NIS2-Compliant M365 Governance: Between Law and Reality

A Teams channel that someone granted access to “everyone in the company” months ago. A SharePoint site without an owner since the last responsible person left the organization. No one noticed, until now.

With the NIS2 Implementation Act, which came into force on December 6, 2025, situations like these have become a tangible compliance risk. Around 29,500 organizations fall under the supervision of Germany’s Federal Office for Information Security (BSI) and must provide auditable governance processes, clear accountability, and reliable evidence of compliance, including for their Microsoft 365 environments.

The reality in many IT departments looks quite different. Groups and sites grow unchecked, ownership is unclear, and in a critical situation, no one can provide a complete record of who had access to what, and when.

This webinar addresses exactly this gap between regulatory requirements and operational reality. The real challenge is often not understanding the requirements, but implementing them effectively.

Guest speaker Raphael Köllner brings a unique combination of expertise as a Corporate Data Protection Officer, AI Officer, CISO, and Microsoft MVP/RD.

He will explain what the legislation actually requires, how the NIS2 templates available in Microsoft Purview Compliance Manager support compliance efforts and where their limitations lie, and how to build a sustainable governance foundation for your Microsoft 365 environment.

Following this, we will demonstrate how BCC Affirmatic helps automate governance, lifecycle management, and compliance evidence in Microsoft 365, replacing manual and error-prone administrative processes.

What You Will Learn

• What NIS2 specifically requires from your Microsoft 365 environment, explained from a legal and compliance perspective
• How the NIS2 framework in Microsoft Purview Compliance Manager works and where its limitations are
• Why ownership, lifecycle management, and access rights are critical for demonstrating compliance
• Practical guidance from BCC on how to establish and sustain governance processes in Microsoft 365

Who should attend:  M365 Admins, Digital Workspace Managers, Heads of IT