Skip to content

NexusScope · Built for Germany, Austria & Switzerland

One incident. Three reporting regimes. Know which ones apply. Before the clock starts.

NexusScope maps your company against Germany’s NIS2UmsuCG/BSIG, Austria’s NISG 2024 and Switzerland’s ISG. You get independent applicability reads, reporting clocks, and visible public-footprint gaps, with sources and confidence stated for each regime.

Join waitlistView sample report

Join the waitlist → we e-mail you when your first scan opens. Free early access · No login.

Beispielwerk Maschinenbau GmbH

beispielwerk.de·DE

Regime Status

Germany, NIS2UmsuCG/BSIG

CONFIRMED

Why: HQ / establishment in Germany. NIS2UmsuCG/BSIG applies on the stated size and sector inputs (important-entity path).

Confidence: Confirmed · 90%
  • Austria, NISG 2024OUT
  • Switzerland, ISGOUT

Gaps

  • HighDMARC record missing entirely

    Next step: Publish a DMARC TXT record at _dmarc.beispielwerk.de (start with p=none, then quarantine, then reject) and monitor rua reports.

  • LowNo DKIM signature hint found

    Next step: Enable DKIM signing in your mail system and publish the public key as a TXT record.

Deadlines

  • 24 h

    Erstmeldung (innerhalb von 24 Stunden nach Kenntnisnahme)

    Gemeinsame Meldestelle von BSI und BBK · Meldung über die gemeinsame Meldestelle (BSI/BBK), Einrichtung des Meldewegs ausstehend

  • 72 h

    Folgemeldung – erste Bewertung (innerhalb von 72 Stunden)

    Gemeinsame Meldestelle von BSI und BBK · Meldung über die gemeinsame Meldestelle (BSI/BBK), Einrichtung des Meldewegs ausstehend

Simulated sample (synthetic demo data). NexusScope provides regulatory readiness intelligence based on referenced public sources and stated answers. Results are intended to support internal assessment and should be reviewed by qualified legal or compliance professionals where appropriate. Timelines current as of September 2026.

How it works

  1. STEP 1

    Tell us about your company

    Your domain and a short questionnaire. Sector, size, locations, EU customers. About two minutes.

  2. STEP 2

    We analyse

    NexusScope evaluates your profile against all three regimes and checks your public footprint (DNS, TLS, web headers, published pages) for visible gaps. GET-only, robots.txt-respecting.

  3. STEP 3

    You get one unified report

    Per-regime applicability, reporting deadlines, a prioritised gap list, and the reasoning behind each conclusion. Including what is Confirmed, Likely, Needs review, or Insufficient information.

What the report looks like

Each sample walks Regulation → Applicability → Why → Evidence → Source → Confidence → Next action. Profiles are synthetic demo data, clearly labelled. Not live determinations.

01

Applicability

Confirmed / Likely / Needs review / Insufficient information, independently for DE, AT and CH.

  • 02

    Why & evidence

    Threshold reasoning from your stated profile plus findings from the public footprint.

  • 03

    Deadlines & next action

    Reporting clocks when a regime applies, plus what would resolve open questions.

Sample profiles

Beispielwerk Maschinenbau GmbH

beispielwerk.de·DE

Manufacturing (machinery) · 50–249 employees · €10–50m revenue

Simulated sample · synthetic profile · not a live legal determination

How to read: Result → Reason → Evidence → Source → Confidence → Next step. Marked UNCLEAR when evidence is missing.

Regime Status

Germany, NIS2UmsuCG/BSIG

CONFIRMED

Why: HQ / establishment in Germany. NIS2UmsuCG/BSIG applies on the stated size and sector inputs (important-entity path).

Confidence: Confirmed · 90%Source: recht.bund.de

Evidence: establishment:pass → sector:pass → class:wichtig_sonstige_anlage1_2

Next action: Erstmeldung (innerhalb von 24 Stunden nach Kenntnisnahme) · Gemeinsame Meldestelle von BSI und BBK

  • Austria, NISG 2024OUT

    Why: No known establishment in AT on the stated profile. NISG 2024 does not apply directly.

    Confidence: Confirmed · 90%Source: ris.bka.gv.at

    Evidence: establishment:fail

  • Switzerland, ISGOUT

    Why: No known establishment in CH on the stated profile. ISG does not apply directly.

    Confidence: Confirmed · 90%Source: fedlex.admin.ch

    Evidence: establishment:fail

Gaps

  • HighDMARC record missing entirely

    Evidencedmarc_record: none · spf_record: v=spf1 include:spf.protection.outlook.com -all

    Source: dns.google

    Next step: Publish a DMARC TXT record at _dmarc.beispielwerk.de (start with p=none, then quarantine, then reject) and monitor rua reports.

  • LowNo DKIM signature hint found

    Evidenceselectors_checked: default, selector1, selector2, google

    Source: dns.google

    Next step: Enable DKIM signing in your mail system and publish the public key as a TXT record.

  • MediumHSTS (Strict-Transport-Security) missing

    Evidencehsts: none · x_frame_options: SAMEORIGIN · referrer_policy: none · csp: none

    Source: beispielwerk.de

    Next step: Set Strict-Transport-Security: max-age=31536000; includeSubDomains. Roll out with a short max-age first.

