Does NIS2 also apply to remote maintenance by external service providers?

Yes. External maintenance is a supply-chain risk under Section 30(2) no. 4 BSIG. Access by machine builders, OEMs or IT providers to your systems must be controlled, time-limited and logged. You remain responsible for the security of these accesses, even when a third party uses them.

What concrete requirements does Section 30 BSIG place on remote access?

Four of the ten minimum measures are most relevant: access control and personnel security (no. 9), multi-factor or continuous authentication and secured communications (no. 10), supply-chain security (no. 4) and secure maintenance plus vulnerability management (no. 5). For remote access this means RBAC, MFA, segmentation and complete audit trails.

Is multi-factor authentication mandatory for remote maintenance under NIS2?

In practice, yes. Section 30 BSIG names MFA explicitly. The ENISA guidance of 26 June 2025 reads the 'where appropriate' qualifier so narrowly that MFA is the baseline for internet-facing systems such as remote desktop and VPN. Without MFA you must document, per account class, why it is not appropriate. For privileged and remote access ENISA recommends phishing-resistant methods.

By when do I have to register with the BSI?

The deadlines have passed. The statutory registration deadline ended on 6 March 2026 and the follow-up deadline set by the BSI on 31 July 2026. The BSI calls on affected entities that have not yet registered to register in the BSI portal immediately (as of October 2026). The BSI does not name any further official deadline.

Can I still register after the deadline?

Yes. The BSI portal still accepts registrations, and the BSI explicitly calls for immediate registration. Registration is subject to fines. According to a heise report of 4 August 2026, the BSI had not initiated enforcement measures by then. That is not tolerance: a late registration remains a breach of duty, and the obligations under Section 30 BSIG apply regardless.

Is a classic VPN enough for NIS2-compliant remote maintenance?

Rarely. A flat site-to-site VPN usually grants the connected party access to an entire network segment, with no role-based restriction, no just-in-time logic and no session record. NIS2 requires least privilege, access control and auditability. A zero-trust approach (ZTNA) with identity-based, granular policies meets this far better.

Is management personally liable under NIS2?

Yes. Under Section 38 BSIG, management must implement and oversee the risk management measures, attend training regularly and is personally liable for breaches of duty. Fines reach up to EUR 10 million or 2 percent of worldwide annual turnover for essential entities (Section 65 BSIG).

NIS2 & Remote Maintenance: What the BSIG Now Requires (as of October 2026)

Q: How many entities have registered so far?

By 31 July 2026, 18,845 entities had registered according to heise, of which 6,490 are essential and 12,355 important entities. Around 29,500 were expected. The Federal Ministry of the Interior has commissioned the Federal Statistical Office to re-examine the number of entities required to register. Whether the estimate was too high or entities are missing is open. For an individual company, this does not change the duty to check its own scope.

Timo Wevelsiep26.06.2026Updated: 01.10.2026

#NIS2
#RemoteMaintenance
#ITSecurity
#OTSecurity
#ZeroTrust

Editorial note: The information in this article was compiled to the best of our knowledge at the time of publication. Technical details, prices, versions, licensing terms, and external content may change. Please verify the information provided independently, particularly before making business-critical or security-related decisions. This article does not replace individual professional, legal, or tax advice.

Want to make remote maintenance NIS2-compliant? We assess your remote access in a Security Audit and build sovereign remote management platforms that ship with RBAC, MFA and complete audit trails by default. Book an initial consultation.

NIS2 is no longer an announcement, it is law in force: Germany's NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) has been in force since 6 December 2025, and the BSI registration portal live since 6 January 2026. Around 29,500 entities were expected. The statutory registration deadline (6 March 2026) and the BSI follow-up deadline (31 July 2026) have passed; by the end of July, around 18,800 entities had registered (as of October 2026). The decisive question is no longer "whether" but "how provably".

One of the most concrete places where NIS2 bites is remote maintenance. That is exactly where external provider access, OT assets and internet exposure meet - the very points the BSI Act (BSIG) addresses explicitly. This article translates the obligations of Section 30 BSIG into concrete requirements for your remote access and shows how a sovereign remote-access platform maps to them. This article is general information and not legal advice.

NIS2 is live: where things stand in October 2026
Why remote maintenance is the pressure point
What NIS2 concretely requires for remote access
Seven requirements for NIS2-ready remote access
How a sovereign remote-access platform maps to it
How we work at WZ-IT
Further reading

NIS2 is live: where things stand in October 2026

The key facts, verified against primary sources (as of October 2026):

In force since 6 December 2025. With the promulgation of the NIS2UmsuCG, the new sections of the BSIG apply directly - including the risk management and reporting obligations (BSI press release).
Registration with the BSI. The portal has been available since 6 January 2026. The three-month registration window closed on 6 March 2026, and the follow-up deadline subsequently set by the BSI on 31 July 2026. The BSI NIS-2 page (German) states that the statutory deadline has expired and calls on entities that have not yet registered to do so immediately.
Who is in scope. Rule of thumb: 50 or more employees, or EUR 10 million annual turnover, in one of 18 regulated sectors. The act distinguishes essential and important entities with different thresholds and depth of obligations.
Reporting obligations. Significant security incidents must be reported in stages under Section 32 BSIG: early warning within 24 hours, a confirmation/update within 72 hours, and a final report after one month.
Liability and fines. Management is personally liable (Section 38 BSIG). Fines reach up to EUR 10 million or 2 percent of worldwide annual turnover for essential entities, and EUR 7 million or 1.4 percent for important entities (Section 65 BSIG).

