Are we within the scope of NIS2?

Above fifty employees, the check is missing

The undertaking manufactures machinery and is above fifty employees. Whether it is within the scope of the new BSI Act has not been examined. No notice has arrived from the federal office, and from that it is concluded that the question is answered.

No notice arrives from the federal office

What the examination sets out from is usually the expectation that the authority will approach the entities in scope. The Act reverses the order. Section 33(1) BSIG addresses the duty to register to the entity, and under section 33(3) BSIG the federal office may register an entity itself only where that duty is not met.

A scoping questionnaire is available on the pages of the federal office, and as to its weight the office says what is needed itself.

The scoping check does not replace the examination for self-identification and carries no evidential weight for any proceedings.

That leaves the entity’s own record, and section 33(4) BSIG gives it its function. Where facts justify the assumption that an entity has omitted to register, it has to produce documents and give information on request. A dated result of an examination would then be the answer to that.

The classification follows the activity, not the register

What the classification turns on is neither the objects clause nor the self-image. Annexes 1 and 2 to the BSIG each list seven sectors, and their types of entity are in many cases defined by an economic activity under the NACE Rev. 2 statistical classification. Mechanical engineering appears there as division 28 in Annex 2, and a machinery manufacturer above fifty employees would accordingly be an important entity.

Attribution within the group is not a matter of course

Whether the group’s figures count is either passed over or affirmed across the board, and both answers go past section 28(4) BSIG. Sentence 1 refers to Commission Recommendation 2003/361/EC and thus to attribution among partner and affiliated undertakings. Sentence 2 withdraws that attribution where the entity is independent of those undertakings as regards the design and operation of its information technology.

Two duties to register, and the second is overlooked

Whether the submission under section 33 BSIG settles the matter is decided by the type of entity. For the types named in section 60(1) sentence 1 BSIG, section 34(1) BSIG requires a second submission, with content of its own and its own period for changes. Managed service providers, cloud computing providers and operators of data centre services fall within it.

How we support you in the NIS2 assessment

The examination itself takes a few hours once the figures on the group structure are available. The effort lies in obtaining them, and it is therefore obvious to attach the examination to the annual accounts, where the same figures are assembled in any event. At the end there is a dated record, and where the result is positive, the registration.

With us the examination sits as part of the security of processing under Art. 32 GDPR. Representation before the federal office, defence in fine proceedings under section 65 BSIG and the liability of the management are legal advice outside our secondary field of law. They run through the affiliated law firm, lexICT legal Rechtsanwaltsgesellschaft.