NIS2 costs money in the cloud wherever Article 21 of the directive, and in Germany § 30 BSIG, requires a specific measure: logging for incident handling, backup and recovery, encryption and key management, multi-factor authentication, vulnerability handling and supply chain security. To plan NIS2 cloud cost, budget each measure as its own cost line with an owner rather than the acronym as a lump sum. This guide covers the legal status, who is in scope, a control-to-cost table and questions for your adviser. It is not legal advice.
Legal status on 10 October 2026
Directive (EU) 2022/2555 had to be transposed by 17 October 2024. Germany did so with its NIS2 implementation act (BGBl. 2025 I No. 301 of 5 December 2025); the rewritten BSI Act (BSIG) has applied since 6 December 2025 and was last amended in July 2026. On 8 July 2026 the Commission referred Spain, France, Ireland and the Netherlands to the Court of Justice for failing to notify full transposition. If you have establishments there, check national law separately.
Two EU proposals are pending: targeted NIS2 amendments (COM(2026) 13) and the Digital Omnibus (COM(2025) 837), which would add a single entry point for incident reports. Neither has been adopted.
In the UK the NIS Regulations 2018 remain in force. On 10 October 2026 the Cyber Security and Resilience (Network and Information Systems) Bill was in the House of Lords, with report stage scheduled for 26 October 2026; it was not yet law. According to the government's summary, it would bring medium and large managed service providers and data centres into scope and require an initial incident notification within 24 hours and a fuller report within 72 hours. UK firms should budget for that possibility but treat it as a bill until Royal Assent.
Who is in scope and what follows
Under § 28 BSIG, an entity in an Annex 1 or 2 sector is "important" with at least 50 employees or more than EUR 10 million turnover and more than EUR 10 million balance sheet. An Annex 1 entity is "particularly important", the directive's essential entity, from 250 employees, or with turnover above EUR 50 million and balance sheet above EUR 43 million. Some types are in scope regardless of size, such as trust service providers. The directive itself uses the medium-sized enterprise ceilings of Recommendation 2003/361/EC.
For software companies, Annex 1's digital infrastructure sector matters most: it lists cloud computing service providers (item 6.1.4) and managed service providers (item 6.1.10). Whether your SaaS product counts as a cloud computing service is a question of interpretation; the BSI offers an online scope check.
An entity in scope has four duties with budget impact:
- Registration (§ 33): within three months through the BSI portal, which requires an ELSTER organisation certificate from "Mein Unternehmenskonto". For entities in scope when the law took effect, the deadline passed on 6 March 2026. By 30 September 2026 the BSI counted 20,141 registrations.
- Reporting (§ 32): early warning within 24 hours, notification within 72 hours, final report no later than one month after that.
- Measures and documentation (§ 30): ten areas of measures, with a duty to document compliance.
- Management (§ 38): management implements and oversees the measures and attends regular training.
Fines reach EUR 10 million for particularly important and EUR 7 million for important entities; above EUR 500 million total turnover the cap becomes 2 or 1.4 per cent of it (§ 65). A missed registration can cost up to EUR 500,000.
Companies outside scope still pay. Customers in scope must secure their supply chain under § 30(2) No. 4 and pass questionnaires, evidence requests and contract clauses on to their suppliers.
From control to cost line
The table maps the measures in § 30(2) BSIG, which mirror Article 21(2) NIS2, to where they appear on or beside the cloud bill.
| Measure (§ 30(2)) | Cost driver | Where it shows up | Cadence | Owner |
|---|---|---|---|---|
| No. 2 incident handling | Log ingestion, retention, analysis, on-call | CloudTrail, CloudWatch Logs, Log Analytics, Cloud Logging | ongoing | Platform team |
| No. 3 backup and disaster recovery | Backup storage, copies in another account or region, restore tests | AWS Backup, Azure Backup, snapshots, cross-region transfer | ongoing, tests periodic | Engineering |
| No. 4 supply chain | Supplier assessment, contract review | staff time, legal fees | yearly | Procurement and security |
| No. 5 vulnerability handling | Scanners, patch windows | Amazon Inspector, Microsoft Defender for Cloud, Security Command Center | ongoing | Engineering |
| No. 8 cryptography | Keys, key operations, HSM | AWS KMS, Azure Key Vault, Cloud KMS | ongoing | Platform team |
| Nos. 9 and 10 access control and MFA | Identity provider licences, hardware keys | often outside the cloud bill | ongoing | IT |
| Nos. 6 and 7 effectiveness and training | Assessments, courses | supplier invoices, staff time | yearly | Management |
| § 30(1), § 33 documentation and registration | Evidence, portal access | staff time | once, then ongoing | Compliance |
The billing model tells you which lever works. AWS KMS charges each customer managed key per month plus API requests beyond a monthly free tier; AWS managed keys incur request charges only. Cloud KMS bills by active key versions, protection level and key operations. Azure Key Vault bills per operation and, for HSM-protected keys, per actively used key. For logs, volume and retention drive cost: Azure Log Analytics keeps data for 30 days by default and charges longer retention by data volume and days; Google Cloud Logging's _Default bucket keeps 30 days, configurable up to 3,650.
