoned risk acceptance create the basis for decisions.
Incident and recovery
Incident handling, crisis management, backups and tested recovery need to align with critical services.
Supply chain and control
Suppliers, procurement, vulnerabilities, effectiveness reviews and identity controls belong in one management model.
Reporting chain
Deadlines only help when roles and approvals are clear.
Early warning
For a significant security incident, an early warning is required within 24 hours of becoming aware of the incident.
Notification with initial assessment
The notification updates the initial information and includes an initial assessment of severity and impact.
Final or progress report
As a rule, the final report follows one month after the 72-hour notification. Ongoing incidents first require a progress report.
Under section 32 BSIG, the reporting duties apply no earlier than the establishment of the reporting channel. The classification of a specific incident and any additional duties always require a case-by-case assessment.
NIS2 management check
Where does your leadership team need clarity next?
Six short questions to structure the conversation. The check does not determine legal scope and does not store any answers.
The check does not replace a scope assessment, legal advice or an authority's assessment of a reportable incident.
Next step
Is executive training right for your current situation?
In an introductory call, we clarify the audience, existing evidence, critical services and whether training, a tabletop or more extensive governance support fits your needs.
Official basis: section 30 BSIG, section 32 BSIG and section 38 BSIG. The training does not provide legal advice and is not BSI-certified training.