The short answer
Most small businesses are not directly covered by NIS2. Germany’s NIS2 implementation act has applied since December 6, 2025 and supplements the BSI Act (BSIG), the law that governs Germany’s Federal Office for Information Security (BSI). It covers companies in certain sectors above a certain size, plus some special cases.
Many smaller businesses feel NIS2 anyway: through their customers. A covered company also has to take the security of its supply chain into account and therefore asks its suppliers and service providers. This often includes the website or the store.
For most small businesses, NIS2 is not an obligation of their own but a question from their customers. If you can answer it with evidence, you have the advantage.
Who is covered directly
Covered are mainly companies that operate in one of the sectors listed in Annexes 1 and 2 of the BSI Act, such as energy, transport, health, parts of manufacturing or digital services, and that have at least 50 employees or more than €10 million in annual turnover and annual balance sheet total (Section 28 BSIG). For some types of entity, such as telecommunications or trust services, different rules apply, and for groups of companies the details matter.
You have to check this yourself; the BSI does not tell you whether you are covered.
The BSI’s NIS-2 self-check
A decision tree with questions about your business. The result is a first orientation, not a legal assessment. The self-check is in German.
Go to the self-checkIf you are covered
- 01
Registration with the BSI
No later than three months after a company falls under the act. According to the BSI, the deadline for companies that were covered from the moment the act entered into force has passed. Anyone not yet registered should do so immediately, through the BSI portal with an ELSTER organization certificate (ELSTER is the German tax administration’s online system).
Section 33 BSIG - 02
Risk management
Appropriate, proportionate and effective measures in line with the state of the art, documented. At least ten areas, including incident handling, backups and recovery, the supply chain, vulnerability handling, access control and multi-factor authentication.
Section 30 BSIG - 03
Reporting obligations
Significant security incidents are reported in stages: an early initial report within 24 hours, a notification within 72 hours, and a final report no later than one month afterwards.
Section 32 BSIG - 04
Management
Management has to implement the measures, oversee their implementation and take part in training regularly. Liability depends on the company law of the respective legal form.
Section 38 BSIG
More on registration and obligations on the BSI’s pages (in German). Questions about liability in an individual case are best clarified with a lawyer.
The more common case: your customers are covered
The obligations of covered companies include “supply chain security, including security-related aspects of the relationships with direct suppliers or service providers” (Section 30(2) No. 4 BSIG).
This includes, for example, contractual agreements with suppliers and service providers on risk management measures, on handling security incidents and on patch management.
BSI, NIS-2 FAQ (in German)The act does not indirectly oblige all suppliers and service providers. Covered companies do, however, have to oblige their suppliers to meet corresponding security requirements.
BSI, Infopaket Lieferkette (in German)For you as a supplier, this is therefore a business question: a covered customer may no longer be able to work with every company without breaching obligations itself. In practice, it arrives as a questionnaire or a contract clause.
What your customers ask about the website
The questions usually concern a supplier’s entire IT, and the website or store is one part of it. You should expect these:
Patch management
- How quickly are security updates applied?
- Are they tested first?
- Who is responsible?
Backups
- How often are backups made, and where are they stored?
- Are they encrypted?
- Has restoring been tested?
Security incidents
- How are attacks or changes detected?
- Who informs the customer, and how quickly?
Access control
- Who has administrator access?
- Is it protected with a second factor?
- Are old accounts removed?
Documentation
- Can you show what was changed, checked and applied, and when?
There is no uniform questionnaire yet. The BSI welcomes initiatives from industry to develop a common set of questions for suppliers.
How to answer the questions with evidence
A “yes” without evidence does little in such questionnaires. Answers backed by a document are better:
| The question behind it | The matching evidence |
|---|---|
| How quickly do security updates arrive? | A described update process: how updates are tested and applied, within what time frame security updates go live, who is responsible. |
| What was changed when? | A log of changes: which updates were applied when, what was checked and what stood out. |
| Does this run continuously? | Regular reports, for example per month or quarter. They show that the measures run continuously, not just once. |
| Do the backups work? | A description of the backups: frequency, storage location, encryption and the last successful restore test. |
| What happens in an incident? | A procedure for incidents: who detects, who decides, who reports to the customer and within what time. |
Where there is still a gap, an honest answer with a plan is better than an unsupported “yes”.
What the Doppelgänger provides as evidence
The Doppelgänger does not make you “NIS2 compliant”, and it only covers your website or store, not the rest of your IT. For that part, it provides evidence that supplier questionnaires ask for.
A documented update process
I apply every update to an exact copy of your website on a dedicated server in Germany first and test it. Security updates usually go live within 24 to 48 hours.
Nightly security checks
An inventory of all plugins and extensions matched against known vulnerabilities, a file comparison and a content check of the live website.
Encrypted backups
An encrypted backup on servers in Germany every night.
The dossier and reports
Every change goes into the dossier with its date, plus regular reports you can show a customer.
More on this on the pages for WordPress and Shopware. What the GDPR requires of every website is explained in my guide Updates are mandatory, and what the Cyber Resilience Act means in the guide Cyber Resilience Act.
Note: this guide is not legal advice. Whether your business falls under NIS2 and what obligations you have in detail is something to clarify with a lawyer if in doubt.
Quick answers.
Does my online store fall under NIS2?
Running your own online store does not on its own make your business a NIS2 entity. What matters is the sector your business operates in and how large it is. It can be different for an online marketplace through which customers enter into contracts with other merchants: providers of online marketplaces are among the sectors of the act. The BSI's self-check gives a first orientation.
As a supplier, do I have to fill in my customer's questionnaire?
The BSI Act does not oblige you directly as a supplier. Your customer, however, has to take the security of its supply chain into account and oblige its suppliers to meet corresponding security requirements. In practice it is therefore a business question: a supplier who cannot answer the questions becomes harder for a covered customer to hire.
What questions about the website typically come up?
How quickly security updates are applied and whether they are tested first, how often backups are made and whether restoring works, who has administrator access and whether it is protected with a second factor, how security incidents are detected and who then informs whom, and how all of this is documented.
Are there model contracts or a standard questionnaire?
The BSI does not provide contract templates, but it does provide an information package on the supply chain (Infopaket Lieferkette, in German). The BSI welcomes initiatives from industry to develop a uniform set of questions for suppliers. Until then, companies use their own questionnaires, which are similar in their core topics.
Does the Doppelgänger make me NIS2 compliant?
No. NIS2 concerns a company's entire IT and organization, not just the website. For your website or store, the Doppelgänger provides evidence that such questionnaires ask for: a documented, tested update process, nightly security checks, encrypted backups in Germany and the dossier, which holds every change.
What applies to me if NIS2 does not cover me?
The GDPR. Art. 32 requires every business to provide security that takes the state of the art into account as soon as personal data is processed, including for a website with a contact form or a store. More on this in the guide Updates are mandatory.