![\"Kritische](\"https:\/\/visit.astrum-it.de\/wp-content\/uploads\/2026\/04\/kritische-infrastruktur-1200x668.jpg\")
<\/p>\n
KRITIS operators must therefore determine for themselves whether their organization qualifies as a critical infrastructure<\/strong> entity and whether they are required to register and comply with the relevant security regulations.<\/p>\n While the KRITIS Framework Act primarily regulates the physical protection of critical infrastructure and facilities<\/strong>, other regulations\u2014in particular the EU NIS2 Directive<\/strong>\u2014focus more on the cybersecurity of companies and organizations<\/strong>. We explain which companies are affected by NIS2 in a separate article<\/a><\/strong>.<\/p>\n<\/div><\/div><\/div><\/div><\/div> In Germany, the legal basis for classifying infrastructure as critical is the so-called KRITIS Framework Act<\/strong>. It defines which facilities and organizations are considered systemically important due to their central significance to the public.<\/p>\n According to this definition of critical infrastructure<\/strong>, this includes facilities, systems, and services whose failure or significant disruption would lead to sustained supply shortages, disruptions to public safety, or other serious consequences for the state, the economy, and society.<\/p>\n KRITIS companies<\/strong> or KRITIS operators<\/strong> are organizations that operate in one of the sectors defined by law and reach a certain level of supply relevance. As a rule, a supply threshold of at least 500,000 people<\/strong> served is decisive. For individual sectors, this threshold is sometimes determined by technical indicators\u2014such as production volumes or capacities.<\/p>\n In addition, competent authorities may classify a company as a critical infrastructure entity<\/strong> regardless of this threshold if its importance to the functioning of society so requires.<\/p>\n The KRITIS Framework Act<\/strong> classifies critical infrastructure into the following sectors:<\/p>\n Not all government agencies or financial sector actors are automatically subject to the general KRITIS regulations<\/strong>, as some are covered by their own regulatory frameworks.<\/p>\n Critical infrastructure companies thus bear a special responsibility for the stability and resilience of central supply and administrative structures. Their services form the foundation for economic performance, social security, and the government\u2019s ability to act\u2014and their systemic relevance within the legal framework is correspondingly high.<\/p>\n An important difference from regulations such as NIS2<\/strong> is that the KRITIS umbrella law<\/strong> primarily targets particularly critical facilities with high supply relevance<\/strong>. NIS2 significantly expands the scope of regulated organizations and also includes many small and medium-sized enterprises from key economic sectors.<\/p>\n<\/div><\/div><\/div><\/div><\/div> Ordinary companies are largely free to decide for themselves how well they protect themselves against sabotage, data theft, disasters, and other threats, and how they balance security costs against security risks. Operators of critical infrastructure, on the other hand, must at least comply with the KRITIS requirements<\/a><\/strong> for their security measures. We have compiled details on this in a separate article<\/a><\/strong>.<\/p>\n The focus here is primarily on physical security<\/strong>: surveillance systems, fences, security personnel, secure doors and gates with effective access controls, as well as other measures to protect critical facilities.<\/p>\n Cybersecurity<\/strong> regulations, on the other hand, are more heavily addressed in other regulatory frameworks, particularly in the EU\u2019s NIS2 Directive<\/strong>. While KRITIS primarily addresses the protection of critical infrastructure itself, NIS2 requires a significantly larger number of companies to implement structured IT security measures.<\/p>\n For the concrete implementation of many security requirements, the regulations refer to the \u201cstate of the art<\/strong>.\u201d DIN EN ISO\/IEC 27001<\/strong>, for example, provides important guidance in this regard.<\/p>\n<\/div><\/div><\/div><\/div><\/div> At VISIT, we support ISO 27001-compliant access control<\/a><\/em><\/strong> with our visitor management<\/a> <\/em><\/strong>and yard management<\/a><\/em><\/strong>. For more details, please see our articles on KRITIS & Visitor Management<\/a><\/strong><\/em> and KRITIS & Yard Management<\/strong><\/a>.<\/span><\/p>\n<\/div><\/div><\/div><\/div><\/div><\/p>\n","protected":false},"featured_media":3424,"template":"","meta":{"_acf_changed":false,"rs_blank_template":"","rs_page_bg_color":"","slide_template_v7":"","_links_to":"","_links_to_target":""},"mediathek-kategorie":[50],"class_list":["post-4657","news","type-news","status-publish","has-post-thumbnail","hentry","mediathek-kategorie-technology-insights-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news\/4657","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/news"}],"about":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/types\/news"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media\/3424"}],"wp:attachment":[{"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/media?parent=4657"}],"wp:term":[{"taxonomy":"mediathek-kategorie","embeddable":true,"href":"https:\/\/visit.astrum-it.de\/en\/wp-json\/wp\/v2\/mediathek-kategorie?post=4657"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What is critical infrastructure? What are KRITIS companies?<\/h2>\n
\n
Stricter Security Requirements for KRITIS Companies<\/h2>\n