Who it’s for

For KRITIS operators: Critical facilities need clear evidence

NIS2 and the KRITIS umbrella act apply to you at the same time. Complass keeps cybersecurity and physical resilience in one program.

Try for free Request a demo

What also applies to you

Operators of critical facilities count as essential entities regardless of their size. In addition to the obligations of all NIS2 entities, the following apply:

Frameworks: NIS2 · KRITIS Umbrella Act · IEC 62443 · ISO 27001 · IT-Grundschutz · EnWG

Use attack detection systems § 31 Abs. 2 BSIG
Prove the implementation of the measures to the BSI every three years § 39 BSIG
Physical resilience under the KRITIS Umbrella Act: registration, risk analysis, resilience plan and incident reporting §§ 8, 12, 13 and 18 KRITISDachG
Registration, risk management and incident reporting like all NIS2 entities §§ 30, 32 and 33 BSIG

Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant without Complass, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

Sectors

Energy suppliers and grid operators

You structure control systems, grid control technology and generation plants with zones and conduits per IEC 62443. You manage requirements from the German Energy Industry Act in the framework "Energy Industry Act (EnWG) and IT security catalogue".

Water and wastewater

Capture process control and telecontrol systems, prioritise vulnerabilities and prepare your evidence for the BSI.

Hospitals

Hospitals above the thresholds are operators of critical facilities. You keep medical technology, clinical IT and building services in one shared asset inventory.

How Complass helps

Compliance management

NIS2 and the KRITIS Umbrella Act side by side: measures, documents and evidence organised for the audit under Section 39 BSIG.

More about this feature

Asset management

Critical facilities and their components in one place, with zones and conduits per IEC 62443 and end of support of the components.

More about this feature

Risk management

Assess risks from both laws in one register, with risk appetite and treatment plan.

More about this feature

Incident management

Record incidents, check reporting obligations and track the deadlines with a countdown.

More about this feature

What you need at a minimum as an operator of critical facilities

If you operate a critical facility, this selection covers the obligations in Complass. The free applicability check shows whether it does.

minimum selection operator of critical facilities

Start package, size S, with Business continuity management

€377 net per month

NIS2: Risk management measures and reporting duties; you prepare notifications in incident management (included). (§§ 30, 32 BSIG (opens in a new tab))
KRITIS Umbrella Act: Registration, risk assessment and resilience measures for critical facilities. (§§ 8, 12, 13 KRITIS-DachG (opens in a new tab))
Management cockpit: Management must implement the risk management measures, monitor their implementation and attend training regularly. (§ 38 BSIG (opens in a new tab))
Business continuity management (BCM): Resilience plan with emergency preparedness, training and exercises; the module adds a business impact analysis and ISO 22301. (§ 13 KRITIS-DachG (opens in a new tab))+ €79
Also included: Incident management, GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)

Try free for 14 days Order

Recommended

Business

€590 net per month

More impact with Asset management and zones and Supplier Management, room for 10 users and 2 frameworks.

Try Business

Further matching packages

Framework BSI IT-Grundschutz Approach according to BSI Standards 200-1 to 200-3, Basic, core or standard protection from €199 per month · View

Prices for businesses, net plus VAT, with annual payment and a 12-month minimum term. Monthly payment with a 15 % surcharge. As of 6 November 2026. Enterprise and groups of companies on request. All packages in the price overview

You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information

Frequently asked questions

How do critical infrastructure operators differ from other NIS2 entities?

Operators of critical facilities count as essential entities regardless of their size. In addition, they must use attack detection systems and regularly prove implementation to the BSI.

What does the KRITIS Umbrella Act add?

The KRITIS Umbrella Act concerns physical resilience, for example against natural hazards, sabotage or supply failures. It applies in Germany only. Complass maintains it as a framework of its own alongside NIS2, so you document registration, risk analysis and resilience plan in one place.

Does Complass carry out the audit under Section 39 BSIG?

No. The audit is carried out by a suitable auditing body. Complass collects measures, evidence and documents so that you can present them to the auditors and the BSI in an orderly way.

Other roles: Operators Manufacturers Suppliers and service providers All audiences at a glance

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo