![\"\"](\"https:\/\/visit.astrum-it.de\/wp-content\/uploads\/2026\/04\/kritis-anforderungen-1200x668.jpg\")
<\/p>\n
But what specific KRITIS requirements<\/strong> does the new KRITIS umbrella law entail? And what organizational, technical, and strategic KRITIS measures<\/strong> are actually necessary to ensure the long-term protection of critical infrastructure<\/strong>?<\/p>\n For operators of critical infrastructure, this is no longer just about IT security in the narrow sense. What is required is a holistic approach to resilience\u2014ranging from risk analysis and appropriate technical and organizational measures to reporting requirements and regular verification. Protecting critical infrastructure is therefore a core business responsibility that must be strategically embedded.<\/p>\n The KRITIS Framework Act complements other regulatory requirements for cybersecurity\u2014in particular the European NIS 2 Directive<\/strong>. While NIS 2 primarily sets requirements for the IT and cybersecurity of many companies and organizations<\/strong>, the KRITIS Framework Act focuses more on the physical and organizational resilience<\/strong> of critical infrastructure. We will examine the specific requirements under NIS 2 in a separate article.<\/a><\/strong><\/p>\n<\/div><\/div><\/div><\/div><\/div> Visitor Management & Yard Management (not just) for KRITIS companies.<\/p>\n<\/div> Would you like to know if you are affected by KRITIS?<\/p>\n<\/div> It is particularly important to note that responsibility does not lie solely with the IT department or plant security. Management is obligated to implement appropriate organizational measures to ensure the security and resilience of the company\u2019s systems and processes. If management fails to adequately fulfill this obligation, the company faces not only substantial fines of up to 1 million euros<\/strong>. Under certain circumstances, personal liability of management<\/strong> may also be considered.<\/p>\n Furthermore, the financial damage caused by preventable security incidents\u2014such as production downtime, reputational damage, or contractual penalties\u2014can far exceed the statutory fines.<\/p>\n This makes it all the more important to analyze regulatory requirements in a structured manner at an early stage and translate them into robust, practical measures. In this article, you will learn which legal KRITIS requirements<\/strong> currently apply, which KRITIS measures<\/strong> must be implemented under the umbrella law, and how you can design the protection of critical infrastructure<\/strong> to be legally compliant and future-proof.<\/p>\n<\/div> Under the KRITIS Framework Act, affected companies must self-register within three months<\/strong>. This process is overseen by a registration office jointly operated by the Federal Office for Civil Protection and Disaster Assistance (BBK)<\/strong> and the Federal Office for Information Security (BSI)<\/strong>. Approximately two weeks after registration, the company will be notified of the competent supervisory authority.<\/p>\n This means<\/strong> that companies must first determine for themselves<\/strong> whether they qualify as KRITIS operators. This classification is based on defined thresholds for individual sectors and facilities.<\/p>\n<\/div> One of the key KRITIS requirements<\/strong> is the preparation of structured risk analyses. In addition to the individual risks associated with their own operations, KRITIS companies must also take systemic dependencies into account.<\/p>\n These include, in particular:<\/p>\n For example, a refinery operator may depend on the electricity supply or transportation capacity for crude oil. At the same time, the transportation sector or waste management sector may rely on the refinery\u2019s products.<\/p>\n The initial risk analysis must be prepared no later than nine months after registration. It must then be updated at least every four years.<\/p>\n<\/div><\/div><\/div><\/div><\/div> KRITIS companies are required to implement appropriate KRITIS measures within ten months of registration<\/strong> and to document these measures in an implementation plan<\/strong>.<\/p>\n The goal is to provide comprehensive and robust protection for critical infrastructure<\/strong>\u2014from prevention and response to the restoration of operational capability.<\/p>\n Essentially, the legal requirements can be divided into several areas of action.<\/p>\n<\/div> A key component of the KRITIS requirements<\/strong> is proactive emergency preparedness. Operators must identify and assess risks at an early stage and define appropriate countermeasures.<\/p>\n These include, among other things:<\/p>\n The goal is to prevent disruptions, attacks, or outages in advance, detect them early, or significantly reduce the likelihood of their occurrence.<\/p>\n<\/div><\/div><\/div> The protection of critical infrastructure<\/strong> is not limited to cybersecurity. Adequate physical protection of buildings, production facilities, servers, warehouses, and technical equipment is equally essential.<\/p>\n This includes, in particular:<\/p>\n These KRITIS measures<\/strong> are designed to prevent unauthorized access, sabotage, or physical tampering. At the same time, KRITIS companies<\/a> must also be designed to be as resilient as possible to natural disasters or accidents.