Is a code scanner mandatory under NIS2?

The short answer

No. There is no provision in the NIS2 directive or in the German BSI Act that requires a code scanner, a scanner product or any particular test method. Anyone who hears otherwise should ask for the citation. There is none.

What is required instead

The directive's list of minimum measures has one letter, Article 21(2)(e), for the whole life of a system: buying it, building it, keeping it running, and dealing openly with the vulnerabilities found along the way. The German act carries that over as number 5 of Section 30(2) BSIG with hardly a word changed, then adds two things of its own: subsection 1 says the whole thing has to be written down, and number 6 says you have to check, with a procedure, whether your measures actually work.

That is the whole duty: know vulnerabilities, handle them, disclose them, document, assess. How an entity gets there, the law leaves to the entity. For your own code the vulnerabilities are essentially hardcoded credentials, vulnerable dependencies and unsafe patterns; how a continuous scan evidences them is in our article on proving NIS2 compliance in daily operations and on our code security and compliance page.

Why we recommend the scan anyway

Because the documentation duty in subsection 1 is the bottleneck in practice. Vulnerabilities can also be managed with an annual manual review. What that lacks is a record for the time in between. A scan on every commit leaves an assessment, an action and a date behind every finding, and that file builds up while the work is done rather than before the audit. That is the reason for the recommendation, not a duty that does not exist.

What the scan cannot do, and what that means for the duty

A scanner finds what has a pattern. Business logic errors, such as authorisation logic that is wrong in business terms, it does not find, and design decisions it does not judge. But the duty under number 5 does not stop at the limit of the tool. Anyone who wants to meet it fully needs, alongside the scan, a periodic check of what has no pattern, usually a penetration test. That is not prescribed either. It is another route to the required outcome.

Who the question applies to at all

Section 30 BSIG addresses essential and important entities. Whether a company is one depends on sector and size; our NIS2 quick check settles that in a few minutes. And regardless of NIS2: anyone who writes no software and runs no bought software themselves has nothing to scan. Anyone who has either has vulnerabilities to manage, whether the directive covers them or not. Whether it is worth it, the free code analysis shows, with no obligation.

Frequently Asked Questions