Operators of critical facilities
KRITIS: duties for your ITand how they differ from NIS2
If you provide electricity, water, health care or transport for many people, you may be operating a critical facility. Stricter duties apply to these operators than to other NIS2 companies, and the KRITIS Umbrella Act adds requirements for physical protection. We help you implement the IT duties and prove them to the Federal Office for Information Security (BSI).
Am I KRITIS or NIS2?
Since 6 December 2025, the new BSI Act has been in force, with which Germany implements the NIS2 Directive. It distinguishes between particularly important entities and important entities. Whether a company belongs to either group depends on its sector, number of employees, turnover and balance sheet total. Operators of critical facilities are a subset of the particularly important entities, regardless of company size.
Whether a facility is critical depends on how many people it supplies. The thresholds are set by a statutory ordinance, until now the BSI KRITIS Ordinance (BSI-Kritisverordnung), which mostly uses a standard value of 500,000 people supplied. A municipal utility can therefore be a KRITIS operator, while a larger industrial company only falls under NIS2 as an important entity. We work out with you which facilities may qualify. The binding classification is made by your legal advisers.
KRITIS and NIS2 compared
| Who is covered | NIS2: companies in certain sectors with 50 or more employees or more than €10 million in turnover and balance sheet total. KRITIS: operators of facilities that reach the thresholds of the statutory ordinance. |
| Measures | NIS2: appropriate, proportionate and effective risk management measures (§ 30 BSIG). KRITIS: additional, stricter measures for the facility's systems (§ 31 BSIG). |
| Attack detection | Explicitly required for operators of critical facilities, taking the state of the art into account (§ 31(2) BSIG). |
| Evidence | KRITIS: verification through audits, inspections or certifications, submitted to the BSI every three years (§ 39 BSIG). For other entities, the BSI can request evidence. |
| Reporting duties | The same for both: early warning of significant security incidents within 24 hours at the latest, incident notification after 72 hours, final report after one month (§ 32 BSIG). |
| Management | The same for both: management must implement the measures, monitor compliance and take part in training regularly (§ 38 BSIG). |
This information refers to the BSI Act as amended by the NIS2 Implementation Act. We check special rules, for example for energy, telecommunications and financial entities, case by case.
The KRITIS Umbrella Act adds further duties
Since March 2026, the KRITIS Umbrella Act (KRITIS-Dachgesetz) has also been in force. It governs the physical protection and resilience of critical facilities, for example protection against sabotage, natural events or power outages. The competent authority here is the Federal Office of Civil Protection and Disaster Assistance (BBK), while IT security remains with the BSI and the BSI Act.
Under the Act, operators are to carry out risk analyses, set out resilience measures in a plan and report significant disruptions. Exactly which facilities are covered and when each deadline starts depends on a new KRITIS ordinance, which was presented as a draft in May 2026 and is to lower some thresholds. We follow these developments and tell you in our conversation what currently applies.
What this means for your IT
- A role and access rights concept that lets you prove who may access the facility's systems
- Separate accounts for admin tasks and MFA for every access, including remote support by service providers
- Attack detection systems that evaluate events continuously, and clear responsibilities for alerts
- Hardening and orderly patching, aligned with operating hours and vendor approvals
- Backup with a documented restore test and an emergency plan for the failure of central systems
- A rehearsed reporting process so that the early warning can be made within 24 hours
- A point of contact the BSI can reach
- Complete documentation for the audit under § 39 BSIG
How we support you
- 01
Classification
We go through with you which facilities and systems may be affected and prepare the questions for your legal advisers.
- 02
Gap analysis
We compare your IT with the requirements of §§ 30 and 31 BSIG and prioritise the gaps by risk and effort.
- 03
Implementation
We implement access rights, attack detection, hardening, backup and the incident process in stages, without interrupting your operations.
- 04
Audit preparation
We compile the evidence so that your audit body can work with it, and we provide technical support when questions come up.
Legal position subject to change
The law on critical infrastructure is currently being reorganised. The new KRITIS ordinance and further requirements from the BSI and BBK are in part still pending. We therefore phrase things carefully and check the current position before we name a deadline or duty to you.
Updated:
FAQ
Frequently asked questions
Am I KRITIS or NIS2?
That is decided by your facilities and not by company size alone. If a facility reaches the thresholds of the statutory ordinance, you are the operator of a critical facility. Otherwise, depending on sector and size, you may fall under NIS2 as an important or particularly important entity.
What is the difference between KRITIS and NIS2?
KRITIS operators are a subset of the NIS2 entities with additional duties. These include stricter measures for the facility's systems, attack detection systems and proof submitted to the BSI every three years.
What does the KRITIS Umbrella Act govern?
It governs the physical protection and resilience of critical facilities. The BBK is responsible, while IT security remains governed by the BSI Act. Many details still depend on an ordinance.
Which reporting deadlines apply after a security incident?
An early warning to the BSI is due no later than 24 hours after you become aware of the incident, the actual notification after 72 hours and a final report after one month. Your company submits the report, and we supply the technical information for it.
How often do KRITIS operators have to provide evidence?
Under the new BSI Act, every three years instead of every two as before. The BSI sets the first date, and there are transitional rules for existing operators.
Is management liable?
Yes. If management culpably breaches its duties, it is liable under the rules of company law. It must implement the measures, monitor compliance and take part in training regularly.
Do you carry out the audit under § 39 BSIG?
No, the audit is carried out by an independent audit body. We prepare your IT and the documentation for it and answer technical questions.
KRITIS
Where does your facility stand?
In a short conversation, we clarify which duties may apply to you and what to do first.