NIS2 compliance for an industrial supplier's web application in Berlin (2026)

The verdict in three sentences

A manufacturing supplier with more than 50 employees or 10 million euros in turnover in the automotive chain usually falls under NIS2 as an important entity, and its internet-facing supplier portal becomes a priority. A realistic budget to bring that application into compliance is 25,000 to 60,000 euros over 4 months, covering audit, MFA, centralised logging and an incident procedure. Doing nothing costs more: fines of up to 7 million euros or 1.4% of global turnover, and above all the risk of losing an OEM customer whose contracts already demand these controls.

Are you in scope, and for what exactly?

NIS2 sharply widens the scope of regulated cybersecurity in Europe, and the manufacture of motor vehicles and parts is listed among the critical sectors. In Germany, the national implementation act (NIS2UmsuCG) puts the BSI in charge of supervision, and in-scope companies must register with it and report significant incidents.

For a tier 1 or tier 2 supplier in the Berlin and Brandenburg area with 420 employees, important entity status is the most common outcome. Obligations apply to the whole company, but the supplier portal (purchase orders, technical drawings, quality documents) concentrates the risk: it is reachable from the internet, used by hundreds of external accounts and often built years ago without formal security requirements.

NIS2 also puts management on the hook: the executive board must approve security measures and complete training. That is a useful lever to unlock budget.

The budget, line by line

These are 2026 ballpark figures for a mid-sized web application (200 to 800 user accounts, around ten modules) in Germany. They depend heavily on the state of the code and hosting.

The upfront total lands between 25,000 and 60,000 euros, with a median around 40,000 euros for a portal in reasonable shape. The most underestimated line is code fixes: a pentest on an older application regularly finds authorisation flaws (one supplier reading another's drawings by changing an ID in the URL) that have to be fixed in the code itself.

The 4-month plan

Month 1: audit and risk analysis, account inventory, penetration test. Month 2: MFA rollout, removal of dormant accounts (often 20 to 30% of the total), SSO for internal staff. Month 3: central logging into a SIEM-type tool, alert rules on abnormal sign-ins, code fixes. Month 4: incident response plan, crisis drill with management, documentation for the BSI and for customers.

The incident plan should fit on a few pages and answer one question: who does what in the first 24 hours. Who qualifies the incident, who reports to the authority, who informs OEM customers, and how the portal can be isolated without stopping production. If your portal also exchanges financial data with accounting software, the queue and logging principles in our article on a Xero and open banking connector apply as well.

Mini case study

Jonas, CIO of a plastic parts supplier for the automotive industry near Berlin (420 employees, 95 million euros turnover), takes the case to his board. The consolidated quote comes to 42,000 euros: 13,000 for the audit, 8,000 for the pentest, 10,000 for MFA and access, 7,000 for logging and 4,000 for the incident plan. Monitoring costs 1,400 euros a month, 16,800 euros a year.

The maximum fine for an important entity is 7 million euros or 1.4% of global turnover, which is 1.33 million euros here. The decisive argument, though, is commercial: the largest OEM customer represents 30% of revenue, 28.5 million euros, and its new framework contract requires MFA and an incident plan. First-year spend of 58,800 euros equals 0.21% of the revenue protected by that single customer. The board signs off in one meeting.

FAQ

How do we know if we are an important or essential entity?

It depends on sector, size (at least 50 employees or 10 million euros turnover) and your role in the chain. The BSI provides guidance and a self-assessment, and the initial audit confirms your status within 1 to 2 weeks.

Is MFA mandatory for external supplier accounts?

NIS2 requires proportionate access controls, and MFA is the expected measure for an internet-facing application. On a 500-account portal, rollout takes 3 to 5 weeks, usually with an authenticator app or security keys.

How long should logs be kept?

There is no single mandated period, but 6 to 12 months is common practice so that late-discovered incidents can still be investigated. Storage for a portal of this size usually costs a few dozen euros a month.

What goes into the 24-hour early warning?

It states the suspected nature of the incident and whether it may be malicious or have cross-border impact. A fuller notification follows within 72 hours and a final report within one month.

Can we keep our current development vendor?

Yes, provided the contract gains security clauses: critical fixes within 5 to 10 days, logged access, incident notification. NIS2 makes you accountable for the security of your digital supply chain.

Let's scope your project. We will map the audit, code fixes and incident plan for your portal with you, targeting compliance in about 4 months. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.