KRITIS Umbrella Act: what operators should do now

The German KRITIS Umbrella Act (KRITISDachG) of 11 March 2026 (BGBl. 2026 I No. 66), in force since 17 March 2026 and last amended on 21 July 2026 (BGBl. 2026 I No. 221), transposes the CER Directive (EU) 2022/2557 on the resilience of critical entities. It covers physical resilience against natural hazards, accidents, sabotage, terrorism, public health emergencies and supplier failures. Cybersecurity stays in the German BSI Act (BSIG). This guide shows the duties in the order in which they fall due. The example is invented.

Legal status: what already applies and what is still missing

The act has been promulgated, but key parts depend on rules that are still pending (as of 10 November 2026):

Ordinance on critical services and thresholds (§ 4(3), § 5(1) KRITISDachG): not promulgated; a draft by the Federal Ministry of the Interior (BMI) exists. Until then, in our assessment, an installation becomes critical under the KRITIS Umbrella Act only through a determination in the individual case (§ 5(3)).
Registration: the Federal Office of Civil Protection and Disaster Assistance (BBK) sets the procedure only within four weeks after the ordinance enters into force (§ 8(8)). According to the BBK FAQ, there is currently no registration duty under the KRITIS Umbrella Act yet.
Further determinations by the BBK and the BMI: reporting procedure (§ 18(3)), templates for resilience plans (§ 13(5)), possible minimum requirements (§ 14(1)) and specifications for the risk analysis (§ 12(3)).
Cybersecurity: for the term critical installation in the BSIG, the BSI Critical Infrastructures Ordinance (BSI-KritisV) continues to apply until the ordinance arrives (§ 66 BSIG).

That sounds like waiting, but it is the best time to prepare: whatever you put in order now, you only transfer later.

Who is affected

The act applies to operators of critical installations in ten sectors: energy, transport and traffic, finance, social security benefits and basic income support for jobseekers, health, water, food, information technology and telecommunications, space, and municipal waste disposal (§ 4(1)).

Critical service: its failure would lead to significant supply shortages or threats to public safety (§ 2 no. 4).
Critical installation: a site, machine, device, software or IT service that is significant for providing a critical service (§ 2 nos. 2 and 3). Software and IT services count only where they directly control, monitor or support physical processes of the service; otherwise only the BSIG applies (§ 2 no. 2).
Operator: whoever exercises decisive influence over the installation, not necessarily the owner (§ 2 no. 1).

The act sets a standard value of 500,000 people supplied for the thresholds (§ 5(2)), a guideline for the ordinance, not a value for classifying yourself. In practice, map your installations provisionally to the categories of the BSI-KritisV. An installation that reaches the threshold there is already critical under the BSIG and will probably be so under the KRITIS Umbrella Act too. Keep an eye on installations just below the threshold.

Not every duty applies to every sector (§ 4(2)): financial entities under DORA and operators in information technology and telecommunications must register, but the other duties do not apply to them. Municipal waste disposal and social security register and also carry out the risk analysis. For electricity, gas and hydrogen, § 5f of the German Energy Industry Act (EnWG) replaces § 16(1) to (6) for evidence (§ 16(7)).

Two acts, one operator: the line to NIS2

Under the BSIG, operators of critical installations are essential entities, regardless of size and turnover (§ 28(1) no. 1 BSIG). They are therefore subject to both acts, which complement each other:

KRITIS Umbrella Act: physical resilience against all hazards; responsible are the BBK as central point of contact and the competent sector authority (§ 3).
BSIG: cybersecurity of IT systems, components and processes, with risk management under § 30 BSIG and the evidence for critical installations under § 39 BSIG.

Both share one registration facility (§ 8(1)) and one reporting office of the BSI and the BBK (§ 18(1)). An event that is exclusively a security incident under the BSIG is not an incident under the KRITIS Umbrella Act (§ 2 no. 9). A cyberattack that shuts down a pump, on the other hand, can belong in both reporting channels.

The duties and their deadlines

Duty	Legal basis	First due	After that
Registration with the BBK	§ 8(1)	at the latest three months after the installation counts as critical	changes within two weeks, supply level yearly (§ 8(6))
Risk analysis and risk assessment	§ 12	nine months after registration (§ 8(7))	as needed, at least every four years
Resilience measures and resilience plan	§ 13	ten months after registration	as needed and after every risk analysis
Incident reporting	§ 18	ten months after registration	per incident: 24 hours, update, report after one month
Implementation by management	§ 20	ten months after registration	ongoing
Evidence to the authority	§ 16	on request, risk-based	no fixed cycle

Sections without a named act refer to the KRITISDachG.

