# NIS2 Module: Section 30 BSIG, Reporting | SpeamCore > Applicability check under Section 28 BSIG, Section 30 check with maturity level, IT inventory, supplier check and reporting clock: the NIS2 module in SpeamCore. Quelle: https://speam.io/en/nis2/ [All modules ](https://speam.io/en/speamcore/#module) SpeamCore module · compliance # NIS2 does not ask whether you mean it. It asks what you can prove. The NIS2 module brings the scope check, the ten measure areas of §30 BSIG, IT inventory, supply chain, document control and reporting into one place — with a maturity rating instead of gut feeling. [Is my company in scope for NIS2?](#check) [Request a demo](#kontakt) 10 measure areas under §30 BSIG A–E maturity per area and overall 24 / 72 h initial and assessment report ## Where NIS2 projects fail in practice "Are we even in scope?" Sector, size class and special cases decide it — and nobody wants to answer the question bindingly. Without an answer, no project starts. "Our provider takes care of that." NIS2 requires security across the supply chain. Without clauses on reporting duties, audit rights and exit, the risk sits with you. "We wrote that policy." Written is not enough. It only becomes provable with a revision status, a release and read receipts. ## From scope to an on-time report. Scope ### Guided check under §28 BSIG Sector under Annex 1 or 2, size class and special cases — the result tells you whether you are an essential or an important entity, with an overview of registration, reporting duties and fines. §30 check ### Ten measure areas, one maturity rating From risk management through backup and access control to cryptography and personnel security. Every question is scored, the result is a maturity rating from A to E per area — gaps become measures in one click. IT inventory ### What needs protecting Systems, external resources and information with protection category, network segment and the recovery parameters MTD, recovery time and fallback operation. Active systems without a recovery plan are flagged. Supply chain ### Five clauses per provider Category, access to systems, data and sites — plus the contract check on security requirements, incident reporting, audit rights, subcontractors and exit strategy. Missing clauses and residual risk at a glance. Document control ### In force, not just on file Guidelines, policies, procedures and plans with revision status, next review date, release by the responsible role and read receipts from employees. Reporting ### 24 h, 72 h, one month The reporting clock tracks all three stages. You fill in the mandatory details under §32 BSIG in structured form and export them as a PDF — submission happens in the BSI portal, after which "Reported now" stops the clock. ## Ten areas. One honest maturity rating. The §30 check captures the status quo across all ten BSIG measure areas. Every answer is scored, every area gets a maturity rating from A to E — and wherever a gap appears, it becomes a measure with an owner and a deadline. Individual areas can be delegated to subject owners; you adopt their drafts in one click. The structure follows VdS 10100 as a guide. The guideline is referenced by source, not reproduced. Risk management and policies §30 (2) no. 1 Maturity B Backup, recovery and crisis management §30 (2) no. 4 Maturity C Supply chain security §30 (2) no. 5 Maturity D Access control and cryptography §30 (2) no. 8 and 9 Maturity B ## The deadlines the BSIG sets Initial report of a significant security incident §32 BSIG 24 hours Assessment report with initial evaluation §32 BSIG 72 hours Final report with causes and measures §32 BSIG 1 month Registration with the BSI once in scope §33 BSIG once, then on change Training for management and staff §38 BSIG regularly Proof of implementation to the BSI §39 BSIG every three years ## Is my company in scope for NIS2? Sector and size class are enough for an initial assessment under §28 BSIG. Group structures and sector exemptions need legal review. 1Sector under BSIG Annex 1 — sectors of high criticality Annex 2 — other critical sectors 2Company size Employees people Annual revenue €m Thresholds under §28 BSIG: from 250 employees or €50m revenue the higher class applies, from 50 employees or €10m the lower one. One figure is enough. [Walk through it with us ](#kontakt) ## Five steps to a defensible position 1 ### Establish scope The guided §28 check tells you whether you are an essential or an important entity — and which duties follow. 2 ### Register with the BSI The registration assistant leads you to the official portals and records progress under deadlines and obligations. 3 ### Run the §30 check Score ten areas, determine the maturity rating, turn gaps into measures — delegated to subject owners where needed. 4 ### Inventory and supply chain Record IT systems with recovery parameters and check provider contracts against the five clauses. 5 ### Rehearse reporting Run through an incident: reporting clock, mandatory details under §32, PDF export. When it counts, the drill is known. ## The catalog is maintained, not written once. Assessment questions, obligations and reporting steps arrive as a centrally maintained partner catalog and are updated whenever the law changes. If KRITIS is booked as well, both modules carry the same incident down two reporting paths — BSI for NIS2, the BBK path for KRITIS. You maintain it once, the reporting clock tracks both chains of deadlines. Until the partner's technical release, the NIS2 catalog carries the note "Catalog: draft". You can already work with it in full. ## One price for the entire NIS2 module. €299.00 / month plus VAT · price in draft status, being finalized with the specialist partner Scope check and BSI registration assistant §30 check across all ten measure areas IT inventory with recovery planning Provider contract check and document control Reporting with clock and PDF export Shared compliance core with KRITIS and QM [Request a demo](#kontakt) Compliance module family ## One compliance core. One module per regulation. Desk, evidence file, action plan, incidents and risk register live in the compliance core. Each regulation is added as its own module — you only book what applies to you. [ Quality management (ISO 9001) available Processes with approvals, internal audits, management review, CAPA and quality objectives. ](https://speam.io/en/qualitaetsmanagement/) [ KRITIS (German KRITIS Act / CER) available Physical protection of critical facilities: obligation catalog, checks, site walks, reporting clock. ](https://speam.io/en/kritis/) NIS2 (BSIG) You are here Information security under §30 BSIG, reporting and supply chain — shares desk, incidents and evidence file with KRITIS. ISO 27001 planned Information security management system with control catalog and audit preparation. DORA planned Digital operational resilience for financial firms and their ICT providers. ## Questions we hear often How does NIS2 relate to KRITIS? NIS2 is information security, KRITIS is physical protection and resilience. Both modules share desk, incidents, evidence file and risk register — one incident can carry both reporting paths. Does the system submit the report to the BSI? No. It prepares the mandatory details under §32 and tracks the deadlines. Submission goes through the BSI portal; you then mark "Reported now" and the clock stops. What does the maturity rating A to E mean? It condenses the answers per measure area into a grade. Management and auditors see at a glance where you stand and where the gaps are. Do we need ISO 27001 certification for this? No. NIS2 requires appropriate measures, not certification. The VdS 10000 roadmap is included if you want to formalize the proof. Why does the catalog say "draft"? The partner's final technical sign-off is still pending. You can already work with the content in full. Who maintains changes in the law? The specialist partner. When a requirement changes, the catalog changes — the delta comparison shows which of your evidence is affected. ## One hour, one honest maturity rating. We walk through the scope check with your figures and score two or three areas of the §30 check live — after that you know where you stand. [Request a demo ](mailto:info@speam.io) [View SpeamCore](https://speam.io/en/speamcore/)