KRITIS

Critical infrastructures — stricter obligations under the German BSI Act (BSIG)

26 April 2026 · Category: NIS2 · Compliance-Kit

TL;DR

KRITIS (critical infrastructures) under the BSIG are installations, systems or parts thereof which serve to supply the population with vital goods and services — and whose failure would cause significant supply shortages or threats to public security. Reinforced by the NIS2UmsuCG: KRITIS are 'particularly important entities'.

What is KRITIS?

The 9 KRITIS sectors under the BSI-KritisV:

Energy
Water
Food
Information technology and telecommunications
Health
Finance and insurance
Transport and traffic
Media and culture
State and public administration

The thresholds are defined in the KritisV (for example energy: 500,000 people supplied).

Practical example

Typical KRITIS examples:

Electricity grid operators from 500,000 people supplied
Municipal utilities (energy and water)
Hospitals from 30,000 full inpatient cases per year
Major airports (Frankfurt, Munich, Düsseldorf)
Large banks

KRITIS in Germany and Austria

The concept of KRITIS is a German particularity. The two jurisdictions differ considerably when it comes to evidencing implementation:

Germany: The concept of KRITIS (operators of critical installations, Betreiber kritischer Anlagen) and the sectoral thresholds follow the BSIG and the BSI-KritisV. Operators of critical installations must evidence the implementation of their risk management measures (§ 30 BSIG) at the earliest three years after their first classification and every three years thereafter, by means of security audits, examinations or certifications (§ 39(1) BSIG). The competent authority is the Federal Office for Information Security (BSI).

Austria: The Austrian Network and Information Systems Security Act 2026 (NISG 2026, BGBl. I Nr. 94/2025) has no separate 'KRITIS' or 'critical installations' scheme along the lines of the BSI-KritisV. The functional counterpart are the 'essential entities' (§ 24 NISG 2026). Implementation of the risk management measures must be evidenced under § 33 NISG 2026: self-declaration within twelve months of the registration obligation arising and — on request — evidence within two years provided by an independent body (essential entities must evidence operational and organisational implementation within two months of being requested to do so). The competent authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria).

Frequently asked questions

Is KRITIS the same as an essential entity?

KRITIS is a subset of the essential entities. KRITIS are 'particularly important entities' with additional obligations (evidence of implementation every three years under § 39(1) BSIG, higher standards).

What does the BSI examine?

Operators of critical installations must evidence the implementation of their risk management measures (§ 30 BSIG) at the earliest three years after their first classification and every three years thereafter, by means of security audits, examinations or certifications (§ 39(1) BSIG). The results, including any security deficiencies identified, must be transmitted to the BSI; external auditors are required. (The former two-year cycle under § 8a(3) BSIG (old version) no longer applies under the BSIG 2025.)

Who decides whether we are KRITIS?

The sectoral supervisory authorities and the BSI. Self-classification as part of the BSI registration. In the event of a dispute: the BSI decides.