Classification and BSI registration
Size thresholds and sector mapping decide between “essential” and “important”; register with the BSI within three months and keep the data current.
Typical obligations
What typically lands on your desk
Risk management and supply chain
All-hazards risk analysis, measures per the state of the art, assessment of direct suppliers and cybersecurity clauses anchored in contracts.
Reporting: 24h / 72h / 1 month
Early warning, full notification and final report to the BSI — and where personal data is affected, the parallel GDPR notification to the supervisory authority.
IT security catalogue and evidence
Grid operators evidence an ISMS per ISO/IEC 27001 and ISO/IEC 27019 under section 11(1a) EnWG; operators of critical facilities prove implementation to the BSI.
How Agentic360 helps
From target process to the real incident
The building blocks utilities and critical-infrastructure operators can work with on the platform — each linked to its detail page.
NIS2 blueprint under the BSIG 2025
12 modules, 22 grounded controls — every step cited to the directive article and the BSIG paragraph, with enforcement practice labelled as such.
The incident as a workflow
Six agents draft the notifications for a ransomware incident decision-ready, every statement cited to its paragraph; the Control Room shows running deadlines in incident mode. Filing and sign-off stay human acts.
Energy GRC and section 14a EnWG
Classification under the BSI-KritisV, the NIS2 category and section 11(1a) EnWG with maturity, gaps and an evidence dossier — plus workflow drafts for volume processes such as registering controllable consumption devices.
No internet required, if need be
On-premises behind your firewall or air-gapped with local models and signed offline update bundles — managed centrally via Fleet Control.
Regulations
Relevant regulations at a glance
EU basis; classification by size and sector.
- BSIG 2025 (German NIS2 implementation act)
In force since 6 December 2025; BSI registration within three months.
- Section 11(1a)/(1b) EnWG
The BNetzA IT security catalogue.
- BSI-Kritisverordnung (BSI-KritisV)
Classification of facilities as critical infrastructure.
- Section 14a EnWG
Grid-oriented control of controllable consumption devices; binding for new devices since 1 January 2024 (BK6-22-300).
- GDPR Articles 33/34
Parallel notification to the data protection authority where personal data is affected.
- ISO/IEC 27001 + ISO/IEC 27019
ISMS framework for the IT security catalogue.
Whether and to what extent a regulation applies to your organisation depends on size, sector and business model. This overview is orientation, not legal advice.
Related roles
Rehearse the incident before it happens.
30 minutes: we play through the 03:12 incident and show how the NIS2 target process compares with your current state.