NIS2 is not a documentation project. It is an operating model for cyber risk.
Germany’s current BSIG requires covered essential and important entities to implement appropriate, proportionate and effective technical and organizational risk-management measures. Management must implement and monitor those measures.
Microsoft Tenant
7 findings
What Oxygenn operationalizes from NIS2
Section 30 BSIG addresses areas including risk management, incident handling, business continuity, supply-chain security, vulnerability management, effectiveness assessment, cryptography, access control and multi-factor authentication.
Governance
Roles, accountability, risk decisions, management oversight and training evidence.
Technical Controls
Identity, privileged access, devices, logging, backup, security configuration and detection.
Evidence & Remediation
Evidence, findings, exceptions, actions, owners, due dates and continuous status.
The difference between “we have a policy” and “we can prove it”
A policy can say privileged access is reviewed regularly. Oxygenn is designed to show which privileged roles actually exist, whether controls work, when status was last checked and which exceptions remain open.
Official foundations
BSIG §30 – Risikomanagementmaßnahmen
BSIG §38 – Geschäftsleitungs-Pflichten
External links are provided as primary sources. Oxygenn is not a law firm.