What is KRITIS?

KRITIS in plain English

When the power goes out in a region, a lot comes to a standstill within a short time: traffic lights, cash registers, pumps, cold storage facilities, and telephone networks. That’s why some organizations are especially important to the general public. If they fail, there is a risk of significant supply shortages or threats to public safety. These are referred to as critical infrastructure – in German, kritische Infrastrukturen, or KRITIS for short.

Think of critical infrastructure as the load-bearing walls of a building. A partition wall can be moved without the house shaking. But if a load-bearing wall fails, every floor is affected. That’s why stricter regulations apply to load-bearing walls – and stricter IT security obligations apply to KRITIS operators.

Today, German law mostly refers to “operators of critical facilities.” This means facilities that are significant for a critical service – for example, a power plant, a waterworks, or a large data center.

What the BSI Act and the KRITIS Umbrella Act require

The IT security obligations for KRITIS are set out in the BSI Act (BSIG) – the law on the BSI, Germany’s Federal Office for Information Security – which was revised when Germany implemented the NIS2 Directive. Which facilities count as critical is determined by the KRITIS Umbrella Act (KRITIS-Dachgesetz); the BSI Act refers to it. The key points:

1. Sectors: Critical services exist in the sectors of energy, water, food, healthcare, finance, transport and traffic, information technology and telecommunications, municipal waste disposal, space, and social insurance services and basic income support for jobseekers.
2. Thresholds: Whether a facility counts as critical depends on thresholds set out in a statutory ordinance – put simply, on how many people depend on the services it provides.
3. Registration: Operators must register their facilities via a joint portal of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance). In doing so, they designate a point of contact that the BSI can reach at all times.
4. Safeguards: They must take appropriate, proportionate, and effective technical and organizational measures in line with the state of the art – that is, with currently available, proven means. For the IT that is essential to operating the facility, attack detection systems are also mandatory – technology that continuously monitors operations and detects threats early.
5. Reporting obligation: Significant security incidents must be reported in stages to the joint reporting office of the BSI and the BBK (Section 32 BSIG): with an early warning no later than 24 hours after becoming aware of the incident, an incident notification no later than 72 hours after becoming aware of it, and a final report no later than one month after that notification.
6. Evidence: Every three years, operators must demonstrate through security audits, inspections, or certifications that their measures have been implemented.

Operators of critical facilities also count as “essential entities” (in German: besonders wichtige Einrichtungen) within the meaning of the BSI Act. Energy suppliers are additionally subject to requirements under Germany’s Energy Industry Act (Energiewirtschaftsgesetz). The KRITIS Umbrella Act also requires measures to protect against physical hazards such as sabotage or natural disasters.

A practical example

Here’s a typical scenario: A municipal utility supplies a region with electricity and drinking water. Its water supply exceeds the relevant threshold – which means the utility operates a critical facility. For its next round of evidence, it is preparing for an audit by an independent auditing body. Beforehand, it has a penetration test carried out – an authorized, simulated attack. The test reveals that a remote maintenance access point for the pump control system is reachable from the internet and protected only by a password. The utility adds further safeguards to the access point and separates the control network more strictly from the office network. The report and the retest are included as supporting evidence in the compliance documentation.

Why does this matter for businesses?

For KRITIS operators, IT security is not optional. Operators that violate their obligations risk orders from the supervisory authority and fines. Even more serious is what a successful attack can trigger: supply outages, dangers to people, and a significant loss of trust.

Companies that are not classified as KRITIS should also be familiar with the topic. With NIS2, the group of regulated companies has grown considerably – and many of them fall below the KRITIS thresholds. In addition, KRITIS operators often pass security requirements on to suppliers and IT service providers – for example, through contracts that secure the supply chain.

What businesses should do now

• Check whether you’re affected: Find out whether your facilities reach the thresholds or whether you fall under NIS2 – if in doubt, with legal advice.
• Define reporting channels: Designate a point of contact that can be reached at all times, and determine who reports an incident and when.
• Manage security systematically: An ISMS based on ISO/IEC 27001 or IT-Grundschutz provides the basis for reliable evidence.
• Look at IT and OT together: Controllers, control systems, and remote maintenance access points of your operational technology (OT) need to be put to the test just like your office IT.
• Demonstrate effectiveness: Have regular tests carried out to check whether your measures withstand a realistic attack, and document findings and remediation.
• Include the supply chain: Agree on binding rules for remote access and security requirements with your service providers.

How Rootsektor can help

As a Germany-based security company, Rootsektor tests the IT and OT of utilities and other KRITIS operators – from the website and office network to the control systems, with safe operation always taking priority. You can read how we go about this under Energy & Critical Infrastructure. The report and test certificate provide technical evidence for your compliance documentation; they do not replace an audit by a body qualified to perform it. If a security incident occurs, our Incident Response & Forensics team also supports you with your reporting obligations.