NIS2 for cloud providers: when a cloud computing service provider is in scope
Anyone offering a cloud service to others, whether infrastructure, platform or software, is an important entity from 50 employees or with more than EUR 10 million each in turnover and balance sheet total, and an essential entity from 250 employees (§ 28 BSIG). Only using cloud services does not put you in scope through this line. Cloud providers are also subject to Implementing Regulation (EU) 2024/2690.
What a cloud computing service is
Four features carry the definition: the customer draws resources on demand, reaches them over the network, the pool grows and shrinks with demand, and several customers share the resources.
That fits computing power and storage as a service (IaaS), platforms such as databases as a service (PaaS) and software that many customers use over the network (SaaS).
A single server with fixed capacity that you run for one customer usually does not have these features. It can fall under another line, though, such as data centre service or managed service.
§ 2 no. 4 BSIG · Art. 6(30) NIS 2
‘cloud computing service’ means a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations;
From what size a provider is in scope
Important entity: at least 50 employees, or an annual turnover and a balance sheet total of more than EUR 10 million each.
Essential entity: at least 250 employees, or more than EUR 50 million turnover and more than EUR 43 million balance sheet total. This is possible because cloud providers are listed in Annex 1.
Unlike DNS services or qualified trust services, for example, cloud providers are not covered regardless of size.
Counting follows Recommendation 2003/361/EC. Partner and linked enterprises can count too.
§ 28(1), (2) and (4) BSIG
What does not count
Using cloud services, such as email, accounting or storage from a provider, is not offering a cloud service. Your company is then not in scope through this line of Annex 1. The provider is one of your suppliers, which you take into account in your measures if your company is in scope for another reason.
A cloud that your company runs only for itself is not a service offered either. If one company runs it for a fee for other companies in the same group, have that checked case by case.
More detailed rules for cloud providers
Cloud computing service providers are also subject to Implementing Regulation (EU) 2024/2690. It describes the technical requirements for the ten areas in more detail and takes precedence over the BSIG to that extent. As a regulation, it applies with the same wording in every EU country.
It also sets when an incident at these providers is significant and has to be reported.
For cloud providers, the main establishment in the EU decides which country is responsible: the country where decisions on cybersecurity are mainly taken. So you register in one EU country, even if you offer your service in several.
§ 30(3) BSIG · Implementing Regulation (EU) 2024/2690 · Art. 26 NIS 2
And the BSI's C5 catalogue?
C5 is a BSI criteria catalogue for cloud services. NIS2 does not require a C5 attestation. Many customers ask for one, though, and an existing attestation can provide evidence for your measures.
An example
A made-up company: a provider of HR software that around 900 customers use over the network. 60 employees, EUR 12 million turnover.
The software runs for all customers on one shared platform that grows with demand. That is a cloud computing service.
With 60 employees, the company is an important entity.
It registers with the BSI, because decisions on cybersecurity are taken in Germany.
It implements the measures under § 30 BSIG, to the depth Implementing Regulation (EU) 2024/2690 requires.
The list of its assets covers the application, the databases, the hosting accounts, customer sign-in and the suppliers, such as the data centre operator.
How the walkthrough does this
In the walkthrough at nisd2.eu, the work starts with the list of what your company works with.
One step asks about processes, software, devices, rooms and networks, and who supplies them. That produces the list of your assets.
One step shows in which EU country you register, with the rule for digital providers such as cloud.
Next to each step is the law, explained in plain words.
At the end, management approves the documents in the app, signed in with its own account.
Common questions
Is SaaS a cloud computing service under NIS2?
Usually yes, if many customers use the software over the network on a shared, scalable platform. That matches the definition in Art. 6(30) NIS 2 and § 2 no. 4 BSIG.
We only use cloud services. Are we a cloud provider?
No. Using cloud services is not offering them. Your company can be in scope for another reason; then the cloud provider is one of your suppliers.
From what size is a cloud provider in scope?
From 50 employees or with an annual turnover and a balance sheet total of more than EUR 10 million each (§ 28(2) BSIG). From 250 employees, or more than EUR 50 million turnover and more than EUR 43 million balance sheet total, it is an essential entity.
Where does a cloud provider active in several EU countries register?
In the EU country of its main establishment, where decisions on cybersecurity are mainly taken (Art. 26 NIS 2).
Sources
- BSI Act (BSIG) § 2 no. 4, §§ 28 and 30, Annex 1, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 6(30), Art. 26 and Annex I, EUR-Lex
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- Commission Recommendation 2003/361/EC, EUR-Lex
- BSI: C5 criteria catalogue, bsi.bund.de
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