  • MediumTLS certificate expires in 21 days

    Evidencedays_until_expiry: 21 · issuer: Let's Encrypt · protocol: TLSv1.3

    Source: beispielwerk.de

    Next step: Renew the certificate and automate renewal (e.g. ACME) with expiry monitoring.

Deadlines

  • 24 h

    Erstmeldung (innerhalb von 24 Stunden nach Kenntnisnahme)

    Gemeinsame Meldestelle von BSI und BBK · Meldung über die gemeinsame Meldestelle (BSI/BBK), Einrichtung des Meldewegs ausstehend

  • 72 h

    Folgemeldung – erste Bewertung (innerhalb von 72 Stunden)

    Gemeinsame Meldestelle von BSI und BBK · Meldung über die gemeinsame Meldestelle (BSI/BBK), Einrichtung des Meldewegs ausstehend

  • 30 d

    Abschlussmeldung (spätestens einen Monat nach der Folgemeldung)

    Gemeinsame Meldestelle von BSI und BBK · Meldung über die gemeinsame Meldestelle (BSI/BBK), Einrichtung des Meldewegs ausstehend

Clocks shown for the first IN regime in this sample. Your live report lists clocks per applicable regime.

Simulated sample (synthetic demo data). NexusScope provides regulatory readiness intelligence based on referenced public sources and stated answers. Results are intended to support internal assessment and should be reviewed by qualified legal or compliance professionals where appropriate. Timelines current as of September 2026.

What you get

Germany's NIS2UmsuCG, Austria's NISG 2024 and Switzerland's ISG each set their own thresholds, sectors and clocks. One incident can trigger different duties, or none.

Most companies only discover which rules apply after the 24-hour reporting window has already started.

Know which regimes apply

Independent Confirmed / Likely / Needs review / Insufficient reads for DE, AT and CH, in one place.

See the clocks that matter

24 h / 72 h / 30 d deadlines with the authority and channel for each applicable regime.

Close visible gaps first

Prioritised findings from passive DNS, TLS and web checks. Public sources only.

Show your reasoning

Every conclusion cites thresholds and public sources, with confidence and open inputs when evidence is thin.

Share a clean PDF

One-click print/PDF export for boards, auditors and legal reviews.

Keep data in CH/EU

Hosting and handling designed so your data stays in Switzerland and the EU.

Who it is for

Designed for DACH organizations navigating overlapping cybersecurity regulations

Built for the roles that must decide whether a reporting duty applies. Before the 24-hour clock starts. The categories below describe intended users. They are not customers, partners, or endorsements.

  • CISOs
  • Security teams
  • Compliance teams
  • IT leadership
  • Managing directors
  • Mid-market organizations

Trust

Built for DACH companies

Orientation for Germany, Austria and Switzerland. Your data stays in Switzerland and the EU. Public sources only. Informational, not legal advice.

  • Built for DACH companies
  • Data stays in Switzerland / EU
  • Informational only, not legal advice

Join the waitlist

Leave your work e-mail. We notify you when scans open. Then you get one DE / AT / CH orientation report from a two-minute questionnaire and a passive public-footprint check.

We use your e-mail only to notify you about early access. No marketing without consent. Privacy Policy.

Frequently asked questions

Does NIS2 / NISG / ISG apply to my company?

It depends on sector, size and structure. Thresholds differ across Germany, Austria and Switzerland. NexusScope checks your profile against each regime and states Confirmed, Likely, Needs review, or Insufficient information, including what remains open.

Is this legal advice?

NexusScope provides regulatory readiness intelligence based on referenced public sources. Results are intended to support internal assessment and should be reviewed by qualified legal or compliance professionals where appropriate. NexusScope does not replace lawyers, auditors, or regulators.

What happens with my data?

Your data is stored in Switzerland and the EU, used to produce your report and to notify you about early access. Scans use public sources only, honour robots.txt, and never access protected systems.

When will NexusScope be available?

Waitlist onboarding for early access is open now. Join and we will notify you when your company can run its first scan.

What does a public-footprint check include?

Passive DNS, TLS and HTTP-header observations on the domain you provide, plus published pages where reachable. GET requests only, no credentials, no port scans. Findings are limited to what is visible from public sources.

What do Confirmed, Likely, Needs review and Insufficient information mean?

Confirmed: the stated profile meets (or clearly misses) the cited thresholds. Likely: strong signals, but a nuance remains. Needs review: evidence points both ways or a classification step is unfinished. Insufficient information: required inputs are missing. The report lists what would resolve it instead of guessing.

Where is my data stored?

In Switzerland and the EU only. Waitlist details and reports support your orientation and early-access notification, not advertising without consent.

Can I export a PDF?

Yes. Every report supports print/PDF export for boards, auditors and counsel. Sample reports on this site are synthetic demo data and use the same layout.

Know which clocks apply. Before the next incident.

Join the waitlist. After you submit, we e-mail you when scans open. You then receive one DE / AT / CH orientation from a short questionnaire and a passive public-footprint check, with sources, confidence, and open questions stated clearly.

Join waitlist
NexusScope — DACH Regulatory Readiness Intelligence