Security & governance
KRITIS
KRITIS is the German shorthand for critical infrastructures (Kritische Infrastrukturen): organizations and facilities whose failure would cause serious supply shortages or risks to public safety. German law places operators of critical installations under stricter cybersecurity and physical resilience duties than other companies, with oversight by federal authorities.
Which sectors and thresholds define KRITIS?
The KRITIS umbrella law lists ten sectors: energy, transport and traffic, finance, social security, health, water, food, information technology and telecommunications, space, and waste disposal. Whether a specific installation counts as critical is decided by thresholds, and the standard rule is that an installation supplying 500,000 people or more is in scope. The detailed thresholds are set by ordinance.
Which laws apply to KRITIS operators?
Two laws now frame the obligations. The law implementing the NIS2 directive entered into force on 6 December 2025 and recast the BSI Act; it covers more than 30,000 companies in total and treats operators of critical installations as a subset of its top category, the particularly important entities. The KRITIS umbrella law followed in March 2026 and implements the EU directive on the resilience of critical entities.
| Law | Focus | Example duties |
|---|---|---|
| NIS2 implementation law (BSI Act) | Cybersecurity | Risk management measures, incident reporting, proof of compliance every three years for operators of critical installations |
| KRITIS umbrella law | Physical resilience | Registration, risk analysis at least every four years, resilience plan, incident reports within 24 hours |
What do the rules mean for backup and storage?
The NIS2 risk management measures include business continuity and backup management, so backup design, recovery testing and the protection of backup systems become auditable topics for operators and their suppliers. Because proof of compliance is periodic, operators need evidence that survives staff changes: documented recovery objectives, restore test records and logs from the storage platform. These sit alongside the organization's business continuity and disaster recovery plan. Many operators structure the work using BSI IT-Grundschutz.
Is KRITIS the same as NIS2?
No. NIS2 is the wider net: it captures medium and large companies across many sectors as important or particularly important entities. KRITIS is the narrower group inside it whose installations exceed the criticality thresholds, and that group carries additional duties under both laws. A company can therefore fall under NIS2 without being a KRITIS operator.
Frequently asked questions
How many KRITIS sectors are there?
The KRITIS umbrella law lists ten sectors, from energy and water to space and waste disposal.
What is the usual KRITIS threshold?
The standard rule is an installation that supplies 500,000 people or more, with sector-specific thresholds defined by ordinance.
How often must KRITIS operators prove compliance?
Operators of critical installations must provide proof of their cybersecurity measures every three years.
Related terms
- BSI IT-Grundschutz: the German methodology for information security.
- Business continuity: keeping essential services running through disruption.
- Disaster recovery plan: the documented path back to service.
- Disaster recovery testing: producing the evidence audits ask for.
- Third-party risk management: extending requirements to suppliers.