For cloud providers and managed service providers, § 30(3) BSIG gives precedence to the technical requirements of Implementing Regulation (EU) 2024/2690. Its annex requires, among other things, keeping and protecting logs for a predefined period (3.2.5), redundant monitoring and logging systems (3.2.6), backups stored outside the system's network at sufficient distance (4.2.2) and regular restore tests (4.2.6). Each is a cost line.
Plan the budget and assign owners
- Record the scope decision. Keep the BSI check result, annex, sector and size figures in writing.
- Capture the current state per measure: in place, gap, owner, affected accounts or subscriptions.
- Make security spend visible. Tag logging, backup and key resources with a key such as
cost-purposeand group by it in Cost Explorer, Azure Cost Analysis or the BigQuery billing export. - Use formulas, not lump sums. Log cost = daily volume × (ingestion price + retention days × storage price). Backup cost = protected volume × copies × storage price + transfer per copy.
- Separate one-off from recurring. Rollout, registration and first assessment are project cost; logs, backups and keys recur monthly.
- Avoid double budgets. One logging or backup platform often serves NIS2, customer requirements and, for financial customers, DORA. Distribute it as a shared cost with a documented key.
- Review variance monthly. Add the lines to your monthly cloud cost review and your 2027 budget. Management, which oversees implementation under § 38, gets actual, plan and gap in one table.
Common mistakes
- A lump-sum NIS2 budget: without a link to measures, nobody can tell whether money is missing or counted twice.
- Retention never decided: defaults are not a rationale. Too short endangers the final report; too long raises cost and can clash with GDPR deletion duties.
- Backups in the same account: a copy in the same account and region offers little protection against account takeover or a regional outage.
- Security spend in a shared account: without a tag and owner, log and key charges surface as an unexplained increase.
- A cost report as evidence: an invoice shows money was spent, not that the measure works.
Questions for your legal adviser and security lead
- Do we fall under Annex 1 or 2 BSIG, and is our product a cloud computing service or a managed service?
- How do employees, turnover and balance sheet count across our group?
- Does Implementing Regulation (EU) 2024/2690 take precedence for us?
- What security log retention is appropriate and compatible with GDPR?
- In which other member states do we operate, and which transposition applies there?
- Would the UK Cyber Security and Resilience Bill bring us in as a managed service provider?
What Costfluent can contribute
Costfluent reads AWS, Azure and Google Cloud billing data through read-only connections and shows cost by account, service, resource and tag. You can set a budget for the security platform's segment through the Public API or the Terraform provider, compare it with actual spend and see where its current period is heading. Variance notifications are Planned. Costfluent never stops resources. A cost report does not prove that a measure works. What the connections can read and where data is hosted is on the security page.
Sources and method
Checked on 10 October 2026: Directive (EU) 2022/2555 (NIS2), Implementing Regulation (EU) 2024/2690, BGBl. 2025 I No. 301, BSI Act, current version, BSI on NIS-2 regulated companies, BSI portal, BSI: NIS-2 in figures, Commission on the NIS2 Directive and proposed amendments, referral of four member states, 8 July 2026, Digital Omnibus COM(2025) 837, procedure 2026/0012(COD) on the NIS2 amendments, procedure 2025/0360(COD) on the Digital Omnibus, Recommendation 2003/361/EC, NIS Regulations 2018, Cyber Security and Resilience Bill: summary, bill stages (Bills API), AWS KMS pricing, Cloud KMS pricing, Azure Key Vault pricing, Azure Monitor data retention, Cloud Logging retention. The tables, planning steps and questions are Costfluent recommendations, not legal advice.
