KRITIS Identification – Does My Organization Fall Under KRITIS?

KRITIS Identification – Does My Organization Fall Under KRITIS?

Companies in Germany are required to determine whether they operate critical infrastructure. This assessment includes identifying relevant facilities and checking whether they are essential for delivering “critical services.” The legal basis is the KRITIS Regulation (BSI-KritisV), derived from §10(1) of the BSI Act (BSIG).

The regulation defines which facilities, thresholds, and supply levels qualify as critical infrastructure. This includes stationary and mobile installations, IT services, and technically interconnected systems. If a facility reaches the legally defined supply threshold, it is considered significant, and the operator becomes subject to specific security obligations.

Sectors under the KRITIS Regulation

The KRITIS Regulation defines eight sectors with sector-specific thresholds:

1. Energy

2. Water

3. Food

4. Information Technology & Telecommunications

5. Healthcare

6. Finance & Insurance

7. Transport & Traffic

8. Waste Management

What companies must comply with once classified as KRITIS

If an organization is classified as a KRITIS operator, the requirements of the BSIG apply — especially §8a and §10. This includes implementing appropriate technical and organizational measures to protect IT systems essential for the critical service. Objectives include ensuring availability, integrity, confidentiality, and authenticity.

Measures must follow the “state of the art.” While the law does not prescribe a specific system, an ISMS based on ISO 27001 or BSI IT-Grundschutz is widely used and accepted by auditors.

Since 1 May 2023, KRITIS operators must also operate intrusion detection systems capable of automated threat detection and reporting. Compliance must be demonstrated to the BSI at least every two years through audits, assessments, or certifications. The BSI may additionally conduct on-site inspections.

KRITIS classification therefore means more than a formal label — it requires mature, documented, and verifiable information security.

Frequently Asked Questions

How do I determine whether my company belongs to KRITIS?

Classification is based on the KRITIS Regulation, which defines threshold values and critical services across eight sectors. Organizations must assess whether their facilities exceed these thresholds based on size, output, or relevance for public supply.

Which sectors are considered critical?

Energy, water, food, IT & telecommunications, healthcare, finance & insurance, transport & traffic, and waste management — each with defined criteria and thresholds.

What legal requirements apply to KRITIS operators?

Under §8a BSIG, they must implement adequate and state-of-the-art IT security measures to protect the systems necessary for their critical service.

Is an ISMS mandatory?

The law is technology-neutral, but ISO 27001 and BSI IT-Grundschutz are the practical standards for structured, auditable, and BSI-accepted implementation.

What obligations arise after classification?

• Implementation of state-of-the-art security controls

• Deployment of intrusion detection systems

• Proof of compliance to the BSI at least every 2 years

• Reporting of IT disruptions

• Potential on-site inspections by the BSI