Critical infrastructure (KRITIS) is essential to the functioning of society. For this reason, the organisations and facilities involved are subject to strict regulatory requirements. TÜV Nord supports you in meeting all these requirements with its KRITIS certification services.
Request Offer
Critical infrastructure (KRITIS) comprises facilities, installations, systems and associated organisations that are essential to the functioning of society, public safety and the provision of services to the population.
KRITIS provide critical services, and measures must be taken to prevent failures or disruptions to these infrastructures.
Originally, nine sectors fell under KRITIS; following the 2021 amendment to the Act on the Federal Office for Information Security (BSIG), there are now ten sectors and industries:
Whether a facility is classified as KRITIS depends on its type, size and significance within the relevant sector. Key factors include the number of people served and sector-specific thresholds.
At federal level, these thresholds are laid down in the KRITIS Framework Act (KRITISDachG), which came into force in March 2026. According to this, all facilities that serve 500,000 people are, in principle, considered critical infrastructure. However, under Section 5(5) of the KRITIS Framework Act, the federal states may also designate facilities that do not meet these thresholds.
The Federal Ministry of the Interior is currently working on amending the Ordinance on the Designation of Critical Facilities under the KRITIS Framework Act (BSI-Kritis Ordinance, BSI-KritisV), which sets out the sector-specific thresholds and classification criteria in detail.
KRITIS operators must meet numerous requirements regarding the information security and resilience of their facilities in accordance with the BSIG and the KRITISDachG. In addition, there are sector-specific regulations. These require, amongst other things:
Registration must take place no later than three months after classification as critical infrastructure. The necessary security and resilience measures include, amongst other things:
The compliance audit under the KRITIS umbrella legislation is currently being specified
With TÜV Nord’s KRITIS compliance assessment services, you can demonstrate that all requirements have been implemented transparently and in accordance with the regulations. Please feel free to contact us for further information.
The BSI requires operators of critical infrastructure to meet certain requirements. Here is an overview of the measures to be implemented:
Companies must register with the BSI and designate a contact point immediately upon being identified as a KRITIS operator. The BSI may register operators as critical infrastructure on its own initiative and, in certain circumstances, request access to documents if they fail to comply with their registration obligation.
Under IT-SiG 2.0, intrusion detection systems (IDS) are now explicitly included among the technical and organisational security measures in KRITIS facilities. These systems must continuously and automatically collect and analyse appropriate parameters and characteristics from ongoing operations. To this end, they should be capable of continuously identifying and preventing threats, as well as providing for appropriate remedial measures in the event of incidents. This requirement can be met, for example, through a Security Operations Centre (SOC) or Security Information and Event Management (SIEM).
The use of SzA will be mandatory from 1 May 2023 at the latest.
Operators of critical infrastructure and organisations of particular public interest are required, in the event of significant disruptions, to provide the BSI, upon request, with the information necessary to resolve the disruption.
Companies must report the use of critical components in certain sectors. The use of such components may be prohibited. According to Section 2 of the IT Security Act (IT-SiG), critical components are IT products whose failure would significantly impair the functioning of the system. These components are yet to be defined for the respective sectors.
Operators must compile an inventory of critical IT products in KRITIS facilities — including up-to-date information on manufacturers and product types. Until now, this requirement applied only to the telecommunications KRITIS sector.
The KRITIS protection objectives (availability, confidentiality, integrity and authenticity) must be defined on the basis of the operationally relevant components, incorporated into the risk assessment and taken into account throughout all processes. The impact on the operational capability of the critical infrastructure and the critical service should serve as a guide to the extent of the risk to the general public.
If security measures are feasible and appropriate according to the current state of the art, the operator must implement them. As a general rule, transferring risks – for example, to insurance companies – is not possible and is no substitute for security measures.
A purely business-oriented risk assessment is generally insufficient.
In accordance with Section 8a(3) of the Federal Information Security Act (BSIG), operators of critical infrastructure must demonstrate to the Federal Office for Information Security (BSI) every two years, through security audits, that they have implemented appropriate measures and are complying with technical standards.
