NIS2 and Network Security: What Companies Must Do About Their VPN Now

The EU NIS2 Directive (Directive 2022/2555) is reshaping cybersecurity requirements across all 27 member states. Each country must transpose the directive into national law, and enforcement is now underway. In Germany, the NIS2 Implementation Act (NIS2UmsuCG) entered into force on December 6, 2025 — with no transition period. Around 30,000 German companies alone must now comply with ten mandatory security measures under the German implementation (§ 30 BSIG — the Federal Office for Information Security Act). The BSI (German Federal Cyber Security Authority) registration deadline passed on March 6, 2026. Result: only 38.5 percent of affected companies registered on time.

The picture is similar across Europe. Whether your national regulator is the BSI (Germany), ANSSI (France), ACN (Italy), or CCB (Belgium) — the core requirements are the same, because they stem from the same EU directive.

What many IT leaders overlook: at least three of the ten mandatory NIS2 measures directly affect VPN and network infrastructure. If you are still running Sophos SSL VPN, OpenVPN with shared credentials, or a Fortinet gateway, you very likely have an open compliance gap.

This article explains the specific network security requirements under NIS2, why legacy VPN architectures fail to meet them, and how a Zero Trust approach with NetBird closes the compliance gap.

Also worth reading: Sophos VPN Alternative 2026 · OpenVPN Alternative 2026 · Setting Up a Business Network for Remote Employees

Is My Company Affected? The Quick Check

NIS2 applies across all EU member states. Whether you are based in Germany, France, the Netherlands, or any other EU country — or even outside the EU but serving EU customers — the directive may apply to you.

Scope depends on two factors: sector and company size.

Company size: Companies with 50+ employees or €10M+ annual revenue fall under NIS2 if they operate in a regulated sector.

Sectors (selection): Energy, transport, healthcare, finance, water, digital infrastructure, IT service providers (managed service providers, managed security service providers), manufacturing, mechanical engineering, chemicals, food production, waste management, research, postal and courier services.

A critical detail: many mid-sized companies are affected for the first time — particularly IT service providers, manufacturers, and food producers. If you are a supplier to an affected company, you can be pulled into scope through the supply chain requirements.

Each EU member state has its own national authority and registration process. In Germany, this is the BSI; in France, ANSSI; in Italy, ACN. The obligations are substantively the same — only the local implementation details differ.

What Happens If You Don't Comply?

The consequences are severe. For essential entities, fines can reach €10 million or 2% of global annual turnover. For important entities, the ceiling is €7 million or 1.4% of turnover.

The most critical point: NIS2 establishes personal liability for management. Under the German implementation (§ 38 BSIG), managing directors must formally approve risk management measures, actively oversee their implementation, and personally attend cybersecurity training. This duty cannot be delegated to a CISO or IT director. A liability waiver by the company is legally excluded. Similar management accountability provisions exist in other member states' implementations.

The Ten Mandatory NIS2 Measures

The NIS2 Directive defines ten categories of security measures that affected companies must implement. The German implementation (§ 30 BSIG) closely aligns with ISO 27001 — companies already certified cover approximately 70 to 80 percent of the requirements.

The ten areas at a glance:

1. Risk analysis and security policies
2. Incident handling
3. Business continuity, backup management, and crisis management
4. Supply chain security
5. Secure procurement, development, and maintenance of IT systems
6. Assessment of the effectiveness of security measures
7. Cyber hygiene and training
8. Cryptography and encryption
9. Access control and identity management
10. Multi-factor authentication and secure communications

Measures 8, 9, and 10 directly affect network and VPN infrastructure. This is precisely where many companies have a problem.

What NIS2 Concretely Means for VPN Infrastructure

Measure 8: Cryptography and Encryption

NIS2 requires policies and procedures for the use of cryptographic methods. The German implementation (§ 30 para. 2 no. 8 BSIG) specifies this concretely:

• Encryption of all data in transit is mandatory
• Algorithms must reflect the current state of the art
• Deprecated methods such as SHA-1 or RSA with fewer than 2048 bits are no longer acceptable
• A cryptography inventory must document which methods are used where

What this means for your VPN: WireGuard meets this requirement natively. The protocol uses exclusively modern cryptography: ChaCha20 for symmetric encryption, Curve25519 for key exchange, Poly1305 for authentication, and BLAKE2s as hash function. There are no configurable cipher suites — misconfiguration is impossible.