<\/p>\n<\/div><\/div><\/div> Despite preventive measures, incidents cannot be completely ruled out. For this reason, the KRITIS requirements<\/strong> mandate robust structures for rapid response and damage control.<\/p>\n Requirements include, among others:<\/p>\n The ability to act in a structured manner in an emergency is a key factor in determining the impact of an incident on supply security and the company\u2019s reputation.<\/p>\n<\/div><\/div><\/div> A key element in protecting critical infrastructure<\/strong> is ensuring operational continuity\u2014even in the event of a disruption. Companies must take steps to restore their critical services as quickly as possible and minimize downtime.<\/p>\n These include:<\/p>\n Effective security management encompasses not only technology and processes, but also the human factor. Operators must ensure that both their own and external personnel are reliably integrated and vetted.<\/p>\n This includes, for example:<\/p>\n Especially for outsourced services, a structured governance model is essential to fully meet KRITIS requirements<\/strong>.<\/p>\n<\/div><\/div><\/div> Regular training sessions and practical exercises are a mandatory component of KRITIS measures. Employees must be made aware of risks, threat scenarios, and rules of conduct.<\/p>\n These include:<\/p>\n Effective protection of critical infrastructure<\/strong> can only be achieved when organizational, technical, and personnel measures work together.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div> The KRITIS Framework Act supplements the requirements of the NIS2 Directive<\/strong> but does not replace them. In the future, many companies may be subject to both regimes simultaneously<\/strong>.<\/p>\n While NIS2 primarily addresses cybersecurity, IT risk management, and reporting obligations for IT security incidents<\/strong>, the KRITIS Framework Act focuses more on the overall resilience of critical infrastructure<\/strong>\u2014including physical security, organizational measures, and operational emergency preparedness.<\/p>\n The KRITIS Framework Act generally does not impose any documentation requirements that go beyond the requirements of NIS2<\/strong>. However, the competent supervisory authorities may request additional documentation.<\/p>\n We explain in detail which companies are affected by NIS2 and what specific security requirements result from it in our article on NIS2 requirements for companies.<\/a><\/strong><\/p>\n<\/div> KRITIS companies are required to report<\/strong> any incident that significantly disrupts or could disrupt the provision of a critical service.<\/p>\n The report must be submitted to the Federal Office for Civil Protection and Disaster Assistance within 24 hours<\/strong>. A detailed report must also be submitted within one month<\/strong> at the latest.<\/p>\n Audit-proof documentation of security-related processes<\/strong>\u2014such as access controls or visitor access\u2014is often a key component in investigating such incidents.<\/p>\n<\/div><\/div><\/div><\/div><\/div> As an ISO 27001<\/a><\/span><\/strong><\/em>-certified software provider, we are happy to assist companies with their initiatives, particularly when it comes to\u00a0KRITIS-compliant access control<\/a><\/strong><\/em><\/span> and KRITIS-compliant yard management<\/a><\/strong><\/span><\/em>.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"featured_media":3386,"template":"","meta":{"_acf_changed":false,"rs_blank_template":"","rs_page_bg_color":"","slide_template_v7":"","_links_to":"","_links_to_target":""},"mediathek-kategorie":[50],"class_list":["post-4656","news","type-news","status-publish","has-post-thumbnail","hentry","mediathek-kategorie-technology-insights-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news\/4656","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news"}],"about":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/types\/news"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media\/3386"}],"wp:attachment":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media?parent=4656"}],"wp:term":[{"taxonomy":"mediathek-kategorie","embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/mediathek-kategorie?post=4656"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Registration of KRITIS companies<\/h2>\n
Risk Analyses<\/h2>\n
\n
Resilience Measures, Implementation Plan, and Documentation<\/h2>\n
<\/i><\/i><\/span>1. Prevention: Systematically preventing incidents <\/span><\/a><\/h4><\/div>
\n
<\/i><\/i><\/span>2. Physical protection of critical facilities and properties <\/span><\/a><\/h4><\/div>
\n
<\/i><\/i><\/span>3. Response, Mitigation, and Consequence Management in the Event of Incidents <\/span><\/a><\/h4><\/div>
\n
<\/i><\/i><\/span>4. Restoration of critical services <\/span><\/a><\/h4><\/div>
\n
<\/i><\/i><\/span>5. Safety Management for In-House and External Personnel<\/span><\/a><\/h4><\/div>
\n
<\/i><\/i><\/span>6. Training, drills, and awareness-raising <\/span><\/a><\/h4><\/div>
\n
Relationship to NIS2<\/h2>\n
Mandatory Reporting of Incidents<\/h2>\n