NIS2 und BSI.en

Deutsch | English

NIS2 and BSI

How HumanShield.APP supports awareness requirements from NIS2 and the BSI IT-Grundschutz.

Note: This page is an overview, not legal advice and not an automatic proof of "compliance". What is binding is your internal risk analysis, your ISMS and, where applicable, legal counsel.

NIS2 (EU Directive 2022/2555)

NIS2 requires affected entities to take risk-management measures, explicitly including basic cyber hygiene and cybersecurity training (Art. 21(2)). Phishing awareness is an established building block of this.

Platform contribution:

• Conduct regular, repeatable awareness campaigns.
• Measurability: open/click/submission rates per campaign and recipient.
• Evidence: result evaluation, CSV export and audit log as documentation of the measures carried out.

BSI IT-Grundschutz

The BSI IT-Grundschutz addresses raising awareness and training in the module ORP.3 "Awareness and training"; phishing simulations are a common awareness measure recommended by the BSI.

Platform contribution:

• Implementation of practical awareness measures (simulations instead of theory only).
• Target-group control via recipient groups (e.g. per department).
• Repeatability and progress measurement over time.

Recommended approach

1. Define goals (measure a baseline, improvement over time).
2. Clarify legal aspects: involve data protection and, if applicable, works council/staff representation before the start; observe data minimization (see Security).
3. Run regularly (not one-off) and vary the templates.
4. Follow up with training — the simulation is the entry point, not the goal.
5. Document (results/export as evidence of the measure).

Important limits

• No substitute for an ISMS, technical protections (mail filters, MFA, EDR …) or a full gap analysis.
• Do not use results for individual sanctions — that undermines the awareness culture.

See also: Features · Security