KRITIS umbrella law – What companies need to know now

The KRITIS umbrella law (KRITIS-DachG) obliges companies that provide critical services to comprehensively protect their infrastructures. The aim is to ensure the long-term security of supply in Germany, even in the event of crises and attacks.

What does the KRITIS umbrella law regulate?

The law sets binding minimum standards for the protection of critical infrastructures – both in terms of physical security and organizational and digital resilience. In the future, companies will have to prove that they have implemented appropriate protective measures.

What does this mean for companies in concrete terms?

• Registration in the KRITIS register at the BBK
• Obligation to perform risk analysis and create a resilience concept
• Reporting of security incidents
• Regular review and obligation to provide evidence to authorities

Your advantage: Proactive action

Companies that address the requirements of the KRITIS umbrella law at an early stage not only strengthen their legal security, but also their competitiveness and crisis resilience.

Challenges for companies posed by the KRITIS umbrella law

With the KRITIS umbrella law coming into force, many companies are facing extensive organizational, technical, and strategic tasks. Compliance with the new legal requirements not only requires expertise, but also careful planning and adaptation of existing structures.

Questions that KRITIS companies should be asking themselves now

Am I affected?

• Does my company meet the criteria for a KRITIS operator according to the KRITIS umbrella law?
• Is my service systemically important or critical to the general public?
• Am I already covered by other regulations such as the IT Security Act?

How resilient is my company currently?

• Do we have a robust emergency and crisis management system?
• Are we prepared for power outages, cyberattacks, or supply bottlenecks?
• Are risk analyses and vulnerability assessments carried out regularly?

What protective measures are already in place—and where are the gaps?

• What about the physical security of our locations (access control, protection against sabotage)?
• What IT security standards are implemented?
• Are there organizational measures in place to maintain critical processes even in the event of a crisis?

Are our internal structures KRITIS-compatible?

• Do we have a responsible body for resilience and KRITIS compliance?
• How is our reporting system organized—internally and vis-à-vis authorities?
• Which employees need to be trained or newly integrated?

What specific legal obligations apply to us?

• Does our company need to be entered in the KRITIS register?
• What reporting obligations apply to security incidents?
• What deadlines and documentation requirements do we have to comply with?

How do we approach implementation in concrete terms?

• Who will take on project responsibility internally?
• Which external partners (e.g., consultants, auditors, IT service providers) do we need?
• How do we integrate the requirements into ongoing operations – without compromising productivity?

Scenario: Power outage with grid consequences

An energy supplier uses CommandX to coordinate situation assessment, alert internal crisis teams, and comprehensively document the measures taken—from the initial disruption to the restoration of supply.

Scenario: Drinking water contamination

A water supplier uses CommandX to ensure that communication chains are maintained and emergency plans are activated. All steps are logged in a traceable manner—a decisive advantage when it comes to providing evidence to regulatory authorities.

Scenario: IT failure in a hospital chain

In the event of a large-scale IT system failure, CommandX provides a fail-safe, external platform that can be used to maintain situation management, resource coordination, and communication between locations.

Scenario: Disruption to rail traffic involving hazardous goods

A transport company uses CommandX to manage internal crisis communication, automatically generate situation reports for the incident command, and carry out structured decision-making processes—involving external partners such as the fire department or environmental authorities.