{"id":4671,"date":"2026-05-21T11:44:50","date_gmt":"2026-05-21T09:44:50","guid":{"rendered":"https:\/\/visit.astrum-it.de\/?post_type=news&p=4671"},"modified":"2026-05-21T11:44:50","modified_gmt":"2026-05-21T09:44:50","slug":"bsi-access-control-and-visitor-management-for-kritis-companies","status":"publish","type":"news","link":"https:\/\/visit.astrum-it.de\/en\/news\/bsi-access-control-and-visitor-management-for-kritis-companies\/","title":{"rendered":"BSI Access Control and Visitor Management for KRITIS Companies"},"content":{"rendered":"

\"\"<\/p>\n

Companies classified as KRITIS operators must review and update their security policies. We provide an overview of the key background information and explain the role that modern visitor management systems can play in this process.<\/p>\n<\/div>

What is the KRITIS Framework Act about?<\/h2>\n

The KRITIS Framework Act transposes the EU CER Directive (Critical Entities Resilience, EU 2022\/2557) into national law and strengthens the resilience of critical infrastructure in Germany. It defines which facilities are considered KRITIS entities<\/b><\/a> and sets out binding requirements for their physical security\u2014such as protective measures, risk assessments, and emergency preparedness. In addition to access controls, this includes, for example, protection against natural hazards or sabotage.<\/p>\n

While the KRITIS umbrella law primarily addresses the physical security and resilience of critical facilities<\/b>, the European NIS2<\/b><\/a> Directive has a different focus: It defines requirements for cybersecurity, IT risk management, and reporting obligations in the event of security incidents<\/b>.<\/p>\n

In the future, many organizations will be subject to both sets of regulations<\/b> simultaneously\u2014albeit with different requirements and priorities.<\/p>\n

In a separate article<\/b><\/a>, we explain what requirements the NIS2 Directive places on visitor management and access controls from an IT perspective and how companies can implement them.<\/b><\/p>\n

The KRITIS umbrella law primarily affects companies providing essential services, such as in the energy, water, transportation, or healthcare sectors, generally serving a population of approximately 500,000 or more. The goal is to strengthen the long-term security of supply for systemically important services.<\/p>\n<\/div>

What does KRITIS have to do with access control and visitor management?<\/h2>\n

In the context of KRITIS, access control involves much more than traditional locking systems. Critical facilities such as data centers, control centers, or<\/p>\n

production plants must be protected reliably not only digitally but also physically.<\/p>\n

Mechanical keys are generally insufficient for this purpose, as they do not allow for audit-proof logging of access. This means that in an emergency, the necessary traceability is lacking\u2014for example, in the event of security incidents or audits. However, it is precisely this transparency that is becoming increasingly important: Security incidents must be reported, and operators of critical infrastructure must be able to determine who had access to sensitive areas and when<\/b>.<\/p>\n

KRITIS operators are therefore required to implement comprehensive security concepts. These include, for example:<\/p>\n