NIS-2: More than 18,000 companies are missing from the BSI portal. What’s behind this?

The deadline to register for NIS-2 with the German Federal Office for Information Security (BSI) was March 6, 2026. The result? Only about 11,500 of an estimated 29,850 affected German companies registered on time. (Source: Security Insider, March 10, 2026) Many commentaries point to negligence. However, a closer look reveals a different pattern, particularly in the healthcare sector.

What’s at stake?

This distinction is important, but it does not change the consequences. Organizations that miss the deadline can expect fines. The BSI can order compliance audits and scrutinize an organization’s entire security framework in serious cases.

Furthermore: Registration was only the first step. Most organizations still have their actual NIS-2 obligations ahead of them. Significant security incidents must be reported within 24 hours. Regular security audits will also become mandatory. Employees must be trained. For organizations that were unable to handle registration on their own, implementing these requirements without external support is hardly realistic.

Catching up systematically instead of improvising

The good news is that: The BSI is open to late registrations. The significant increase in registrations in the final days before the deadline suggests that there is a fundamental willingness to comply. The key now is to catch up systematically, not haphazardly.

An external perspective can help you realistically assess your NIS-2 status and prioritize next steps. No one-time consultation can replace developing your own expertise within the organization. However, structured support creates the foundation upon which all further measures are built.

For healthcare organizations facing this exact challenge, sepp.med offers cybersecurity consulting focused on NIS-2 compliance. The focus is on pragmatic implementation, including gap analysis, registration, and preparation for incident reporting and audit requirements.

Sources

• Security Insider: Run auf BSI-Registrierungsportal, 10.03.2026
• European Parliament and Council of the European Union: Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive).