Germany: NIS 2 Implementation and Cybersecurity Strengthening Act including security requirements was passed by Parliament

On 13 November 2025, the NIS 2 Implementation and Cybersecurity Strengthening Act, including security requirements, was passed by the Parliament. It introduces a minimum set of risk measures, including incident-handling procedures, business continuity requirements, vulnerability management, authentication, cryptographic protection, and supply chain controls. Companies are required to assess their own risks and implement proportionate safeguards. The Act also replaces the single-step reporting model with a three-tier regime requiring reports at 24 hours, 72 hours, and one month.