SpeamCore module · compliance
NIS2 does not ask whether you mean it. It asks what you can prove.
The NIS2 module brings the scope check, the ten measure areas of §30 BSIG, IT inventory, supply chain, document control and reporting into one place — with a maturity rating instead of gut feeling.
10
measure areas under §30 BSIG
A–E
maturity per area and overall
24 / 72 h
initial and assessment report
Where NIS2 projects fail in practice
"Are we even in scope?"
Sector, size class and special cases decide it — and nobody wants to answer the question bindingly. Without an answer, no project starts.
"Our provider takes care of that."
NIS2 requires security across the supply chain. Without clauses on reporting duties, audit rights and exit, the risk sits with you.
"We wrote that policy."
Written is not enough. It only becomes provable with a revision status, a release and read receipts.
From scope to an on-time report.
Scope
Guided check under §28 BSIG
Sector under Annex 1 or 2, size class and special cases — the result tells you whether you are an essential or an important entity, with an overview of registration, reporting duties and fines.
§30 check
Ten measure areas, one maturity rating
From risk management through backup and access control to cryptography and personnel security. Every question is scored, the result is a maturity rating from A to E per area — gaps become measures in one click.
IT inventory
What needs protecting
Systems, external resources and information with protection category, network segment and the recovery parameters MTD, recovery time and fallback operation. Active systems without a recovery plan are flagged.
Supply chain
Five clauses per provider
Category, access to systems, data and sites — plus the contract check on security requirements, incident reporting, audit rights, subcontractors and exit strategy. Missing clauses and residual risk at a glance.
Document control
In force, not just on file
Guidelines, policies, procedures and plans with revision status, next review date, release by the responsible role and read receipts from employees.
Reporting
24 h, 72 h, one month
The reporting clock tracks all three stages. You fill in the mandatory details under §32 BSIG in structured form and export them as a PDF — submission happens in the BSI portal, after which "Reported now" stops the clock.
Ten areas. One honest maturity rating.
The §30 check captures the status quo across all ten BSIG measure areas. Every answer is scored, every area gets a maturity rating from A to E — and wherever a gap appears, it becomes a measure with an owner and a deadline. Individual areas can be delegated to subject owners; you adopt their drafts in one click.
The structure follows VdS 10100 as a guide. The guideline is referenced by source, not reproduced.
Risk management and policies
§30 (2) no. 1
Backup, recovery and crisis management
§30 (2) no. 4
Supply chain security
§30 (2) no. 5
Access control and cryptography
§30 (2) no. 8 and 9
The deadlines the BSIG sets
Is my company in scope for NIS2?
Sector and size class are enough for an initial assessment under §28 BSIG. Group structures and sector exemptions need legal review.
Annex 1 — sectors of high criticality
Annex 2 — other critical sectors
Five steps to a defensible position
Establish scope
The guided §28 check tells you whether you are an essential or an important entity — and which duties follow.
Register with the BSI
The registration assistant leads you to the official portals and records progress under deadlines and obligations.
Run the §30 check
Score ten areas, determine the maturity rating, turn gaps into measures — delegated to subject owners where needed.
Inventory and supply chain
Record IT systems with recovery parameters and check provider contracts against the five clauses.
Rehearse reporting
Run through an incident: reporting clock, mandatory details under §32, PDF export. When it counts, the drill is known.
The catalog is maintained, not written once.
Assessment questions, obligations and reporting steps arrive as a centrally maintained partner catalog and are updated whenever the law changes. If KRITIS is booked as well, both modules carry the same incident down two reporting paths — BSI for NIS2, the BBK path for KRITIS. You maintain it once, the reporting clock tracks both chains of deadlines.
Until the partner's technical release, the NIS2 catalog carries the note "Catalog: draft". You can already work with it in full.
One price for the entire NIS2 module.
€299.00 / month
plus VAT · price in draft status, being finalized with the specialist partner
Compliance module family
One compliance core. One module per regulation.
Desk, evidence file, action plan, incidents and risk register live in the compliance core. Each regulation is added as its own module — you only book what applies to you.
Processes with approvals, internal audits, management review, CAPA and quality objectives.
Physical protection of critical facilities: obligation catalog, checks, site walks, reporting clock.
Information security under §30 BSIG, reporting and supply chain — shares desk, incidents and evidence file with KRITIS.
Information security management system with control catalog and audit preparation.
Digital operational resilience for financial firms and their ICT providers.
Questions we hear often
How does NIS2 relate to KRITIS?
NIS2 is information security, KRITIS is physical protection and resilience. Both modules share desk, incidents, evidence file and risk register — one incident can carry both reporting paths.
Does the system submit the report to the BSI?
No. It prepares the mandatory details under §32 and tracks the deadlines. Submission goes through the BSI portal; you then mark "Reported now" and the clock stops.
What does the maturity rating A to E mean?
It condenses the answers per measure area into a grade. Management and auditors see at a glance where you stand and where the gaps are.
Do we need ISO 27001 certification for this?
No. NIS2 requires appropriate measures, not certification. The VdS 10000 roadmap is included if you want to formalize the proof.
Why does the catalog say "draft"?
The partner's final technical sign-off is still pending. You can already work with the content in full.
Who maintains changes in the law?
The specialist partner. When a requirement changes, the catalog changes — the delta comparison shows which of your evidence is affected.
One hour, one honest maturity rating.
We walk through the scope check with your figures and score two or three areas of the §30 check live — after that you know where you stand.