NIS2 or the KRITIS Umbrella Act: Which Obligation Applies to What

IT security and physical protection side by side: on the left an administrator in a server room, on the right a secured steel door with an access reader, video cameras and a fence, where a security officer is standing

Key Takeaways

NIS2 focuses on IT security: it addresses particularly important and important entities in 18 sectors under Section 28 BSIG.
The KRITIS Umbrella Act requires operators of critical facilities to take explicit measures for physical resilience.
KRITIS operators are affected twice over and must meet the dual obligation to provide evidence to both the BSI and the BBK.
The reporting deadline for cyber incidents under the new BSI Act already applies within 24 hours (Section 32 BSIG).

Why the Two Frameworks Are Constantly Confused

Since 6 December 2025 and 17 March 2026, operators of critical infrastructure have been subject to two laws that look almost identical at first glance: the NIS2 Implementation Act, which fundamentally rewrote the BSI Act, and the KRITIS Umbrella Act, which transposes the CER Directive (EU) 2022/2557 into German law. Both address operators of critical infrastructure, and both involve registration, risk analysis, reporting obligations and duties for senior management. The legislator itself, however, expressly distinguishes the two directions of protection: the IT security requirements are governed by the BSIG as part of the NIS2 implementation, while the KRITIS Umbrella Act lays down, for the first time, independent minimum requirements for the physical protection of critical facilities that apply uniformly across Germany.

The confusion is understandable, because the two frameworks overlap in structure and vocabulary:

Both aim to protect critical infrastructure and transpose an EU directive: NIS2 transposes Directive (EU) 2022/2555, the KRITIS Umbrella Act the CER Directive (EU) 2022/2557.
Both require registration, regular risk analyses, documented measures and reporting obligations with a 24-hour deadline.
Both expressly place responsibility on senior management, which must approve the measures and monitor their implementation.

In practice, this similarity leads to a concrete gap: anyone who has organisationally completed their NIS2 project often considers the regulatory side done and overlooks the fact that an ISMS or an IT-Grundschutz certificate replaces neither the threat and risk analysis nor the resilience plan for physical security. The physical obligations under Section 13 KRITIS-DachG must be fulfilled separately and evidenced separately to the supervisory authority.^[1] Anyone who implements only NIS2 has therefore met half of their obligations.

NIS2: Cybersecurity, Addressees, Authority

The NIS2 Implementation Act (NIS2UmsuCG) entered into force on 6 December 2025 and fundamentally rewrote the BSI Act. It addresses particularly important and important entities in 18 sectors. The size thresholds follow directly from the law: particularly important entities exist under Section 28(1) BSIG from 250 employees or EUR 50 million in annual turnover, important entities under Section 28(2) BSIG from 50 employees or EUR 10 million in annual turnover.

At its core is the catalogue of risk management measures under Section 30 BSIG: ten mandatory areas of measures, from risk analysis and vulnerability management to cryptography and multi-factor authentication.^[2] The measures must reflect the state of the art and have applied without transition periods since the law entered into force on 6 December 2025.^[2] Significant security incidents must be reported to the Federal Office for Information Security (BSI) without undue delay and in stages under Section 32 BSIG; the procedure in detail is the subject of a separate article.

Protected asset: information technology and network and information systems, not the structural security of properties.
Competent authority: the BSI, including registration via the BSI portal and evidence under Section 39 BSIG at intervals of no less than three years.^[2]
Sanctions: fines of up to EUR 10 million for particularly important entities; with a total turnover of more than EUR 500 million, up to 2 percent of worldwide total turnover, governed by Section 65 BSIG.

A simple question is enough to draw the line: does the obligation concern information technology, its availability and its protection against cyber threats? Then it is governed by the BSIG as part of the NIS2 implementation. The fence around a substation, the access control in a waterworks or the video surveillance of a port site do not fall within this scope.

KRITIS Umbrella Act: Physical Resilience, Operators of Critical Facilities, BBK

The KRITIS Umbrella Act entered into force on 17 March 2026 and, for the first time, creates a uniform, nationwide and cross-sector legal framework for the physical protection of critical facilities. Its European basis is the CER Directive, whose transposition deadline already expired on 17 October 2024; the delayed transposition led to infringement proceedings against the Federal Republic of Germany.

