Broad SME outreach
Targeted outreach to organisations and decision-makers to get a realistic picture of how relevant NIS-2 was perceived to be at the time.
Project archive · Technical University of Munich · 2025
Practical implementation of NIS-2 in small and medium-sized enterprises
Empirical study of implementation barriers and development of a standardised self-assessment model.
Summary
From abstract duties to concrete work packages
The project examined how mid-sized organisations perceive NIS-2, which internal and external barriers make it hard to get started, and how a structured self-assessment can help.
1,800SMEs in the empirical outreach
3,600email contacts over the course of the study
17semi-structured expert interviews
1standardised self-assessment model
Approach
Research design
Expert interviews
17 semi-structured conversations with people responsible for IT security, IT leadership, management and compliance, analysed in anonymised form.
Assessment model
Turning the findings into a traceable self-assessment with maturity levels and topic areas that can be prioritised.
Context: The field phase ran from 28 May to 15 July 2025. The qualitative sample of 17 interviews provides in-depth practical insight but is not statistically representative of German SMEs as a whole.
Interview findings
Why many companies had not yet taken action
The conversations revealed recurring organisational patterns, not just technical gaps.
Regulatory uncertainty
Unclear applicability and open national details encouraged a wait-and-see attitude and made firm decisions harder.
Time and documentation
Scarce staff capacity, budgets and evidence obligations were often described as a greater burden than individual technical measures.
Need for concrete guidance
Interviewees wanted clear, SME-friendly steps and a better fit with existing standards and processes.
Result
A tool for a pragmatic start
The self-assessment creates a shared working basis for management, IT and information security.
Transparent implementation status
37 questions on implementation and 37 mirrored questions on evidence make existing measures and documentation gaps visible separately.
From gap to roadmap
Identified gaps can be translated into concrete work packages and prioritised by risk, effort and dependencies.
Using existing standards
Mappings to ISO/IEC 27001, TISAX and BSI IT-Grundschutz help reuse existing ISMS structures.
Management-ready reporting
A standardised view of status and priorities improves alignment between specialists and decision-makers.
Research transfer
The model is available as a free tool
The NIS-2 self-assessment that came out of the project is provided by HvS-Consulting and can be used as a starting point for a structured review.
References covered
NIS-2
ISO/IEC 27001
TISAX
BSI IT-Grundschutz
Continuation
From the bachelor's thesis to the NIS-2 Realitätscheck
The first study took place during a period of regulatory uncertainty and a strong wait-and-see attitude. After the German NIS-2 implementation act came into force, the research design was continued in 2026 as a longitudinal follow-up study.
The results were presented at BSides Munich 2025, the BSI's 21st German IT Security Congress and the Elbsides Conference 2026.
Project status: The interview phase is complete. This page is an archive, not an open invitation to take part in the study.
Academic context
Technical University of Munich
The project was carried out as a bachelor's thesis in Information Systems at the Chair of Cyber Trust at the Technical University of Munich, supervised by Prof. Dr. Jens Großklags.
Author: Younes Ahmadzei.
This page is not an official publication of the Technical University of Munich.
Get in touch
Questions about the research project?
For professional exchange about the study, the assessment model or talks.