06December2025
NIS-2 Implementation Act comes into force
The new cybersecurity requirements for affected companies become mandatory.
NIS-2, KRITIS, and the Cyber Resilience Act significantly increase the requirements for security and risk management. Not only technical protective measures are required, but a holistic approach that includes processes, responsibilities, and physical security.
We support companies in effectively connecting physical and digital security – for compliance, protection, and future viability. Access control, traceability, and secure processes become an integral part of your security strategy.
Due to regulatory pressure, controllable security
Get a non-binding consultation now!
✓ Access control as part of your security architecture
✓ Traceable permissions and secure processes
✓ Future-proof and flexible foundation for regulatory requirements
New EU directive for more cybersecurity in
companies and organizations.
Focus on risk management, reporting obligations, and security measures.
Requirements for
operators of critical infrastructures
such as energy, industry, or healthcare to protect sensitive processes and facilities.
The Cyber Resilience Act requires
manufacturers and distributors
to provide secure connected products throughout their entire lifecycle.
NIS-2
KRITIS
CRA
NIS-2 applies to companies and organizations of particular importance for the economy, supply, and infrastructure. Relevant are particularly medium and large companies in critical or particularly important sectors.
KRITIS applies to operators of critical infrastructures, whose failure would have significant impacts on supply security, the economy, or public life. Defined thresholds and the criticality of the services are crucial.
NIS-2
Important entities: at least 50 employees OR annual revenue over 10 million EUR.
Especially important entities: at least 250 employees AND annual revenue over 50 million EUR AND balance sheet total over 43 million EUR.
Typical affected industries
Energy
Digital Infrastructure & IT
Industry & Production
Public Administration
Healthcare
Transport & Logistics
Food & Trade
Water & Environment
Finance and Insurance
KRITIS
Companies are considered KRITIS-relevant if certain thresholds are exceeded – sector-specific, e.g., supply of over 500,000 people in the energy supply sector.
Typical KRITIS sectors
Energy Supply
Water Supply
Healthcare
Transport & Traffic
Nutrition
State & Administration
Information and Communication Technology
Finance and Insurance
The Cyber Resilience Act concerns manufacturers, importers, and dealers of products with digital elements. The aim is to make connected products safer throughout their entire lifecycle – from development to deployment to updates and vulnerability management.
CRA
Relevant for products with digital elements: This includes hardware, software, and connected systems that can be directly or indirectly connected to a network or another device.
Manufacturers must meet security requirements, actively address vulnerabilities, and provide security updates.
This also affects us as manufacturers of digital access control systems, electronic locking technology, and connected security solutions.
If the requirements of the Cyber Resilience Act are not met, products can be withdrawn from the market or not placed on the market. This creates risks for companies along the supply chain – for example, if important products, systems, or suppliers are suddenly unavailable.
Typical affected product areas
Connected products
IoT devices
Software & Apps
Cloud and platform solutions
Digital locking systems
Update and patch management
Companies and operators must actively assess risks and implement appropriate measures.
Security measures, processes, and decisions must be documented and verifiable.
Physical, digital, and organizational measures interconnect and form an effective security chain.
Violations can lead to fines, liability of management, and business interruptions.
More
Responsibility
More Documentation Obligations
Holistic Security Architecture
Risks & Consequences
Do you want to know what impact the new requirements will have on your organization?
Get advice now!
Many security concepts focus on IT systems. However, effective security begins with controlled access to buildings, sensitive areas, and critical infrastructure.
Digital access organization creates transparency, control, and traceability and thus becomes a central component of modern compliance strategies.
Intelligent access solutions for modern security requirements.
Our solutions support companies and professional partners in organizing access efficiently, transparently, and future-proof.
Secure, flexible, and scalable solutions for every requirement.
Manage, change, and revoke permissions centrally.
All accesses are recorded and documented in a tamper-proof manner.
Seamless integration into existing security and IT systems.
Prepared for current and future requirements.
Digital access control
Real-time access management
Seamless logging
Integration & interfaces
Future-proof & compliant
The Cyber Resilience Act increases the requirements for manufacturers of connected products. Security thus becomes a responsibility throughout the entire product lifecycle – from development to operation to updates and the long-term maintenance of systems.
As a manufacturer of digital access solutions, DOM develops systems that connect physical and digital security and support companies in meeting current and future security requirements.
For DOM, this means:
As a manufacturer of modern access control systems, we support your company together with qualified specialist partners in the planning and implementation of your individual security solutions.
The regulatory requirements surrounding NIS-2, KRITIS, and CRA are gradually evolving. The timeline provides an overview of the most important deadlines, registrations, and legal milestones.
