Case study
NIS2 and Cyber Resilience Act
NIS2 & CRA: implementing NIS2 and the Cyber Resilience Act
We help your company become ready to report incidents and able to demonstrate its security – with a clear assessment of whether you're affected, ongoing security operations on Google Security Operations and evidence that is created in day-to-day operations.
- Clarify whether you're affected and what you must do
- Reporting readiness, around the clock on request
- Evidence from day-to-day operations instead of binders
What applies since when?
- 10 December 2024
Cyber Resilience Act in force
Regulation (EU) 2024/2847 applies directly in all EU member states; its obligations take effect in stages.
- 6 December 2025
NIS2 applies in Germany
The German NIS2 Implementation Act and the revised BSI Act are in force (BGBl. 2025 I No. 301). Reporting obligations and risk management have applied since then.
- 11 September 2026
CRA reporting obligations
Manufacturers must report actively exploited vulnerabilities and severe security incidents affecting their products (Art. 71 CRA).
- 11 December 2027
CRA in full
Security requirements for products with digital elements and CE marking apply (Art. 71 CRA).
As of November 2026. Our work covers the technical and organisational implementation, not legal advice.
NIS2 or CRA – what affects you?
NIS2 – affects your operations
Applies to important and essential entities in defined sectors, such as energy, healthcare, transport, digital services or the manufacture of certain goods. At its core: risk management, registration with the BSI, reporting of significant security incidents and accountability of management.
Initial notification no later than 24 hours after becoming aware, notification with an initial assessment after 72 hours (Section 32 BSIG).
Cyber Resilience Act – affects your products
Applies to manufacturers, importers and distributors of products with digital elements, i.e. connected hardware and software placed on the EU market. At its core: security across the entire lifecycle, vulnerability management, reporting obligations and CE marking.
Since 11 September 2026, actively exploited vulnerabilities and severe incidents must be reported; the remaining obligations apply from 11 December 2027 (Art. 71 CRA).
Many companies are affected by both: as operators of critical processes and as manufacturers of connected products, for example in mechanical and plant engineering.
Approach
How we implement NIS2 and the CRA
Compliance doesn't come from a document but from operations that work. We first clarify which obligations apply to you, then close the technical and organisational gaps and practice the reporting chain before it gets serious.
01
Check whether you're affected
Classify sector, size and products: does NIS2 apply, the CRA or both? Result: your obligations on one page.
02
Analyze gaps
Compare existing measures against the requirements: risk management, detection, reporting channels, supply chain, vulnerability management.
03
Implement measures
Central detection on Google Security Operations, hardening of the cloud environment, roles and responsibilities.
04
Practice the reporting chain
A simulated incident from detection to notification, with named roles and deputies.
05
Operations and evidence
Ongoing monitoring as a managed service – around the clock on request – regular reports and evidence created in day-to-day operations.
The technology we use
Google Security Operations
Central detection and response across all systems, with AI-assisted analysis by Gemini.
Mandiant Threat Intelligence
Current insights into attackers and vulnerabilities feed directly into detection.
Security Command Center
Overview of risks, misconfigurations and vulnerabilities in your Google Cloud environment.
Data storage in the EU
Security data is stored in European regions.
Detection and reporting as a managed service: Managed SOC with Google SecOps →
More on data storage in the EU: Sovereign Cloud with Google →
From practice: NIS2 at a municipal utility
How a regional energy supplier with around 350 employees and six people in IT sets up ongoing security operations without building its own SOC.
Get started for free
The first step costs nothing
We review your environment read-only and show you in a results report where to start – free of charge and without obligation.
Find out in 30 minutes which obligations apply to you
- Classification of NIS2 and the CRA for your company
- Initial assessment of gaps and effort
- Next steps
Frequently asked questions
Important and essential entities in defined sectors, such as energy, healthcare, transport, digital infrastructure or certain areas of manufacturing. What matters is sector and company size – as a rule from 50 employees or 10 million euros in annual turnover (according to the BSI). We check the classification together with you; the legal assessment in each individual case is a matter for your legal counsel.
Since 6 December 2025. On that day, the German NIS2 Implementation Act entered into force; the obligations are set out in the revised BSI Act (BGBl. 2025 I No. 301).
A significant security incident must first be reported no later than 24 hours after becoming aware of it. A notification with an initial assessment follows no later than 72 hours, and a final report one month after that (Section 32 BSIG).
NIS2 governs the cybersecurity of companies and their operations. The Cyber Resilience Act governs the cybersecurity of products with digital elements sold in the EU. If you manufacture connected products and also fall under NIS2, you have to meet both.
The regulation has been in force since 10 December 2024. The reporting obligations for actively exploited vulnerabilities and severe incidents have applied since 11 September 2026, the remaining obligations from 11 December 2027 (Art. 71 CRA).
Not necessarily. What matters is that incidents are reliably detected and reported on time – including at night and at weekends. Many companies solve this with an SOC as a managed service instead of running their own shifts.