The addressee is the operator of a critical facility in one of ten sectors, from energy through transport and traffic, water and health to public administration. The key benchmark is the standard threshold of 500,000 people supplied, supplemented by qualitative criteria such as dependencies, market share and potential impact of damage.^[3] For registration and supervision, the Federal Office of Civil Protection and Disaster Assistance (BBK) is the central point of contact, while the federal and state authorities responsible for each sector remain involved.

The obligations form a chain whose first link is registration. The deadlines run from registration, not from the law's entry into force:^[1]

Registration with the BBK via the joint BBK and BSI platform, no later than three months after a facility qualifies as a critical facility (Section 8(1) KRITIS-DachG).^[4]
Risk analysis and risk assessment under Section 12 KRITIS-DachG for the first time nine months after registration (Section 8(7) KRITIS-DachG).^[4]
Resilience measures and resilience plan under Section 13 KRITIS-DachG for the first time ten months after registration (Section 8(7) KRITIS-DachG).^[4]
Reporting obligations: significant disruptions must be reported without undue delay, as a rule within 24 hours at the latest, via the joint BBK and BSI reporting office.
Evidence: the supervisory authority can request the resilience plan, reports and audits on a risk basis and order on-site inspections; the law does not provide for a fixed evidence cycle.

For appropriate physical protection, Section 13(3) KRITIS-DachG names the types of measures that can count towards it: structural and technical security such as property boundaries and delaying façade elements, monitoring of the surroundings, detection equipment and access controls. These examples are to be derived on a risk basis and under the standard of proportionality, not worked through as a catalogue.^[1] Violations can be punished as administrative offences, including fines of up to EUR 1 million for breaches of the duty to provide information at registration.

Side by Side: Protected Asset, Addressee, Evidence

The two frameworks can be compared most cleanly by asking about the protected asset, addressee, authority and evidence. The following table summarises the differences:

Criterion	NIS2 (BSIG)	KRITIS Umbrella Act
Protected asset	Information security and network and information systems	Physical resilience of critical facilities
Addressee	Particularly important and important entities in 18 sectors under Section 28 BSIG	Operators of critical facilities in ten sectors, standard threshold of 500,000 residents supplied
Scale	Thresholds from 50 employees or EUR 10 million in annual turnover (Section 28(2) BSIG)	A much smaller group: only facilities above the standard threshold; concrete operator numbers will only be known once the KRITIS ordinance is issued
Competent authority	BSI^[2]	BBK as the central point of contact, alongside the federal and state authorities responsible for each sector
Risk analysis	Ten areas of measures under Section 30 BSIG, reflecting the state of the art^[2]	Risk analysis under Section 12 KRITIS-DachG, for the first time nine months after registration (Section 8(7) KRITIS-DachG)^[4]
Evidence	Under Section 39 BSIG, at intervals of no less than three years^[2]	Resilience plan under Section 13; evidence and audits on a risk basis at the request of the supervisory authority^[5]
Reporting obligation	In stages to the BSI under Section 32 BSIG	Significant disruptions within 24 hours to the joint BBK and BSI reporting office
Fines	Up to EUR 10 million; with total turnover above EUR 500 million, up to 2 percent of worldwide total turnover (Section 65 BSIG)	Tiered, up to EUR 1 million per breach of duty

Two notes on how to read it: the BSI's operator count covers registrations under the previous BSIG procedure; the KRITIS Umbrella Act places the classification of critical facilities on a framework of its own and repeals the BSI-KritisV, so the two groups may shift in future. And: one operator can run several critical facilities, which is why operator and facility numbers diverge.

Affected Twice Over: What It Means Organisationally

For most operators of critical facilities, the question "NIS2 or the KRITIS Umbrella Act" does not arise at all, because both frameworks apply at the same time: under Section 28(1) no. 1 BSIG, operators of critical facilities are in principle deemed particularly important entities and are therefore subject to the obligations of the BSIG. The reverse does not hold, because the scope of the BSIG is considerably wider. Anyone registered as a KRITIS operator must therefore strengthen digital and physical resilience side by side and evidence both separately.