What operators should do now

Assign responsibility. Management must implement and oversee the resilience measures (§ 20(1)). Name one person who brings together information security, emergency management, site security and facilities.
Clarify the classification provisionally. Determine sector, critical service and installations, calculate the supply level under the BSI-KritisV and record the result with a date.
Collect the registration details. Per installation: operator with legal form, contact details, name of the installation, sector and service, location and supply area, public IP address ranges, a point of contact and the types of critical components (§ 8(1)).
Prepare the risk analysis. Record the hazards: natural, technical and human-made risks, including hybrid and terrorist threats (§ 12(1) no. 1 in conjunction with § 11(2) no. 1). Add the dependencies in both directions: whom you depend on and who depends on you (§ 12(1) no. 2).
Take stock of existing measures. The act names six groups (§ 13(3)): emergency preparedness, physical protection, crisis management and alerting, business continuity with standby power and alternative supply chains, security management for staff and external service providers, training and exercises.
Draft the reporting process. Criteria, who decides around the clock, and alignment with § 32 BSIG.

Existing material counts: risk analyses, emergency manuals, alarm plans and certificates from other duties or voluntary certifications can serve as evidence (§ 17(1)).

The resilience plan

You set out all measures in a resilience plan and apply it (§ 13(4)). The plan shows why you chose a measure: which risk it addresses and how you weighed the effort against the risk (§ 13(2)). The competent authority can request it (§ 16(2)).

A document in a drawer is not enough: exercise reports, test records, maintenance records of the standby power and training records show that the plan is applied. The BBK provides templates for resilience plans (§ 13(5)) at the latest eight months after the ordinance enters into force. Align your plan with them then.

Reporting incidents

An incident is an event that significantly impairs, or could significantly impair, the critical service (§ 2 no. 9). You report to the BBK through the joint reporting office (§ 18(1)):

Initial report: without undue delay, at the latest 24 hours after becoming aware,
update: for ongoing incidents,
detailed report: at the latest one month after becoming aware.

Each report contains what is known at that point, in particular the number and share of those affected, the duration and the affected area (§ 18(2)).

Example from water supply

The example is invented. A water supplier runs a waterworks that already counts as a critical installation under the BSI-KritisV. For cybersecurity it has an ISMS. For the KRITIS Umbrella Act it proceeds like this:

Classification: provisionally critical, reviewed again when the ordinance is promulgated.
Registration data sheet: fully completed, with point of contact and deputy.
Risk analysis: the existing ISMS method is extended by physical hazards. At the top are heavy rain at the pumping station in the valley and a longer power outage.
Dependencies: standby power lasts 48 hours, the chemical stock ten days. There is no second supplier for fuel.
Measures: flood protection at the pumping station, a resupply contract for fuel, one command post exercise a year.

When the ordinance arrives, it transfers the details and knows its follow-up deadlines the same day.

Checklist

Responsibility and deputies are assigned, and management is involved.
Sector, critical service and installations are provisionally classified.
The registration details for each installation are complete.
The risk method covers physical hazards and dependencies.
Existing measures are mapped to the six groups of § 13(3).
A draft resilience plan refers to the risk analysis.
The reporting process works around the clock and is aligned with the NIS2 reporting channel.
Existing evidence and certificates are recorded.
The legal status is reviewed at least every six months.

The KRITIS Umbrella Act in Complass

A spreadsheet for deadlines, a folder for the plan, emails for exercise reports: that is how people lose track. In Complass everything sits in one place:

Guided project: the KRITIS Umbrella Act module leads you in seven phases from applicability through registration, risk analysis, resilience measures, resilience plan and incident reporting to evidence and management duties.
Templates: applicability assessment, registration data sheet, risk analysis, resilience plan, incident report template, exercise program and evidence overview.
Measures catalog: the resilience measures follow the six groups of § 13(3), each with applicability, status and evidence.
Risks: you record physical hazards in the risk register in the category "Physical / environmental", next to your cyber risks.
Incidents: an incident gets the KRITIS-DachG reporting channel added, with the initial report after 24 hours and the report after one month, counted from awareness.

Risk heat map of the demo company with inherent risk and target risk per risk — Risk heat map: impact and likelihood, before and after the measures.

Whether you are affected at all is shown by the free applicability check. Besides NIS2, it also asks about critical installations.

Frequently asked questions

Do we have to register with the BBK today?

According to the BBK FAQ, there is currently no registration duty under the KRITIS Umbrella Act, because the ordinance is missing. It is different if the Federal Ministry of the Interior determines in the individual case that your installation is significant (§ 5(3)). Regardless of this, the BSIG continues to apply to cybersecurity.

Does the KRITIS Umbrella Act also apply to companies covered by NIS2?

Only if they operate a critical installation. Many important and essential entities under the BSIG are not operators of critical installations. Conversely, every operator of a critical installation is an essential entity under the BSIG.

Do we have to write everything from scratch?

No. Emergency manuals, alarm plans and risk analyses from other duties or certifications can serve as evidence (§ 17(1)).

Who is responsible: the BBK or the sector authority?

Both. The BBK is the central point of contact for registration and reporting, and names the authority competent for your service when it confirms your registration (§ 3, § 8(5)).

In a demo we use a sample project to show you how classification, risk analysis and measures turn into a resilience plan.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the KRITIS Umbrella Act and the BSIG and the determinations of the BBK are authoritative. As of November 2026.