KRITIS
Critical Infrastructure
Kritische Infrastrukturen
KRITIS denotes organisations and facilities of essential importance to society, whose failure or impairment would cause significant supply shortages or threats to public safety. In Germany the affected sectors and thresholds are defined through the Federal Office for Information Security (Germany) (BSI) Act and the BSI Critical Infrastructure Ordinance (BSI-KRITISV). With Network and Information Security Directive 2 (NIS2) the circle of regulated entities was extended far beyond the classic KRITIS notion.
History. Critical-infrastructure protection in Germany took concrete shape with the IT Security Act of 2015 and the subsequent Federal Office for Information Security (Germany) (BSI) Critical Infrastructure Ordinance. A threshold principle was decisive: facilities count as critical once they exceed defined supply levels, classically oriented around serving 500,000 people. IT Security Act 2.0 (2021) tightened duties and, among other things, made attack-detection systems mandatory.
Facts. KRITIS sectors include energy, water, food, information technology and telecommunications, health, finance and insurance, transport, municipal waste disposal and state/administration. Operators must take appropriate technical and organisational precautions reflecting the state of the art, run attack-detection systems and report significant disruptions to the Federal Office for Information Security (Germany) (BSI). Network and Information Security Directive 2 (NIS2) and the parallel KRITIS umbrella law (physical resilience) extend and re-layer these duties.
Outlook & recommendation. The line between „KRITIS“ and the ordinary mid-market is blurring: through Network and Information Security Directive 2 (NIS2) many companies now fall under comparable duties without ever having seen themselves as critical infrastructure. The sensible first step is a clean applicability analysis — sector, threshold, entity type — and only then the action plan. Energy suppliers and municipal utilities in particular are a core field of NEOSEC's practice.