Understanding and implementing the BSI KRITIS Regulation: How to fulfil the requirements of the security law

A new threat situation also requires a new understanding of security. The BSI KRITIS Ordinance - also known as the Ordinance on the Determination of Critical Infrastructures according to the BSI Act (BSI = Federal Office for Information Security) or BSI KritisV for short - is a centralised set of rules that is intended to promote precisely this understanding of security and the associated protective measures. The regulation defines which facilities, systems and companies in Germany are considered particularly relevant for the provision of services to the general public and how these infrastructures must be strengthened in terms of their information security and functionality.

The KRITIS Regulation came into force on 3 May 2016, but has been amended and expanded several times since then: The first amending regulation from 2017 included additional sectors such as healthcare, finance and insurance as well as transport and traffic, while the amendment to the BSI KRITIS Regulation from 2022 provided for adjustments to the content (e.g. the threshold values). Further amendments were made in 2023 and 2024, each of which added additional annexes to the KRITIS Regulation.

As already mentioned, the BSI KRITIS Regulation is aimed at operators of critical infrastructures, or "KRITIS" for short, which play a central role for the community. However, whether a company falls under this regulation does not depend solely on its size, but also on its specific function within certain sectors and whether it reaches defined thresholds. A company belongs to KRITIS if it ...

• ... is active in one of the sectors specified in the regulation, for example energy, information technology, transport and traffic, health, finance and insurance, water, food or municipal waste disposal.
• ... exceeds the threshold values specified for the sector in the CRITIS Regulation (e.g. network capacities, daily processing volumes, number of persons supplied).
• ... operates a system that is categorised as supply-relevant and/or contributes to the supply of the general public and is therefore considered system-critical.

So what exactly does the BSI KRITIS Ordinance require? In general terms, it obliges affected companies to comprehensively secure their IT systems and ensure continued operations even in the event of technical faults, cyberattacks or other security-related incidents. Many of the measures are based on the so-called BSI IT-Grundschutz, which serves as a guideline for implementation. The requirements affect not only technical systems but also organisational processes, reporting procedures and cooperation with the BSI. 

• Operators must implement appropriate organisational and technical security measures in line with current best practices.
• There is an obligation to immediately report significant IT disruptions or security incidents to the Federal Office for Information Security.
• Companies must regularly submit proof of implemented security measures in the form of audit reports.
• Operators are required to designate a contact point that is available around the clock and acts as the BSI’s direct contact.
• For certain facilities and systems, a risk assessment must be carried out to identify potential threats and vulnerabilities.
• Operators must ensure that service providers and third parties involved in operational processes also meet the relevant security requirements.

The sometimes strict and demanding requirements have a serious background: In an increasingly digital and interconnected world, dependency on reliably functioning systems is growing, while the risk of cyberattacks, technical faults and human error is also increasing. Failures in critical infrastructure would have far-reaching consequences for the economy, government and society. The KRITIS Ordinance therefore creates uniform and binding security standards to help companies strengthen their information security in a structured and proactive way. 

Moreover, the ordinance provides a clear legal framework – backed by the Security Act – and supports operators of critical infrastructure in identifying risks early on, implementing appropriate security measures and making their supply systems more resilient. In doing so, it helps protect Germany as a business location and strengthens trust in digital processes. The KRITIS Ordinance is thus a cornerstone of the national cybersecurity strategy and indispensable for protecting modern critical infrastructures.

A structured approach is crucial in order to not only formally fulfil the requirements of the BSI KRITIS Regulation, but also to effectively anchor them in day-to-day operations. In addition to the legal obligations and technical measures already mentioned, strategic, procedural and personnel aspects play an equally important role. Pay attention to the following points to make your organisation resilient in the long term:

1. Actively involve management!
   The responsibility for implementing KRITIS requirements lies at the highest level. Without clear prioritisation by management, security concepts remain ineffective.
2. Integrate information security into all business processes!
   Security measures are only effective if they are an integral part of operational processes - from procurement to operation and maintenance of your systems.
3. Train your employees regularly!
   The level of security depends largely on the behaviour of your teams. Sensitisation and awareness training must therefore be targeted and continuous.
4. Use established management systems!
   Orientate yourself to standards such as ISO 27001 or industry-specific guidelines in order to set up your security architecture in a structured manner and review it regularly.
5. Document all measures in a traceable manner!
   Complete documentation facilitates internal audits, external audits and proof to the BSI. It is the basis for transparency and compliance.
6. Keep an eye on changes and adjustments!
   The CRITIS Regulation is subject to dynamic developments. Adapt your processes to new requirements at an early stage.

Deutsche Telekom's IoT solutions create the ideal basis for implementing the requirements of the BSI KRITIS Regulation digitally, efficiently and in a future-proof manner. Intelligent sensor technology, secure connectivity and real-time data analysis enable you to detect critical conditions at an early stage, optimise your operating processes and sustainably increase the resilience of your infrastructures.