KRITISVorgaben

KRITISVorgaben refer to the regulatory requirements for operators of Critical Infrastructure (KRITIS) in Germany. They aim to ensure the availability, integrity and resilience of essential services that are vital for public safety and the functioning of society.

Legal framework and scope: The KRITIS obligations are part of the German IT security regime, anchored in the IT-Sicherheitsgesetz (IT-SiG) and the KRITIS-Verordnung (KritisV). The KritisV specifies which sectors and facilities are considered critical and therefore subject to increased security requirements. Supervisory authorities, headed by the Federal Office for Information Security (BSI), implement and enforce these rules.

Sectors and facilities: KRITIS covers essential infrastructure across multiple sectors, including energy, information technology and telecommunications, transport and traffic, health, water, food, the financial market, and parts of public administration. Within these sectors, facilities whose disruption would endanger public safety or national security are classified as KRITIS.

Obligations of KRITIS operators: Operators must establish and maintain security measures aligned with recognized standards (for example IT-Grundschutz or comparable state-of-the-art practices). They are required to conduct risk assessments, implement organizational and technical safeguards, and ensure proper incident response and continuity planning. In case of significant IT security incidents or disruptions, operators must report to the BSI in accordance with the statutory reporting provisions. Ongoing compliance and documentation of security measures are part of the duties under these Vorgaben.

Impact and purpose: The KRITIS Vorgaben seek to minimize the likelihood and impact of disruptions to critical services, thereby enhancing systemic resilience, public safety, and trust in essential infrastructure. Non-compliance can lead to regulatory actions, penalties, and mandatory remedial measures.