Despite all the focus on NIS2 and the implementation of the European directive in German law, companies should take a broader view of risk management and also consider aspects of non-European data transfers (in particular the USA and China), dependence on cloud service providers and requirements in the area of supply chains. The presentation will provide impetus in this regard.