Germany’s KRITIS Umbrella Act: Strengthening Critical Infrastructure Resilience

Germany has enacted the KRITIS Umbrella Act (KRITIS-Dachgesetz), establishing a nationwide legal framework to bolster the resilience and physical protection of critical infrastructure. This move aligns with the European Union’s CER Directive (EU 2022/2557) and aims to create a uniform approach across all sectors.

Background and Motivation

The protection of critical infrastructures has become a central security task for Germany. Sectors including energy supply, water, food, health, transport, telecommunications and administration rely on complex, interconnected systems. Increasing natural events, acts of sabotage, and hybrid threats – including targeted attacks on energy facilities and IT systems – have underscored the need for a robust legal framework .

Key Provisions of the KRITIS Umbrella Act

The KRITIS Umbrella Act introduces cross-sector regulations for the physical protection of critical infrastructure for the first time. It addresses cybersecurity concerns, building upon the EU’s NIS2 Directive and existing legislation from the BSI (Federal Office for Information Security). Operators of critical infrastructure will be obligated to implement suitable and proportionate resilience measures and report significant security incidents .

Key elements of the Act include:

• National Risk Analyses and Assessments: These will consider natural, technical, and man-made risks, as well as cross-sectoral and cross-border risks, and extreme events caused by accidents, natural hazards, and health emergencies .
• Reporting Obligations: Operators must report IT disruptions or significant impairments to a designated contact point .
• IT Security Standards: Implementation of ‘state of the art’ IT security measures is required, with verification to the BSI every two years .

Concerns and Criticisms

Some observers have raised concerns about the potential for increased bureaucracy and documentation requirements without a corresponding increase in resilience. The vbw – Association of the Bavarian Economy e. V. – has called for a review of the threshold for defining critical infrastructure (currently set at serving 500,000 citizens), arguing that it may exclude rural areas . The vbw also emphasizes the need for greater involvement of federal states in defining critical infrastructure and strengthening state and administrative structures.

Looking Ahead

The successful implementation of the KRITIS Umbrella Act will depend on clear responsibilities between government and industry, and a coordinated approach to identifying and protecting critical infrastructure. The focus must be on developing effective and practical protection strategies in both physical and virtual spaces to mitigate the risk of attacks and disruptions.