Critical infrastructure covers organizations and facilities that provide essential services. Examples include energy, water, health, transport, telecommunications and parts of finance. Germany commonly uses the abbreviation KRITIS; exact legal scope and thresholds depend on the applicable current legislation.
The security objective extends beyond confidentiality. Availability, safe operation, supply chains, physical dependencies and recovery are central because a technical incident can affect society outside the affected organization.
What changes for security planning?
- - Identify essential services and dependencies, not only servers.
- - Separate operational technology and administrative paths where appropriate.
- - Prepare resilient communication and manual fallback procedures.
- - Test incident response, recovery and cooperation with authorities.
KRITIS, essential and important entities
Germany's NIS2 implementation law entered into force on 6 December 2025, bringing new registration and incident-reporting obligations under the BSIG. Operators of critical installations form a particularly relevant subset, while the law also covers other essential and important entities. Classification depends on sector, entity type, size, installations and legal thresholds. A broad industry label alone is not enough for a legal conclusion.
| View | Core question | Example |
|---|---|---|
| Service | Which supply or societal function must continue? | Electricity distribution, drinking water, hospital care or telecommunications. |
| Installation and IT/OT | Which technical components enable the service? | Control systems, identities, data centre, cloud, network and remote access. |
| Dependency | Which failures outside the organization have an immediate effect? | Energy, supplier, platform, staff, site or communications provider. |
| Impact | What consequences arise for society, the economy and public safety? | Supply interruption, health hazard or cascading failure. |
Connect cybersecurity and physical resilience
Critical services depend on more than software. Access, spare parts, power, cooling, staff and communications can interrupt the same process. Germany expanded the physical resilience framework in 2026, but applicability and duties still require review of the current statutes and BSI information. Exercises should include combined scenarios and manual fallback procedures.
Thank you for your feedback! We will review it and optimize this content.