Important: there is no formal grace period for the substantive obligations. The deadlines concerned registration; the security measures under Section 30 BSIG have applied since 6 December 2025.

Registration status after the follow-up deadline

Metric	Value	Source
Expected entities (Federal Statistical Office estimate)	around 29,500	heise, 4 August 2026
Registered by the statutory deadline (6 March 2026)	around 11,500	heise
Registered by 31 July 2026	18,845	heise
of which essential entities	6,490	heise
of which important entities	12,355	heise

According to heise, the BSI considers the status "generally satisfactory", even though some entities have not yet met their obligations, or not fully. The Federal Ministry of the Interior has commissioned the Federal Statistical Office to re-determine the number of entities required to register. Registration is subject to fines; the BSI had not initiated enforcement measures by early August.

In practice this means: anyone who has not yet checked whether they are in scope should do so and, where applicable, register right away. A missing registration is only the most visible part. In a later audit or after a reportable incident, the regulator asks about the measures under Section 30 BSIG, and remote access is one of them.

Why remote maintenance is the pressure point

Remote maintenance combines three risks that NIS2 deliberately targets:

External access = supply chain. When a machine builder, OEM or IT provider reaches into your systems, that is supply-chain security in the sense of Section 30(2) no. 4 BSIG. Responsibility for that access stays with you.
OT meets IT. In production and building technology, remote maintenance reaches deep into operational technology. A compromised maintenance access there is not just a data leak but an asset and safety risk.
Internet exposure. Classic remote maintenance often hangs on exposed services - precisely the attack surface for which NIS2 demands strong authentication and segmentation.

Reality often looks different: a shared VPN account, shared passwords, a tool from someone else's cloud, and no record of who did what and when. Under NIS2, that is no longer tenable.

What NIS2 concretely requires for remote access

Section 30(2) BSIG lists ten minimum measures (statutory text). Four of them land directly on remote maintenance:

No. 9 - access control, personnel security, ICT system administration. This is the basis for role-based permissions (RBAC) and the least-privilege principle: every access only as far as the task requires.
No. 10 - multi-factor or continuous authentication and secured communications. MFA is named explicitly. The ENISA Technical Implementation Guidance of 26 June 2025 reads the "where appropriate" qualifier so narrowly that MFA is effectively the standard for internet-facing systems such as remote desktop and VPN; for privileged and remote access it recommends phishing-resistant methods (FIDO2, passkeys).
No. 4 - supply-chain security. Third-party access must be contained both contractually and technically: defined roles, limited reach, revocable at any time.
No. 5 - secure maintenance and vulnerability management. Maintenance access itself is software that must be patched and monitored - including the remote tools and gateways in use.

On top comes the reporting duty under Section 32 BSIG: a 24-hour early warning can only be met if you can reconstruct what happened. Without complete audit trails over every remote session, that is impossible.

Seven requirements for NIS2-ready remote access

The obligations translate into an auditable checklist:

RBAC / least privilege. Role-based policies instead of shared accounts. Who can reach which asset is defined explicitly, not handed out by accident through network topology. Deeper dive: RBAC and audit for remote access.
MFA for every access. Multi-factor authentication tied to an identity provider/SSO, phishing-resistant for privileged sessions.
Complete audit trails. Who, when, from where, onto which system - logged and ideally recorded per session, with adequate retention.
Just-in-time and time-limited. Access is granted for a maintenance window and expires automatically. No standing accounts for external parties.
OT/IT separation and segmentation. Remote access ends at exactly the machine, not in the whole production network. Microsegmentation instead of a flat VPN.
Controlled supplier access. External parties get their own tightly scoped, instantly revocable accounts - no shared password, no shared tunnel.
Sovereignty and patchability. The platform runs self-hosted or in the EU, with no data flowing into foreign clouds, and is patched like any other software - backed by continuous CVE monitoring.

How these points connect legally is covered in our knowledge article on NIS2-compliant remote access.

How a sovereign remote-access platform maps to it

A modern zero-trust approach (ZTNA) meets these requirements more structurally than a classic VPN. Self-hosted platforms such as NetBird, Headscale or a cleanly built WireGuard stack deliver:

Identity-based policies instead of IP reach: access depends on user and role, MFA/SSO sit at the entrance - covering RBAC and authentication.
Granular microsegmentation: peer-to-peer connections to exactly the released hosts, not the whole subnet - the required OT/IT separation.
Expiring access and setup keys with a validity period: the technical basis for just-in-time and supplier access.
Central logs and session records: the audit-trail foundation for Section 32.
Data sovereignty: the control plane runs on your infrastructure, without dependence on a US SaaS remote-maintenance tool.

That this holds up in production is shown by our references: secure machine remote maintenance at ABCO Water Systems in Australia and the platform for nextGYM in Germany. Both rely on sovereign, logged remote access rather than open tunnels.

How we work at WZ-IT

We treat NIS2-compliant remote maintenance as a build project with evidence, not a tool purchase:

Inventory in a Security Audit. We map every existing remote access, the external accounts and the OT touchpoints and compare them against the obligations of Section 30 BSIG - see Security Audit.
A platform, not patchwork. We build the remote management platform with RBAC, MFA, segmentation and audit trails as the default - self-hosted and revocable.
Operations with an SLA. Patches, CVE monitoring and access reviews run continuously so the evidence does not decay after go-live.

That turns an abstract legal obligation into an auditable, documented architecture - exactly what regulators and management want to see.