In short: The EU directive NIS2 obliges significantly more companies than before to take risk management measures and to report significant security incidents. In Germany it is implemented through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG, a German law); the competent authority is the BSI (German Federal Office for Information Security). For web servers, this mainly means: updates, vulnerability management and incident handling must be organized and verifiable. This page is general information, not legal advice.
Not legal advice: whether your company falls under NIS2 and which obligations apply in detail, you clarify on the basis of the BSI's information and with legal advice. We deliberately state no thresholds or deadlines that depend on how you are classified.
What NIS2 is
NIS2 is the second EU directive on network and information security. It considerably widens the circle of obligated companies compared with the earlier rules and distinguishes between essential and important entities. Which sectors and size classes are covered is set out in the law.
In Germany, the NIS2UmsuCG implements the directive and, for that purpose, among other things, restructures the BSI Act. The BSI is the point of contact for registration, reporting and supervision and provides information and aids for classification on its website. You will find reliable, up-to-date information on deadlines and procedures there, not in general summaries.
NIS2 obligations for companies at a glance
For affected companies, the obligations can be roughly grouped into three areas:
Risk management. Companies must take appropriate and proportionate technical and organizational measures. These typically include concepts for risk analysis and information security, handling of security incidents, maintaining operations with backups and crisis management, supply chain security, security in procurement, development and maintenance including vulnerability handling, access control and cryptography.
Reporting. Significant security incidents are to be reported to the BSI. The directive provides a staged procedure for this, from an early first notification to a final report. For the exact deadlines and reporting channels for Germany, consult the BSI's information.
Responsibility of management. Senior management must approve the measures, oversee their implementation and undergo training in cybersecurity matters. More under Liability of management.
What this means for web servers
Web servers are often a company's most exposed system. PHP2Shell shows how quickly a vulnerability in a basic component can affect all the applications running on it. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 allow code execution without logging in; the BSI has declared warning level 3 (orange) and recommended an immediate update.
For a company subject to NIS2, practical questions follow: do we know which servers use PHP and in which version? Who follows security announcements and decides on emergency updates? Can we detect an attack, and who assesses whether an incident is significant and therefore reportable? Is it settled what the host and service providers take on?
A patch does not remove malware that was planted earlier and does not prove that nothing happened. That, too, is part of the incident assessment.
Concrete measures for the web infrastructure
The following points are not an exhaustive list, but they cover the most common gaps:
| Measure | Relates to |
|---|---|
| Inventory of all web servers, PHP versions and applications | Risk analysis |
| Fixed procedure for security updates incl. restart and evidence | Vulnerability management |
| Monitoring and log retention | Incident handling |
| Tested backups and recovery plan | Business continuity |
| Division of tasks with host and agencies in writing | Supply chain |
| Multi-factor authentication for admin access | Access control |
| Prepared reporting channels and responsibilities | Reporting obligations |
The BSI's IT-Grundschutz is suitable as a methodological framework. An IT emergency plan for web servers ties together technology, responsibilities and reporting channels.
Thinking NIS2 and data protection together
An attack on a web server can be a NIS2 incident and a data protection breach at the same time. Two procedures then run in parallel, with different authorities and requirements. The notification to the data protection supervisory authority under Art. 33 GDPR is described in GDPR reporting obligation: 72 hours. Plan both routes in advance so that nobody has to improvise in an emergency.
Another point concerns service providers. Many companies have agencies look after their websites and hosts run their servers. The duty to take supply chain risks into account means in practice: regulate by contract who applies security updates, how quickly critical vulnerabilities are handled, how you are informed about incidents and what evidence you receive. The PHP2Shell situation is a good touchstone for whether these arrangements already exist and worked in an emergency. If an answer is missing, that is an item for your risk management.
How does PHP SOS help?
- We record your web infrastructure and assess risks and gaps in a form you can use for your risk management.
- We set up a verifiable procedure for security updates and, on request, take it over through a security maintenance contract.
- With security monitoring and log retention, we create the basis for detecting and assessing incidents.
- In an incident, we provide the technical facts for your notification to the BSI; the legal classification remains with you and your legal advisers.
Frequently asked questions
Is my company affected by NIS2?
That depends, among other things, on the sector and the size of the company. The exact criteria come from the German implementing act. The BSI provides information on whether you are affected on its website; if in doubt, clarify the question with legal advice.
What does NIS2 mean for a company website?
Web servers, customer portals and shops are among the systems whose risks an affected company must manage. This includes updates, vulnerability management, access control and the ability to detect and report incidents.
Which reporting deadlines apply under NIS2?
The directive provides for a staged reporting procedure for significant security incidents. For the binding deadlines, channels and forms for Germany, consult the information from the BSI and the text of the law. We deliberately do not state deadlines here without reference to your situation.
Does NIS2 also apply to suppliers?
NIS2 requires affected entities to also consider the security of their supply chain. That is why many customers ask their service providers and suppliers about security measures, even if these are not directly subject to the law themselves.