Regardless of whether they are classified as critical infrastructure, the relevant facilities and organisations are subject to numerous regulations. Consequently, depending on the sector, different responsibilities and exemptions apply under the BSIG and the KRITISDachG, which are intended to prevent duplication of regulation. Here are a few examples.
KRITIS operators in the financial sector are subject to supervision by the Federal Financial Supervisory Authority (BaFin). Exceptions to the requirements of the BSIG arise, amongst other things, in connection with the Digital Operational Resilience Act (DORA), which already sets out strict requirements in the areas of risk management, incident reporting, audit and documentation obligations, and supply chain management.
The Federal Network Agency (BNetzA) is responsible for operators of public telecommunications networks and providers of publicly available telecommunications services. In this sector, the Telecommunications Act (TKG) sets out, amongst other things, exceptions to the scope of the BSIG.
The Federal Network Agency (BNetzA) is also responsible for operators of energy supply networks, energy installations and digital energy services. In this regard, the Energy Industry Act (EnWG) limits the scope of application of the BSIG.
There are also overlaps between the two key pieces of legislation – the BSI Act and the KRITIS Framework Act – and therefore a need to clarify their respective scopes. The BSI Act distinguishes between important organisations and particularly important organisations:
Particularly important organisations are those in seven sectors which have at least 250 employees or an annual turnover of 50 million euros and a balance sheet total of more than 43 million euros. KRITIS operators are automatically classified as particularly important organisations.
Whilst important organisations are not KRITIS organisations, they must nevertheless comply with requirements regarding information and physical security. These are companies in seven sectors with at least 50 employees or an annual turnover and total assets of more than 10 million euros.
The requirements of the BSIG generally distinguish between important facilities and particularly important facilities. Within the category of particularly important facilities, a further distinction is made. Classification may be based either on the operation of critical installations or on the thresholds set out in Section 28 of the BSIG.
The following table provides an overview of the requirements arising from the BSIG and sets these out against the respective categories of facilities.
The implementation of an Information Security Management System (ISMS) is mandatory for operators of critical infrastructure in order to comply with the new security standards. An ISMS does not merely relate to a company’s IT security, but also helps to optimise business processes and structures in order to reduce disruptions and risks relating to information security management.
KRITIS operators can, for example, meet the BSI’s requirements by obtaining certification in accordance with ISO 27001, incorporating the additional aspects of the KRITIS protection objectives as set out in Section 8a of the BSIG.
Another option for providing evidence is to use a sector-specific security standard (B3S) recognised by the BSI or the BSI’s guidance document as the basis for assessment.
| BSIG | Contents | Critical infrastructure (KRITIS) | Particularly important entity (excluding KRITIS) | Important entity |
|---|---|---|---|---|
| §30 | Risk management measures | Applicable | Applicable | Applicable |
| §31 | Specific requirements for risk management | Applicable | Not applicable | Not applicable |
| §32 | Reporting obligations | Applicable | Applicable | Applicable |
| §33 | Registration requirements | Applicable | Applicable | Applicable |
| §34 | Special registration requirements | Applicable | Not applicable | Not applicable |
| §35 | Duty to provide information | Applicable | Applicable | Applicable |
| §38 | Duties of the management | Applicable | Applicable | Applicable |
| §39 | Duties to provide evidence | Applicable | Not applicable | Not applicable |
| §41 | Prohibition on the use of critical components | Applicable | Not applicable | Not applicable |
| §61 | Supervisory and enforcement measures by the Federal Ministry for Economic Affairs and Energy (BwE) | Not applicable | Applicable | Not applicable |
| §62 | Supervisory and enforcement measures wE | Not applicable | Not applicable | Applicable |
TÜV NORD CERT is an internationally recognised and reliable partner for testing and certification services. Our experts and auditors possess in-depth knowledge and are all permanently employed by TÜV NORD. This ensures independence, impartiality and continuity in the support we provide to our clients. The benefit for you is clear: our auditors guide and support the development of your business and provide you with objective feedback.
