What Constitutes Critical Infrastructure? The Complete KRITIS Guide 2025

What Counts as Critical Infrastructure?

What Is KRITIS?

KRITIS refers to critical infrastructures—organisations and facilities essential for the functioning of society. Their failure or disruption can cause:

• long-term supply shortages
• severe public safety impacts
• far-reaching societal consequences

When Is Something Classified as Critical Infrastructure?

Not every public-facing organisation automatically qualifies as KRITIS. Key criteria include:

1. Systemic Importance

A facility is KRITIS if its failure would cause major supply shortages or security issues.

2. Threshold Values (BSI-KritisV)

Sector-specific quantitative thresholds, for example:

• Energy: input/output capacity
• Hospitals: ≥ 30,000 inpatients per year
• Water: daily production volume
• IT: data centre connection capacity > 3.5 MW

3. Functional Contribution

Highly networked or indispensable services also fall under KRITIS.

Classification occurs via:

• self-identification, or
• government designation

The 9 KRITIS Sectors at a Glance

1. Energy
2. Information Technology & Telecommunications
3. Water
4. Food Supply
5. Healthcare
6. Finance & Insurance
7. Transport & Traffic
8. Government & Administration
9. Media & Culture

Practical Examples

• Hospital:

  „

  ≥ 30,000 inpatients/year → KRITIS (Healthcare)

• Data Centre:

  „

  3.5 MW connection capacity → KRITIS (IT)

• Food Wholesaler:

  „

  Supplies millions daily → potential KRITIS relevance

KRITIS is more diverse than energy or water—it includes IT, logistics, and essential commerce.

Legal Foundations & Protection Concepts

Key regulations:

• BSI Act (BSIG) – technical/organisational security measures
• BSI-KritisV – sector thresholds and definitions
• NIS2 Directive – expanded scope & stricter EU-wide requirements

Typical protection measures:

• Information Security Management System (ISMS)
• Risk analyses
• Business continuity management (BCM)
• Security policies, access controls, awareness training

Why Protecting Critical Infrastructure Is Becoming More Important

Drivers include:

• more digitalisation → more attack surfaces
• rising cyberattacks on hospitals, utilities, authorities
• climate risks & extreme weather
• geopolitical tensions
• new laws like NIS2 and the KRITIS Framework Act

Resilience is evolving from a best practice to a legal requirement.

Conclusion

Critical infrastructures form the backbone of modern society. Understanding KRITIS classification, legal requirements and risks helps organisations implement the right measures early and remain resilient.

Q&A (English)

What counts as critical infrastructure? Organisations in sectors like energy, water, IT, healthcare, finance, transportation, government, media and waste management whose failure would severely impact society.

Who determines what KRITIS is? Legal regulations—primarily the BSI-KritisV—define the criteria.

Is every hospital or IT provider automatically KRITIS? No. Only after threshold values are exceeded (e.g. ≥ 30,000 inpatients/year).

What obligations do KRITIS operators have? Operate an ISMS, report incidents, conduct risk analyses, implement security measures.

Will regulations change due to NIS2 or the KRITIS Framework Act? Yes. More organisations will fall under the scope, and requirements will become stricter.