Two registrations: registration in the BSI portal under Section 33 BSIG and registration with the BBK via the joint platform.
Two evidence routes: NIS2 evidence under Section 39 BSIG at intervals of no less than three years^[6] and the resilience plan under Section 13 KRITIS-DachG, which the supervisory authority requests on a risk basis.^[5]
Two reporting channels with different responsibilities, technically brought together through the joint BBK and BSI reporting office.
One property portfolio through which both sets of obligations run: the same sites, the same facilities, but different protected assets and evidence.

What matters organisationally is the allocation of responsibilities within the organisation. IT management carries the obligations under the BSIG; the physical side, from the threat and risk analysis through the protection zone concept to the planning of perimeter security, video surveillance and access control, lies with the security officers and facility management. Both evidence routes require a documented derivation: the resilience plan must show the considerations behind every measure, with reference to the risk analysis.

In practice, this means for scheduling: anyone who only sets up the risk analysis and the resilience plan once the supervisory authority requests documents uses up the preparation time that the law expressly grants between registration and the deadlines.

Interfaces Between IT and Physical Security

Separating the frameworks does not mean that digital and physical security should be planned as isolated solutions. On the contrary: modern security technology is itself part of the IT infrastructure. Access control processes personal data and is subject to co-determination by the works council; IP-based video surveillance runs over the same network structures as the business processes it protects. A vulnerability in the network can therefore also be a vulnerability in physical protection.

At the interface between several trades, overarching security management systems (PSIM) emerge, which integrate systems from different manufacturers on a single user interface via neutral, openly available interfaces such as BACnet or OPC, across sites and countries as well. It is precisely such systems that connect physical detection with the reporting and intervention processes that both frameworks expect.

For legal compliance, this means: the physical measures under Section 13 KRITIS-DachG are planned so that their documentation remains audit-ready and does not conflict with the cyber obligations.^[5]

Having Physical Protection Duties Assessed for Your Organisation

Whether you are affected can be assessed separately for each framework: for the cyber obligations, classification under Section 28 BSIG and registration in the BSI portal are decisive; for the physical obligations, what counts is whether a facility is to be classified as a critical facility under the KRITIS Umbrella Act. Since the specific classification will be made through the ordinance yet to be issued, an early as-is survey of your own property portfolio is advisable: which sites supply how many people, where are there dependencies on other critical services, and how is the existing perimeter security, video surveillance, access control and intrusion detection documented?

This is exactly where manufacturer-independent specialist planning comes in: operators of critical infrastructure, including from energy supply, municipal drainage and aviation, are supported with security concepts and threat and risk analyses, the required security technology is planned from perimeter security to the overarching security management system, and implementation is supported through to acceptance. The derivation of every measure from the threat and risk analysis is documented so that it remains audit-ready for the BBK, authorities and experts. You can find out more under Critical Infrastructure (KRITIS).^[7]

Contact us for a no-obligation initial consultation. PLANATEL®: Independent planning and consulting since 1992. Tel: 040 / 23 73 02-30 | Email: info@planatel.de

Frequently Asked Questions

What is the essential difference between NIS2 and the KRITIS Umbrella Act?

NIS2 governs cybersecurity and the protection of information technology against digital threats. The KRITIS Umbrella Act, by contrast, focuses on the physical resilience of critical infrastructure, to protect it against sabotage, natural disasters or structural damage.

Who falls under the KRITIS Umbrella Act?

The KRITIS Umbrella Act applies to operators of critical facilities that provide essential services to the community. Classification is based on statutory thresholds, as a rule from 500,000 people supplied.

Do KRITIS operators also have to implement the NIS2 requirements?

Yes. Under the NIS2 Implementation Act, operators of critical facilities are automatically classified as particularly important entities. They must therefore meet both the digital requirements for cybersecurity and the physical protection duties.

Which authorities supervise the new obligations?

The Federal Office for Information Security (BSI) is responsible for supervising cybersecurity and incident reporting under NIS2. For physical protection and resilience plans under the KRITIS Umbrella Act, the Federal Office of Civil Protection and Disaster Assistance (BBK) acts as the competent authority.

How quickly must incidents be reported under NIS2?

Affected companies must report significant IT security incidents without undue delay. An initial early warning must reach the BSI within 24 hours, followed by a detailed notification after 72 hours.