OpenVPN, by contrast, uses TLS/SSL with configurable cipher suites. In practice, we regularly encounter installations with outdated configurations: weak ciphers, expired certificates, disabled Perfect Forward Secrecy. Each of these misconfigurations constitutes a NIS2 violation.

Sophos SSL VPN is built on OpenVPN and inherits the same issues. After firmware updates, cipher mismatches regularly break existing VPN connections. The result: admins delay updates out of fear of regressions — further degrading the security posture.

Measure 9: Access Control

NIS2 requires policies for access control to systems and asset management. The principle of least privilege must be consistently enforced and demonstrably documented.

What this means for your VPN: Traditional VPN architectures grant access to the entire internal network after successful authentication. An employee connects via the VPN tunnel and can reach everything — file servers, ERP, databases, printers. This flat network access model is the exact opposite of least privilege and therefore a NIS2 violation.

NetBird solves this with identity-based access policies. Admins define granularly which user group may access which resource — including protocol restrictions (TCP, UDP, ICMP) and port ranges. An accountant sees the ERP system but not the development server. An external contractor sees exactly the one machine they need to maintain — and nothing else.

Additionally, NetBird offers Posture Checks: only devices meeting defined security requirements (current OS, running security software, correct NetBird version) receive access at all. This is Zero Trust in practice — and exactly what NIS2 demands.

Measure 10: Multi-Factor Authentication and Secure Communications

NIS2 requires the use of multi-factor authentication or continuous authentication, as well as secured communications within the organization.

What this means for your VPN: VPN access without MFA is no longer compliant. This affects every Sophos installation still relying on username and password, every OpenVPN server with simple certificate authentication, and every Fortinet appliance without activated FortiToken.

NetBird solves MFA through native SSO integration. Authentication runs through the company's identity provider — whether Azure AD, Google Workspace, Okta, or Keycloak. If the IdP enforces MFA (and it should), this automatically extends to VPN access. No separate token management, no additional infrastructure.

Simultaneously, NetBird fulfills the requirement for secure communications: all connections are end-to-end encrypted, directly between peers. There is no central gateway where traffic is decrypted and re-encrypted — unlike Twingate or traditional SSL VPN solutions where the connector acts as a man-in-the-middle.

Additional NIS2-Relevant VPN Aspects

Supply Chain Security

NIS2 requires the assessment of cybersecurity across suppliers and service providers. If your VPN provider is a US cloud service, immediate questions arise: Where are metadata processed? Who has access to connection data? Is the code auditable?

Tailscale runs its entire control plane as proprietary cloud software. Twingate likewise. For regulated companies — healthcare, financial sector, public administration — this is often a disqualifying factor.

NetBird is 100 percent open source. The entire codebase — client, management server, signal server, relay — is publicly available and auditable on GitHub. With birdhost, infrastructure runs in ISO 27001 and SOC 2 certified data centers across 8 regions worldwide (certifications held by the data center operators). No metadata leaves the region you select. The supply chain is transparent and verifiable.

Effectiveness Assessment

NIS2 requires regular assessments of the effectiveness of security measures. This means: logging, auditability, and demonstrable control.

NetBird logs every connection, every policy change, every login — including timestamp, source IP, and associated identity. These are exactly the records that regulators want to see during audits.

Traditional VPN solutions often provide only rudimentary logging: connection establishment and teardown, perhaps transferred data volume. Who accessed which resource? Which policy was active at that time? With Sophos, OpenVPN, or Fortinet, this is not verifiable without additional tools.

Why Legacy VPNs Have a Structural NIS2 Problem

The issue is not that Sophos, OpenVPN, or Fortinet are inherently insecure. The problem is architectural: these solutions were built for a world where "inside" was trusted and "outside" was hostile. NIS2 demands the opposite — Zero Trust.

Central gateway as single point of failure: With Sophos, Fortinet, and OpenVPN, all VPN traffic flows through a central server. This server simultaneously acts as performance bottleneck, preferred attack target, and single point of failure. If it goes down, the entire network is offline.

Open ports as attack surface: SSL VPN portals must be reachable from the internet. This reachability makes the appliance a target. The Fortinet CVEs of recent months clearly demonstrate what happens when SSL VPN gateways are compromised: admin accounts are created, VPN configurations exported, networks infiltrated. The situation becomes fully untenable once the appliance no longer receives patches at all: support for the Cisco ASA 5506-X, 5508-X, and 5516-X ends on August 31, 2026, and every vulnerability discovered after that date remains permanently unpatched.

