NIS2 Registration with BSI: Step-by-Step Guide

NIS2 Registration with the BSI: Deadline, Access and Process

Register through the BSI portal after checking whether your organisation is in scope. If your registration deadline has passed, complete registration promptly. This guide covers the access requirements, the information to prepare and the responsibilities after submission. It does not assume that every organisation had the same deadline.

Who Must Register?

Use § 28 BSIG and Annexes 1 and 2 to establish the entity category. Size thresholds, the type of activity and exceptions all matter; some providers are covered regardless of size. Domain-name registry service providers are also subject to § 33(1). Certain digital service providers have additional registration obligations under § 34. Operators of critical facilities must also follow the applicable KRITIS registration rules and current BSI instructions.

If you are unsure whether your organisation is covered, start with our NIS2 applicability checker. The calculator guides you through the relevant thresholds for your industry and delivers a traffic-light classification as important or particularly important entity.

Prerequisites Before Registration

Before opening the BSI portal, you should prepare four things. This saves time and prevents interruptions in the middle of the form.

• 1.ELSTER organisation certificate: Check whether a suitable certificate already exists and who is authorised to use it. If a new certificate is needed, allow time for activation and postal delivery. Check current timing with ELSTER; there is no guaranteed five-day turnaround.
• 2.Mein Unternehmenskonto (MUK): The central business administration portal of the German federal government at service.mein-unternehmenskonto.de. You need the ELSTER certificate to set it up.
• 3.Registration data: Name, legal form, register number where applicable, address, email and phone, public IP ranges, sector or industry, relevant EU Member States and competent supervisory authorities.
• 4.Contact details and responsibilities: Prepare monitored contact channels, contact persons and deputies. An operational escalation path is useful; a blanket statutory 24/7 contact requirement for all NIS2 entities does not follow from § 33(1).

Step 1: Apply for the ELSTER Organisation Certificate

The ELSTER organisation certificate is used to authenticate through MUK. Follow the current ELSTER registration and activation instructions. Arrange who receives the activation letter and who manages access. Do not base your registration deadline on an assumed fixed postal delivery time.

1. Go to elster.de and select "Create account".
2. Choose the account type "Organisation" (not "Private individual").
3. Enter your company tax number and postal address. The tax number must exactly match the company name registered with the tax authority.
4. Confirm your email address and wait for the activation letter.
5. Complete activation using the details supplied by ELSTER. Store the certificate securely and restrict access to authorised users.

Common mistakes: Wrong account type selected (private individual instead of organisation), tax number does not match the official company name, or the .pfx file was not stored securely and is lost after changing computers. Store the certificate in a secure, access-controlled location immediately.

Step 2: Set Up Mein Unternehmenskonto (MUK)

Mein Unternehmenskonto (MUK) is the central business administration portal of the German federal government. It links the ELSTER certificate to your company identity and enables single-sign-on access to all connected federal authority portals, including the BSI portal. BSI registration is not possible without MUK.

1. Go to service.mein-unternehmenskonto.de.
2. Sign in using your ELSTER Organisation Certificate.
3. Complete the company details: legal form, commercial register number, business address.
4. Confirm the link. Your MUK account is immediately usable afterwards.

MUK is not only relevant for BSI registration. It will be the central access point for all digital government services at federal level in the long term. Set it up carefully and designate a responsible person internally for managing access.

Step 3: Register in the BSI Portal

The BSI portal at portal.bsi.bund.de is the actual registration location. Allow 30 to 45 minutes to complete the form once all information is ready.

1. Go to portal.bsi.bund.de and sign in via the MUK login.
2. Select "Register entity" in the dashboard.
3. Enter complete company details: company name, legal form, commercial register number, address, contact person.
4. Select the relevant sector or industry under Annex 1 or 2 BSIG and check your classification as an important or particularly important entity.
5. Enter the public IP ranges relevant to your entity in the format requested by the portal. Private network ranges are not public IP ranges.
6. Prepare the relevant EU Member States and competent federal or state supervisory authorities. Complete any additional fields shown by the portal for your entity type.
7. Enter current contact details and the contact persons requested by the portal. Define responsibility for monitoring messages and keeping these details current.
8. Check and submit the registration. Retain the submission record and any reference numbers supplied by the portal; do not assume a fixed confirmation turnaround.

Prepare public IP ranges in CIDR notation, for example 203.0.113.0/24. This is a documentation example, not an address to submit. Follow the current portal instructions for IPv4, IPv6 and multiple entries.

Step 4: Set Up the Contact Point and Reporting Channels

For ordinary NIS2 registration, § 33(1) requires current contact details. § 33(3) concerns registration by the BSI if an entity fails to fulfil its obligation; it does not prescribe a particular IT security role. Organise message monitoring, cover and escalation to the incident response team.

There is no general exclusion of managing directors as contacts in § 33(1). Choose contacts based on availability, authority and the internal response process. Operators of critical facilities are a separate case: the BSI describes an always-reachable contact point for them. Follow its current KRITIS instructions and the transitional rules in § 66 BSIG. Source: BSI reporting-point overview

Prepare the separate incident-reporting process under § 32 BSIG: early warning without undue delay and within 24 hours of becoming aware of a significant incident; the incident notification within 72 hours; the final report no later than one month after that notification. Ongoing incidents require a progress report instead. Practise the process internally without submitting fictitious incidents to the authority. Source: § 32 BSIG

After Registration: The First 30 Days

Save the registration record and the identifiers supplied by the portal. Assign responsibility for reviewing and updating the data. Registration is one administrative step; it does not replace risk management, executive responsibilities or incident reporting.

• •Internal documentation: Store the registration number, registration date, and designated contact point in your compliance system. This is the first piece of evidence for your NIS2 compliance file.
• •Communication to senior management: Under § 38 BSIG, senior management must be demonstrably informed about NIS2 obligations and participate in training. Use the successful registration as an occasion for a first management briefing session.
• •Document the first risk management cycle: Under § 30 BSIG you are obliged to implement appropriate risk management measures. Document the start of your first risk assessment cycle immediately after registration. Document findings, owners and the next measures.
• •Test the reporting process: Simulate a hypothetical security notification internally to ensure all responsible parties know the 24h/72h/one-month chain. Document the test.

Avoid Common Mistakes in BSI Registration

These five mistakes come up most frequently when we support organisations through the registration process:

1. 1.Access arranged too late: Check existing certificates and authorisations first. Allow for activation and postal delivery if you need a new certificate.
2. 2.Wrong sector classification: Incorrect assignment to Annex I instead of Annex II or vice versa can lead to the wrong entity category with different (higher or lower) obligations. Review the BSI sector definitions and seek legal advice if in doubt.
3. 3.IP ranges entered incorrectly: The form expects CIDR notation. Single IPs without /32, IP ranges with hyphens, or missing subnet masks cause validation errors. Prepare the list in a text editor beforehand.
4. 4.No message-handling responsibility: A contact entry alone is not a response process. Assign monitoring, cover and escalation; choose the role based on these responsibilities.
5. 5.Registration confused with incident reporting: The three-month registration deadline is separate from the 24-hour and 72-hour reporting deadlines. Set up an internal response process that can meet them.

Fine Framework for Missing Registration

An intentional or negligent failure to submit registration details, or submitting them incorrectly, incompletely or late, falls under § 65(2) no. 6 BSIG. The applicable maximum fine is EUR 500,000 under § 65(5) sentence 1 no. 5. Other offences have their own fine limits; repeated registration failures do not automatically trigger the EUR 10 million or 2% limit. Source: § 65 BSIG. An overdue registration should be completed promptly; this does not guarantee lenient treatment.

Frequently asked questions