KRITIS

As of: 10/2026

What rules apply to KRITIS?

The IT security of critical infrastructure is regulated by the BSI Act (BSIG). It was recast by the NIS2 Implementation Act; the new version has applied since December 6, 2025. Operators of critical facilities are then considered particularly important entities regardless of their size. They must register with the BSI, report security incidents and implement appropriate measures in line with the state of the art. More on this in the entry NIS2.

Since March 17, 2026, the KRITIS Umbrella Act additionally regulates physical resilience, that is, protection against hazards such as sabotage, natural events or power outages. Operators register for this with the Federal Office of Civil Protection and Disaster Assistance (BBK) and prepare risk analyses and resilience plans. Which facilities count as critical is determined by thresholds in statutory ordinances. This entry does not replace legal advice.

What KRITIS means for IT decommissioning

At KRITIS operators, decommissioned servers, control computers or laptops often contain network diagrams, access credentials and configurations. If they fall into the wrong hands, this can endanger the facility itself. Decommissioning therefore belongs in the security concept: with a high or very high Need for protection, an unbroken chain of custody and proof for each data carrier. Second IT collects hardware sealed in direct trips, erases with Blancco and destroys data carriers that cannot be erased in its own facility according to DIN 66399 (up to H-5 and E-5). More about Data security at Second IT.

Frequently asked questions about KRITIS

Which sectors belong to KRITIS?

Among others energy, water, food, health, information technology and telecommunications, finance and insurance, transport and traffic, and municipal waste disposal. The thresholds of the respective ordinance are decisive.

What is the difference between KRITIS and NIS2?

NIS2 extends cybersecurity obligations to many more companies. KRITIS operators form the most strictly regulated group within it and additionally have obligations under the KRITIS Umbrella Act.

Do special requirements apply to decommissioned hardware?

There is no separate law for this. However, the required security measures also include the secure disposal of data carriers. Documented erasure or destruction per serial number is the usual proof here.

Is my company a KRITIS operator?

That depends on the sector and the supply level of your facility. Statutory ordinances set thresholds above which a facility counts as critical. Belonging to a sector alone is not enough. If in doubt, have this reviewed legally.

Where do KRITIS operators have to register?

For IT security, with the Federal Office for Information Security (BSI). For physical resilience under the KRITIS Umbrella Act, with the Federal Office of Civil Protection and Disaster Assistance (BBK). So there are two separate reporting channels.