Vendor dependency as concentration risk: When an appliance ecosystem tips over, it does not hit one company but tens of thousands at once. The FortiBleed leak affecting more than 73,000 FortiGate credentials makes that risk measurable and puts it squarely into the supply chain assessment NIS2 demands.

No identity-aware access control: Traditional VPNs authenticate the user at the gate and then grant broad network access. Once you are in, you are in. Granular, identity-based access control with device posture checks must be retrofitted — if it is even possible.

NetBird inverts this architecture. No open ports: connections are coordinated via NAT traversal, data flows directly between peers. No central decryption: WireGuard tunnels are end-to-end. No flat network access: every access is verified by identity and logged.

Checklist: NIS2-Compliant VPN Infrastructure

Review your current VPN solution against these points. Each item corresponds to a specific NIS2 requirement:

Cryptography:

• Are only current encryption methods in use (no SHA-1, no RSA < 2048 bit)?
• Is a cryptography inventory documented?
• Are cipher suites configured so that misconfiguration is impossible?

Access control:

• Is the least privilege principle enforced — or do VPN users get access to the entire network?
• Are access rules identity-based and granularly definable?
• Are there device posture checks (OS version, antivirus status)?

MFA:

• Is multi-factor authentication activated for all VPN connections?
• Does authentication run through a central identity provider with MFA enforcement?

Logging and auditability:

• Are all connections, policy changes, and logins recorded?
• Can you demonstrate who accessed which resource and when?

Supply chain and data sovereignty:

• Is the VPN product's source code auditable?
• Are metadata and connection data processed within your required jurisdiction?
• Is there a data processing agreement (DPA) with the VPN provider?

If more than two points are open, there is an urgent need for action.

How birdhost Covers the NIS2 Requirements

birdhost offers managed NetBird hosting, a fully managed Zero Trust VPN solution designed to meet NIS2 requirements.

Cryptography: WireGuard with ChaCha20, Curve25519, Poly1305, BLAKE2s. No configurable cipher suites, no misconfiguration possible. State of the art, fully documentable.

Access control: Identity-based access policies with groups, protocol restrictions, and posture checks. Least privilege out of the box. Since version 0.65, with integrated Reverse Proxy for secure service exposure without port forwarding.

MFA: Native SSO integration with Azure AD, Google Workspace, Okta, Keycloak, and Authentik. MFA enforcement via the identity provider. Automatic on-/offboarding via SCIM.

Logging: Complete audit trail for connections, policy changes, and authentication events.

Data sovereignty: Infrastructure hosted in ISO 27001 and SOC 2 certified data centers across 8 regions worldwide (certifications held by the data center operators). GDPR-compliant. DPA available. 100 percent open source — fully auditable.

Cost: Flat rate from €99.90 per month. No per-user fees. Unlimited users and devices included. 7-day free trial via the merkaio self-service portal.

Conclusion: NIS2 Makes Zero Trust Mandatory

NIS2 is not an abstract compliance exercise. The directive demands concrete technical measures — state-of-the-art encryption, identity-based access control, multi-factor authentication, comprehensive logging. Legacy gateway VPNs fail to meet these requirements by design.

The good news: the transition does not have to be disruptive. NetBird can run alongside an existing VPN solution. Employees can be migrated step by step while the legacy VPN remains active as a fallback. With birdhost as a managed service, the operational overhead for setup, monitoring, and updates is eliminated.

Companies that act now are not just closing a compliance gap — they are getting a faster, more secure, and easier-to-manage network.

Further reading:

• Sophos VPN Alternative 2026: UTM End-of-Life — What Now?
• OpenVPN Alternative 2026: NetBird vs. OpenVPN
• NetBird vs. Tailscale 2026: The Enterprise Comparison
• Twingate Alternative 2026: NetBird vs. Twingate
• Setting Up a Business Network for Remote Employees

Sources:

• EU NIS2 Directive (2022/2555) — EUR-Lex
• NIS2 Implementation Act (NIS2UmsuCG) — German Federal Government
• § 30 BSIG — Risk Management Measures
• NIS2 Transposition Status by Member State — ENISA
• NIS2 Implementation in Germany — OpenKRITIS
• NIS2 Requirements: All 10 Mandatory Measures — SECJUR