Data Center: The Complete NIS2 Guide

Data center operators are directly subject to NIS2 Annex II No. 6 lit. d as providers of digital infrastructure - regardless of revenue, once the technical threshold of 3.5 MW average IT power consumption is reached or general SME thresholds are exceeded. As operators of critical infrastructure for many NIS2-obligated customers, data centers occupy a key position in the digital supply chain. This guide is written for data center operators, technical directors, and compliance managers.

Who is affected?

Data center operators fall under NIS2 Annex II No. 6 lit. d (data center service providers) when they have at least 50 employees or at least EUR 10 million in annual revenue. They are then Important Entities.

Additionally: those who exceed the 3.5 MW average IT power consumption threshold may fall into KRITIS categories depending on their classification and become Essential Entities under Annex I.

Colocation providers, cloud infrastructure operators, and hyperscalers are generally directly in scope. Corporate data centers providing services to third parties also fall within scope.

Obligations under § 30 BSIG-new

§ 30 BSIG-new requires seven obligation areas that are especially significant for data center operators because of the criticality of hosting infrastructure:

1. Risk analysis and management: Power supply (UPS, grid connection), cooling, network infrastructure, physical access, and all managed services must be assessed.
2. Incident handling: Failures affecting customer systems are reportable incidents. Incident response must coordinate customer communication and BSI notification.
3. Business continuity: Redundancy concepts (N+1, 2N) must be documented and regularly tested. RTO and RPO must be defined for all critical services.
4. Supply chain security: Power suppliers, cooling technology manufacturers, and network carriers must be reviewed for security standards.
5. Access control and MFA: Physical access (biometric, card) and logical access (MFA) must be documented and enforced for all zones.
6. Encryption: Customer data on storage systems must be encrypted at rest. Transmissions between data center and customers must be encrypted.
7. Training and awareness: Data center technicians, NOC staff, and administrative personnel must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

A power failure or cooling failure that impacts customer systems for more than one hour and affects NIS2-obligated entities is a reportable incident. Cyberattacks on data center management systems without proven data loss are also reportable.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: personal liability for management. Added to this is contractual liability to customers for SLA breaches caused by security incidents.

3.5 MW threshold: calculating average IT power consumption and EN 50600

The 3.5 MW threshold for direct KRITIS classification refers to the average IT load of the data center, not total power consumption. The calculation follows EN 50600-4-9 (energy performance indicators for data centers).

Calculation formula: Average IT power = Total power consumption / PUE (Power Usage Effectiveness). Example: a data center with a PUE of 1.5 and total power consumption of 6 MW has an IT load of 4 MW - exceeding the 3.5 MW threshold.

Relevant for classification: not individual racks or halls, but the entire data center at a location. Those operating multiple smaller sites must assess each site separately. EN 50600 also provides the documentation methodology required for BSI and regulatory proof.

First steps

1. Calculate your data center's average IT power consumption per EN 50600-4-9.
2. Check headcount and revenue against the SME thresholds.
3. Conduct a complete risk analysis covering power, cooling, connectivity, and physical security.
4. Inventory all customer systems and classify which are NIS2-obligated.
5. Create an incident response plan with a customer escalation matrix.
6. Review all maintenance contracts (cooling, UPS, network) for security clauses.
7. Register with the BSI.

Common pitfalls

PUE not factored into KRITIS calculation: The threshold refers to IT load, not total power. An incorrect calculation can lead to the wrong classification.

Physical security not treated as an IT security topic: Tailgating risks, insufficient zone separation, and missing CCTV logging are NIS2-relevant risks.

Customer security requirements not addressed contractually: NIS2-obligated customers will demand audit rights, incident notification, and security certifications. Those who are not contractually prepared will face pressure.

Redundancy tests only on paper: Planned redundancy that has not been tested is not reliable redundancy. Regular tests are a NIS2 obligation.

Use the industry-specific NIS2 calculator for data centers to determine your classification.