When does awareness turn into concrete action?
What role do legislation, liability, customer requirements and supply chains play in getting organisations to actually start?
Research archive · Phase 1 and Phase 2
NIS-2 in German SMEs: from waiting to implementing
The NIS-2 Realitätscheck combines qualitative research, a longitudinal follow-up study and practical experience from information security consulting.
Project overview
Regulatory ambition meets operational reality
The study asks not only whether companies know about NIS-2, but what actually slows implementation down in day-to-day work and which tools people really adopt.
1,200+SMEs contacted in the follow-up study
18usable questionnaires in Phase 2
6in-depth interviews in Phase 2
2consecutive research phases
Research questions
What the study examines
Where does the most friction arise?
How do scarce resources, unclear responsibilities and translating requirements into reliable evidence interact?
What support works in practice?
Whether standardised self-assessment and mappings to established standards make it easier to start and make priorities visible.
Key observations
The hurdle is not only technical
The Phase 2 figures refer to the descriptive sample of 18 usable questionnaires.
Lack of time and staff
A lack of time and staff was the most frequently named practical barrier to implementation.
Documentation is a burden
Documentation and bureaucracy were raised as problems far more often than the technical complexity of individual measures.
Lack of concrete guidance
Missing guidelines and unclear requirements made it harder to translate regulatory duties into workable tasks.
Read with care: 67% of respondents described NIS-2 mainly as an administrative or liability-driven obligation; 11% saw it as a driver of security culture. Because the sample is small and self-selected, these figures cannot be extrapolated to all German SMEs.
From research project to community
Development 2025–2026
2025 · Phase 1
Bachelor's thesis project at TUM
Empirical outreach to 1,800 SMEs, 17 expert interviews and development of a standardised assessment model.
Nov. 2025
BSides Munich
First public presentation of the study, under the title “In Scope, Out of Sight”.
Q1 2026 · Phase 2
NIS-2 Realitätscheck
Longitudinal follow-up study after the German NIS-2 implementation act came into force.
April 2026
21st German IT Security Congress
Presentation of the current results at the BSI; the contribution was nominated for the Best Student Award.
June 2026
Elbsides Conference
Putting the Phase 2 results in context for the security community in Hamburg.
Research transfer
NIS-2 self-assessment for SMEs
The first research phase produced an Excel-based maturity model. It translates the requirements of NIS-2 Articles 20, 21 and 23 into 37 questions on implementation and 37 mirrored questions on evidence.
Maturity & mappings
Maturity levels 0–5
ISO/IEC 27001
TISAX
BSI IT-Grundschutz
Transparency
Context and sources
Project status: The online survey has ended. This page serves as a research archive, and no survey data is collected here any more. The notices that applied at the time remain available in the survey privacy archive.
Public descriptions of the research design and talk content can be found on the official pages of BSides Munich 2025 and the Elbsides Conference 2026. Journalistic coverage of the BSI congress is available from heise online.
The project was carried out as independent student work at the Technical University of Munich. The content of this website is not an official publication of TUM, the BSI or HvS-Consulting.
About the author
Younes Ahmadzei
Information Security Consultant.