NIS2 vulnerability management: What § 30 BSIG requires

NIS2 vulnerability management: What § 30 BSIG requires from SMBs

The German NIS2 Implementation Act (NIS2UmsuCG) entered into force on December 6, 2025, with no transition period. On average, it brought 29,500 entities under BSI supervision, up from 4,500, including many mid-sized companies in the Mittelstand. Essential entities (besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen) must now manage vulnerabilities under § 30 BSIG of the NIS2UmsuCG.

Read the BSI announcement on the law taking effect here.

Large companies with a Security Operations Center (SOC) mostly had to adjust existing processes, but for mid-sized companies whose IT is often run by generalists, the questions are practical. What does the law actually require? And how do you meet it without building a robust security team?

This article explains what § 30 BSIG says about vulnerability management. It gives you a checklist and shows where continuous IT and OT assessment fits in.

What does § 30 BSIG require for vulnerability management?

§ 30 BSIG requires essential and important entities to take appropriate, proportionate and effective technical and organizational measures to protect the availability, integrity and confidentiality of the systems they use to provide their services, and to keep the impact of incidents as low as possible. These measures should follow the state of the art (Stand der Technik), and you must document your compliance. Paragraph 2 lists ten areas, and Nr. 5 names vulnerability management directly, which several of the other areas depend on.

Read the full text of § 30 BSIG here.

BSI guidance on Nr. 5 is concrete: entities should regularly scan their systems for known vulnerabilities, assess how critical each one is, and document every vulnerability found and every measure taken.

Read the BSI guidance on security measures and vulnerability management here.

Two points matter most for SMBs:

• Proportionality. Measures are weighed against your risk exposure, size, implementation cost, and the likelihood and severity of incidents. No one expects a 200-person manufacturer to run an enterprise SOC.
• Evidence. You need to show that you comply, and “we patch regularly” won’t do it. Scan history, remediation records, and reports will.

The law does not require continuous scanning, but a control that runs only once a year is hard to present as effective and state-of-the-art.

NIS2 checklist: Vulnerability management under § 30 BSIG

What about OT? Yes, if you rely on it to deliver your services. § 30 BSIG covers the IT systems, components, and processes you use to provide your services, and BSI counts OT, such as industrial control systems, among them. BSI guidance on vulnerability management addresses OT devices directly, so include the ones you rely on in your plan.

Four challenges SMBs face with vulnerability management under NIS2

1. The annual pentest trap

   Many Mittelstand firms have relied on an annual penetration test to answer auditor questions. A pentest gives deep insight into a single moment in time, so a critical vulnerability published the day after the test stays invisible until the next one. Penetration testing still has value, but it doesn’t replace ongoing vulnerability management. On its own, it’s hard to defend as an effective control.
   
   

2. Too many alerts, too little context

   Enterprise platforms often need dedicated staff to maintain scan settings and work through findings. A generalist handed a long report full of “critical” findings has no clear place to start, and severity scores alone don’t fix that. A medium-severity vulnerability that ransomware groups exploit matters more than a critical one that attackers have not yet exploited. Without that context, teams spend hours on the wrong fixes while exposed systems wait.
   
   

3. The IT & OT divide in manufacturing

   Many manufacturers keep office IT and factory-floor OT separate. Traditional scanners are often built only for IT, and running them against PLCs can disrupt production. A separate OT tool adds cost and a second view of risk, and it misses a basic fact: OT environments run on ordinary IT too. SCADA servers and engineering stations are often standard Windows machines. An IT-only tool and an OT-only tool each see half the picture.
   
   

4. Remediation built for generalists

   Your administrators shouldn’t need to be security specialists to fix a vulnerability. Findings should come with clear remediation steps, so your team can handle routine fixes without paying external consultants.

How continuous IT & OT assessment supports § 30 BSIG

Holm Security's Next-Gen Vulnerability Management Platform (VMP) brings exposure and vulnerability management for IT, cloud, web applications, and OT into one view:

• Continuous assessment of internal and external networks, with an up-to-date asset inventory.
• Risk-based prioritization that shows whether a vulnerability is exploited in the wild or used in ransomware attacks.
• OT assessment you control. A Scanner Appliance inside your network runs read-only default profiles. You can limit it to specific IP ranges, maintenance windows, and reduced packet rates, or start in a test environment. For Windows-based OT systems, the Device Agent collects inventory without probing the network. No vendor can promise zero impact on fragile devices, but you get full control over scope, schedule, and intensity.
• Remediation guidance your team can act on directly.
• Reports that document findings and fixes over time.
• Hosted in Europe so your vulnerability data stays in the EU.

Compliance that also makes you more resilient

NIS2UmsuCG asks for what good security practice already looks like. Know your assets, find vulnerabilities, fix what matters first, and be able to show it. With continuous assessment, risk-based prioritization and controlled OT coverage in one platform, a small IT team can cover the vulnerability management parts of § 30 BSIG without adding a dedicated security team.

See how Holm Security helps you reduce exposure across IT and OT and produce the evidence NIS2 asks for.

Book a demo today!

FAQ

1. Who must comply with § 30 BSIG?

   Essential entities (besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen) under NIS2UmsuCG. Whether you are in scope depends on your sector, headcount, and revenue. The BSI offers a free online check. Check whether NIS2 applies to you with the BSI scope check.
   
   

2. Does NIS2 require continuous vulnerability scanning?
   

   No, but it doesn’t set an interval either. § 30 BSIG requires effective measures that should follow the state of the art, and you must document your compliance. BSI guidance calls for regular vulnerability scans without saying how often. That leaves you to justify your interval, and a yearly scan is hard to defend when new vulnerabilities appear every day. Continuous assessment closes that gap and is the simplest way to show your measures work.
   
   

3. Is an annual penetration test enough to meet NIS2 risk management requirements?

   No, not on its own. In Germany, NIS2’s risk management requirements are set out in § 30 BSIG, which doesn’t name specific tests. It does, however, require effective measures that include vulnerability management and a way to evaluate whether your measures work. You must also be able to document compliance. A pentest covers one moment in time, so it can’t show that you find and fix vulnerabilities as they appear. BSI guidance calls for regular vulnerability scanning and says one-off security checks are not enough. Use a pentest to complement that.
   
   

4. Does § 30 BSIG apply to OT?

   It applies to the IT systems, components and processes you use to provide your services, and BSI counts OT you rely on among them. BSI guidance on vulnerability management addresses OT devices directly.
   
   

5. Who is liable under NIS2UmsuCG?

   Under § 38 BSIG, management must implement the risk management measures and oversee them. Managers who breach these duties are liable to the company for the damage they cause. Read the full text of § 38 BSIG.