NIS2 for data centres: when a data centre falls under the BSIG
Anyone offering data centre services to others, such as colocation, is an important entity from 50 employees or with more than EUR 10 million each in turnover and balance sheet total, and an essential entity from 250 employees (§ 28 BSIG). A server room only for your own company is not a service offered. Whether a data centre is also a critical facility depends on a threshold of its own.
What a data centre service is
It means the whole operation: rooms, racks and network, plus power distribution and cooling. The building services are part of the service.
Whether you rent out space, power and cooling for other people's servers (colocation) or run the servers yourself does not change whether it counts as a data centre service.
§ 2 no. 35 BSIG · Art. 6(31) NIS 2
‘data centre service’ means a service that encompasses structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport services together with all the facilities and infrastructures for power distribution and environmental control;
From what size a provider is in scope
Important entity: at least 50 employees, or an annual turnover and a balance sheet total of more than EUR 10 million each.
Essential entity: at least 250 employees, or more than EUR 50 million turnover and more than EUR 43 million balance sheet total. This is possible because data centres are listed in Annex 1.
Unlike DNS services or qualified trust services, for example, data centres are not covered regardless of size.
Counting follows Recommendation 2003/361/EC. Partner and linked enterprises can count too.
§ 28(1), (2) and (4) BSIG
Your own server room
If your company runs servers only for itself, you are not offering a data centre service. You are then not in scope through this line of Annex 1.
Your company can still be in scope for another reason, for example as a manufacturer, a food business or a waste firm. Then the server room is among the systems you protect.
If one company runs a data centre for a fee for other companies in the same group, have that checked case by case.
When a data centre is a critical facility
Regardless of the company's size, a data centre can be a critical facility. Its operator is then an essential entity.
Whether a facility is critical depends on thresholds in a regulation. In the BSI Critical Infrastructure Regulation (BSI-KritisV), the value for a data centre (housing) is 3.5 megawatts of contractually agreed capacity.
Operators of critical facilities have two more duties: they use attack detection systems, and they prove their measures to the BSI every three years.
§ 2 no. 22, § 28(1) no. 1, §§ 31 and 39 BSIG
More detailed rules for digital providers
Data centre service providers are also subject to Implementing Regulation (EU) 2024/2690. It describes the technical requirements for the ten areas in more detail and takes precedence over the BSIG to that extent.
It also sets when an incident at these providers is significant and has to be reported.
§ 30(3) BSIG · Implementing Regulation (EU) 2024/2690
An example
A made-up company: a regional colocation provider with 60 employees, two sites and SME customers. 2 megawatts of capacity are contractually agreed.
Colocation is a data centre service. With 60 employees, the company is an important entity.
At 2 megawatts it is below the BSI-KritisV value. On that basis the data centre is not a critical facility.
It registers with the BSI and implements the measures under § 30 BSIG, to the depth Implementing Regulation (EU) 2024/2690 requires.
The list of its assets starts with the building services: grid connection, UPS, backup power, cooling, fire protection and access. Network, racks and monitoring follow.
How the walkthrough does this
In the walkthrough at nisd2.eu, the work starts with the list of what your company works with.
One step asks about processes, software, devices, rooms and networks, and who supplies them. That produces the list of your assets.
In the company profile you state whether you operate a critical facility. Only then does the step on attack detection and evidence to the BSI appear.
Next to each step is the law, explained in plain words.
At the end, management approves the documents in the app, signed in with its own account.
Common questions
Is colocation a data centre service under NIS2?
Yes. Colocation provides rooms, power and cooling for other people's IT. That falls under the definition in § 2 no. 35 BSIG.
Does NIS2 apply to our own server room?
Not as a data centre service, as long as you run it only for your own company. If your company is in scope for another reason, you protect the server room as part of your measures.
From what size is a data centre in scope?
From 50 employees or with an annual turnover and a balance sheet total of more than EUR 10 million each (§ 28(2) BSIG). If the data centre is a critical facility, regardless of size.
Is every data centre KRITIS?
No. A data centre is a critical facility only above a threshold. In the BSI-KritisV that is 3.5 megawatts of contractually agreed capacity for housing.
Sources
- BSI Act (BSIG) § 2 nos. 22 and 35, §§ 28, 30, 31, 39, Annex 1, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 6(31) and Annex I, EUR-Lex
- Implementing Regulation (EU) 2024/2690, EUR-Lex
- BSI-KritisV, Annex 4, gesetze-im-internet.de/bsi-kritisv
- Commission Recommendation 2003/361/EC, EUR-Lex
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write down what your company has
A list of the processes, software and devices you work with.
Registration & Reporting
Register with your authority
Your company registers once with your authority.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
