Clear access rights
Every regulation asks who may access what and who approved it. That is why Identity & Access Management is our core topic: without a role model and documented approvals, you cannot prove access control.
A guide to the regulations
Which regulation applies to your IT?The main frameworks at a glance
Many companies hear about NIS2, KRITIS, DORA or GMP at the same time, and medical practices also hear about the KBV IT security guideline. It is often unclear which rule applies and what it means for IT. This page explains the five frameworks and shows where they overlap. Afterwards you will know which questions to clarify and where we can take the technical work off your hands.
Five frameworks with a shared core
NIS2, KRITIS, DORA and GMP come from different directions. NIS2 and KRITIS govern the cybersecurity of important companies and facilities in Germany, DORA applies specifically to the financial sector, GMP ensures quality in the manufacture of medicinal products, and the IT security guideline under § 390 SGB V applies to medical, dental and psychotherapy practices. Supervision, reporting channels and audits differ accordingly.
In IT, however, they ask for many of the same things. Each of them is about who may access what, whether data can be restored after an outage, whether changes are traceable and whether you can prove all of it. If you build these basics properly once, you meet a large part of the requirements of several frameworks at the same time.
The regulations compared
This overview does not replace a legal review of your individual case, but it shows you where to start.
| NIS2 (BSI Act) | Applies to companies in the sectors named in the Act, as a rule from 50 employees or more than €10 million in annual turnover and balance sheet total. Core IT duties: risk management with access control, MFA, backup, logging and incident handling, registration with the Federal Office for Information Security (BSI) and reporting of significant security incidents. |
| KRITIS (BSI Act and KRITIS Umbrella Act) | Applies to operators of facilities whose level of supply reaches the thresholds set in a statutory ordinance, for example in energy, water, health or transport. Core IT duties: stricter measures than under NIS2, attack detection systems, proof submitted to the BSI every three years. |
| DORA (EU Regulation 2022/2554) | Applies to financial entities such as banks, insurers, payment institutions and investment management companies, since 17 January 2025. Core IT duties: ICT risk management, reporting of major ICT incidents to BaFin, regular testing and management of IT service providers. |
| GMP (EU GMP Guide, Annex 11) | Applies to manufacturers of medicinal products and active substances. Comparable quality management requirements apply to medical devices. Core IT duties: validated systems, audit trail, controlled access rights, tested backups and data integrity. |
| IT security guideline (§ 390 SGB V) | Applies to medical, dental and psychotherapy practices with statutory health insurance accreditation and to medical care centres (MVZ), regardless of size. Core IT duties: minimum requirements for devices, software, network and telematics infrastructure (TI) components, graded by the number of people involved in data processing. |
A company can fall under several frameworks. For financial entities, the DORA requirements take precedence over most NIS2 duties under the BSI Act.
What they all require
Secure sign-in
MFA for every account, including management and field staff, and separate accounts for admin tasks. Exceptions are the first thing any audit picks up.
Tested backups
A backup only counts once the restore has been tested and the result documented. NIS2, DORA and GMP all require this.
Traceable changes
Who changed what, when, and who approved it? Logs and an orderly change process answer this question before an auditor asks it.
A plan for emergencies
After a security incident, reporting deadlines of only a few hours apply. So it must be clear in advance who decides, who reports and which technical information is needed.
Evidence you can show
Being secure is not enough, you also have to be able to show it. We document as we implement, so that at the end you have records you can present to an auditor or a customer.
How to find out what applies to you
- 01
NIS2 check
A few questions show whether your company is likely to fall under NIS2. The check is free and takes a few minutes.
- 02
Intro Call
In 20 minutes on Teams or by phone, we discuss your situation. Fabian Schmid advises on NIS2, KRITIS, DORA and GMP himself.
- 03
Gap analysis
In the Security Assessment we compare your IT with the requirements that apply to you. You receive a written report with measures prioritised by risk and effort.
- 04
Implementation and evidence
We implement the measures without interrupting your operations and hand over documentation that belongs to you.
Our role and that of your legal advisers
We take care of the technical implementation and the evidence. Whether you are legally affected is assessed bindingly by your legal advisers, and your company submits any reports to the authorities itself. We work with lawyers, auditors and validation service providers and give them the technical information they need.
From our projects
Industrial supplier, international · 2,000 users
Introduction of an IAM solution at an internationally active industrial supplier, a family-owned company. The project included reorganising the file shares and a password reset that users can carry out themselves.
Result: The support team has more time: users reset their own passwords, and password tickets have dropped from almost 300 to 10 per week.
Updated:
FAQ
Frequently asked questions
Which regulation applies to my company?
That depends on your industry, your size and your facilities. Banks and insurers fall under DORA, pharmaceutical manufacturers under GMP, medical practices under the IT security guideline under § 390 SGB V, and many other companies with 50 or more employees under NIS2. Whether you also operate a critical facility is decided by thresholds in a statutory ordinance.
Can a company fall under several regulations?
Yes, that is common. A pharmaceutical manufacturer, for example, may have to meet both GMP and NIS2. Because the technical requirements overlap a great deal, we plan the measures so that one set of evidence works for several frameworks.
How are NIS2 and KRITIS related?
Under the BSI Act, operators of critical facilities are a subset of the particularly important entities under NIS2. Additional duties apply to them, such as attack detection systems and regular proof submitted to the BSI.
Does NIS2 also apply to banks?
Financial entities that apply DORA are exempt from most NIS2 duties under the BSI Act, because DORA takes precedence as the more specific rule. The DORA and BaFin requirements then apply.
We are not affected ourselves. Do we still need to do anything?
Often yes, because affected customers pass their requirements on to suppliers and service providers. Under DORA, financial entities even have to bind their IT service providers to certain duties by contract.
Do you provide the legal assessment?
No, the binding assessment comes from your legal advisers. We classify the technical requirements, implement them and supply the documents that lawyers and auditors need.
Where should we start?
With a gap analysis that shows where your IT stands today. It is part of the Security Assessment from €6,900, and we credit its cost towards a follow-up project.
Compliance & Regulation
Let's clarify what applies to you
Tell us about your situation in 20 minutes. Afterwards you will know which regulations you should keep in view and what they mean for your IT.