NIS-2 Cockpit
The duties under the German BSIG are not recommendations, they are deadlines. The cockpit computes them from a single moment, reminds you before they pass, and documents what you did.
In short
The NIS-2 Cockpit is software that turns the duties of the German BSIG into monitored deadlines: classification under § 28, registration under § 33, the reporting chain under § 32, and the registers under §§ 30 and 38.
Under § 32 Abs. 1 BSIG a significant security incident is owed as an early warning without undue delay and at the latest within 24 hours of becoming known, as an updated report at the latest after 72 hours, and as a final report at the latest one month after that 72-hour report was transmitted.
Under § 33 Abs. 1 BSIG the registration with the BSI is owed within three months of the day an entity first — or again — qualifies as an essential or important entity. The deadline is rolling, not a one-off cut-off.
The cockpit files no report with the BSI and gives no legal advice. It prepares, reminds and documents; the report itself you submit through the BSI's joint reporting office.
It costs €79 a month or €790 a year. The Pro and Business plans include it at no extra cost.
The reporting chain, as the statute sets it
24 hours
Early warning
from becoming aware
§ 32 Abs. 1 Satz 1 Nr. 1
72 hours
Updated report
also from becoming aware
§ 32 Abs. 1 Satz 1 Nr. 2
1 month
Final report
from transmission of the 72-hour report
§ 32 Abs. 1 Satz 1 Nr. 4
The last anchor is the one most summaries get wrong: the month runs from the transmission of the 72-hour report, not from becoming aware. Report early and the final report is owed correspondingly earlier.
What the cockpit keeps
§ 28 BSIG
Classification with reasoning you can check
Sector under Anlage 1 or 2, size class, and the categories that are in scope regardless of size. The verdict names the provision it rests on — and allows “unclear” as an outcome rather than feigning a certainty that § 28 does not offer for group structures.
§ 33, § 34 BSIG
Registration tracker with a rolling deadline
Three months from the day the criteria are met — first or again. Plus the checklist of the five details the BSI asks for, and the two different windows for reporting a change: two weeks under § 33 Abs. 5, three months under the special registration duty of § 34.
§ 32 BSIG
Reporting clock with a content checklist per stage
One moment — becoming aware — starts the whole chain. Each stage shows what belongs in it, and the final deadline correctly hangs on the transmission of the 72-hour report rather than on awareness. If the incident is still running, a progress report takes its place.
§ 32 BSIG
Alerts to your reporting chain — at night too
On opening, at halfway, shortly before expiry and on a breach, by email to the people who must be reachable when it matters. They need no user account for that.
Drill
Drill mode on a compressed clock
The same chain at 288× speed: 24 hours become five minutes. Marked as a drill everywhere, counted as a real incident nowhere — and reportable as an exercise that was actually carried out.
§§ 30, 38 BSIG
Measure and governance registers
The ten minimum measures of § 30 Abs. 2 with status, ownership and evidence, plus management resolutions and training records under § 38 — the provision that attaches personal liability.
Frequently asked questions
What does the NIS-2 Cockpit cost?+
€79 a month or €790 a year. The Pro and Business plans include it at no extra cost. There is a 14-day trial without a credit card.
Does the cockpit report the incident to the BSI?+
No. The cockpit computes the deadlines, reminds you of them and records what was reported. The report itself you submit through the BSI's joint reporting office. Automatic submission is deliberately not offered.
Is this legal advice?+
No. The cockpit supports the preparation and documentation of your duties under the BSIG. Whether and how a provision applies to your company is a matter for the individual case, and for group structures regularly one for a lawyer.
What deadlines does § 32 BSIG set?+
An early warning without undue delay and at the latest 24 hours after becoming aware; an updated report at the latest after 72 hours, also counted from becoming aware; a final report at the latest one month after the 72-hour report was transmitted. If the incident is still ongoing, a progress report takes the place of the final report.
By when must you register with the BSI?+
Under § 33 Abs. 1 BSIG within three months of the day an entity first — or again — qualifies as an essential or important entity. Because the deadline is rolling it can start for the first time years after the law came into force, for instance when a company grows past a threshold of § 28.
How do I know whether my company is in scope?+
Sector and size under § 28 BSIG decide it. The free NIS-2 check gives a first indication; in the cockpit that becomes a stored classification with its reasoning. The authoritative routes are the BSI's own scope assessment and legal advice.
Do the people in the reporting chain need a user account?+
No. Alert recipients are stored with a name and an email address. The people who must be reachable at night — a managing director, an external incident-response provider — rarely have access to the tool, and an alert must not fail on that.
Where is the data held?+
In the EU. The cockpit itself runs without a language model: deadlines are arithmetic, so they are computed rather than estimated.
The cockpit supports the preparation and documentation of your duties under the BSIG. It is not legal advice and it files no report on your behalf. It is built on §§ 28 to 38 BSIG as enacted by the NIS2UmsuCG. BSIG, 2026-09-01.
NIS-2 Cockpit
or €790 a year. Included in Pro and Business. 14-day trial, no card.