ProAuditMap

NIS2 and DORA: scope and audit areas.

Answer a few questions about your organisation. You get a cautious classification under the German BSI Act and under DORA, plus the audit areas and matching sample audit programs. Your input does not leave the browser.

Legal position: BSI Act as of 5 December 2025, DORA (EU) 2022/2554. Date: 21 October 2026

Is your organisation seated or established in Germany?

The tool assesses under the German BSI Act. Other countries have implemented NIS2 differently.

Are you a body of the German federal administration?

Section 29 BSIG determines which bodies belong to the federal administration. The tool does not assess them.

Pick the matching kind under Article 2 DORA. If you are not in the financial sector, choose “None of these”.

Do you operate a critical facility?

This means a critical facility under the German KRITIS umbrella act. If you do not know, choose “I do not know”.

Are you one of these kinds of service providers?

The BSI Act has its own rules for these, partly regardless of size.

Does your activity belong to a type of entity listed in the BSI Act?

Annex 1 lists energy, transport, financial sector, health, water, digital infrastructure and space. Annex 2 lists postal and courier services, waste management, chemicals, food, certain manufacturing, digital services and research.

Does one of these special cases apply?

The BSI Act has its own rules for these cases. If more than one applies, clarify your position legally.

Do you offer goods or services to others for payment?

The BSI Act applies to entities that offer goods or services to others for payment.

Is your company part of a group, and is it open whether the group’s figures count?

Figures of partner and linked enterprises are added under Section 28(4) BSIG, unless your IT is independent of them.

Do you carry out several activities, none clearly predominant?

Negligible side activities can be disregarded under Section 28(3) BSIG.

How large is your company?

Figures after adding partner and linked enterprises, turnover and balance sheet total in million euros. Employees count as annual work units: part-time and seasonal work pro rata, apprentices and maternity or parental leave not at all (Recommendation 2003/361/EC, Annex Article 5). Section 28(4) BSIG does not apply this recommendation to legally dependent units of a regional or local authority; clarify the counting method legally in that case.

Guidance, not legal advice. The classification does not replace a legal review of your case.

Sources