Berlin blackout shows why KRITIS resilience still depends on access control

At a glance

What this is: This is an analysis of the Berlin January 2026 blackout and the KRITIS governance gap it exposed between physical sabotage, data protection, and enforceable access control.

Why it matters: It matters because critical infrastructure teams have to treat resilience as an access and governance problem as well as a physical security problem, especially when operational data and permissions can amplify the impact of sabotage.

By the numbers:

• More than 2,200 businesses were affected by the Berlin blackout, according to KOBIL.

Context

The Berlin blackout is a reminder that critical infrastructure resilience starts with the ability to keep essential services operating after physical disruption. When a cable bridge is sabotaged, the failure is not only electrical. Transport, healthcare, communications, and heating all become dependent on how well access, data, and recovery controls were designed before the incident.

KRITIS policy matters because minimum standards are only useful when they are enforceable across operators, public bodies, and state-level variations. The article’s central governance concern is that resilience breaks down when sensitive infrastructure data is too visible, permissions are too broad, and organisations rely on paper standards instead of operational controls.

For identity and access teams, this is a real-world example of why resilience programmes cannot stop at perimeter protection. The underlying assumption that only cyber systems need governance is too narrow. Access control, MFA, encryption, and continuous risk assessment sit inside the same resilience model as physical hardening and emergency response.

Key questions

Q: What breaks when critical infrastructure access controls are too broad?

A: Broad access makes operational data easier to misuse and recovery actions harder to contain. In critical infrastructure, the problem is not only unauthorised login. It is that network maps, maintenance details, and dependency data become available to too many people, which reduces the effort needed to plan, amplify, or conceal disruption.

Q: Why do public infrastructure data and network maps increase resilience risk?

A: They reveal how services depend on one another, which helps an attacker or saboteur identify the most sensitive points of failure. Even without direct system compromise, that knowledge can guide targeting, delay recovery, and increase the blast radius of a physical or cyber incident.

Q: What are the warning signs that KRITIS governance is failing?

A: Common signals include inconsistent rules across jurisdictions, broad sharing of operational documents, emergency access that is not tightly logged, and resilience plans that assume trust rather than verified identity. If operators cannot show who can access sensitive infrastructure data, governance is already weak.

Q: How should organisations balance emergency access with accountability in KRITIS environments?

A: They should predefine emergency access, bind it to strong authentication, and keep it auditable even under incident pressure. The goal is not to block response. It is to ensure that crisis access stays narrow, time-bound, and visible enough for post-incident review.

Technical breakdown

Why access control is part of critical infrastructure resilience

Critical infrastructure resilience is often discussed as a physical engineering problem, but the operational control plane matters just as much. Access control decides who can view network maps, pipeline data, maintenance schedules, and recovery procedures. If those permissions are too broad, an attacker or insider can turn ordinary operational knowledge into an escalation path. In KRITIS environments, resilience depends on restricting who can see what, where, and when, because sensitive infrastructure data can enable targeting long before any system is physically damaged.

Practical implication: treat operational access as a resilience control, not only an IT control.

Why sensitive infrastructure data needs tighter governance

Infrastructure data such as network structures, supply points, and service dependencies is high-value targeting intelligence. Once that information is publicly accessible or loosely shared, it reduces the effort needed to plan sabotage or abuse recovery processes. Encryption protects data in transit and at rest, but it does not solve overexposure if users, contractors, or partner systems already have excessive access. The core issue is data governance, meaning clear permissions, segmentation, and reviewable access paths around operational information.

Practical implication: classify and restrict infrastructure data as attack-enabling information, not administrative paperwork.

How Zero Trust and MFA change resilience economics

Zero Trust and multi-factor authentication do not prevent every outage, but they reduce how far an incident can spread through trusted access paths. Zero Trust assumes that trust must be continuously verified, which is valuable when emergency systems, operators, and vendors all need access under pressure. MFA raises the cost of credential abuse, while continuous risk assessment helps identify when access assumptions no longer match reality. In KRITIS settings, these controls support both security and continuity because they make it harder for a single compromise to become a systemic failure.

Practical implication: use continuous verification and MFA to keep operational access bounded during crisis conditions.

Threat narrative

Attacker objective: The objective was to disable critical services by striking infrastructure whose loss would create broad operational disruption and pressure on dependent systems.

1. Entry occurred through arson on a cable bridge over the Teltow Canal, which physically disrupted the power supply and created immediate service loss.
2. The disruption cascaded into dependent services, leaving homes, businesses, trains, hospitals, and care homes operating under emergency conditions.
3. Impact spread beyond electricity into communications, heating, and continuity of care, showing how one sabotage event can become a multi-sector resilience failure.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access control is now a resilience control, not a back-office control. The Berlin blackout shows that critical infrastructure risk is not limited to walls, fences, or network segmentation. When emergency operations depend on who can see, change, or share operational data, permissions become part of continuity planning. Practitioners should stop treating access governance as separate from KRITIS resilience and design it as a core control surface.

Public exposure of infrastructure data creates an attack-enablement layer. Network maps, supply points, and dependency data are not neutral records when an attacker can use them to time or target disruption. That means data classification has to reflect operational sensitivity, not just confidentiality labels. For critical infrastructure operators, the lesson is to minimise who can discover the structure of the system in the first place.

Zero Trust is relevant here because trust collapse is exactly what sabotage exploits. In an emergency, organisations often expand access quickly for recovery, maintenance, and coordination. Without strong identity assurance, those temporary exceptions become the highest-risk path in the environment. The practical conclusion is that resilience programmes need bounded, auditable access even during crisis response.

KRITIS resilience fails when standards are uneven across operators and jurisdictions. The article’s policy critique matters because inconsistent thresholds and local exceptions weaken collective response. A national resilience model only works when operators, authorities, and emergency services can rely on the same access, data, and control expectations. Practitioners should align internal governance to the highest common denominator, not the weakest local rule.

Named concept: operational exposure gap. This article exposes the gap between having a resilience policy and actually restricting the operational information that makes disruption easier to execute. The gap is not technical only; it is a governance failure around data visibility, identity assurance, and enforcement. Teams should assess whether their own resilience plans unintentionally expose the details an adversary would need.

What this signals

Operational exposure gap: critical infrastructure resilience fails fastest when sensitive maps, dependencies, and recovery details are too visible to too many people. The control problem is not just confidentiality in the abstract, but limiting who can learn enough about the environment to turn disruption into a wider outage.

For KRITIS operators, the practical shift is toward treating access governance, MFA, and data minimisation as continuity controls. If recovery depends on expanded permissions, the programme needs pre-approved emergency pathways, stronger identity assurance, and logging that survives crisis conditions.

For practitioners

• Strengthen access control around operational infrastructure data Limit access to network diagrams, supply points, recovery runbooks, and maintenance data to named roles with explicit approval and review.
• Apply MFA to recovery and engineering access paths Require multi-factor authentication for privileged users, third-party support, and emergency access accounts that can alter critical systems.
• Classify infrastructure data by operational sensitivity Treat topology, dependency, and location data as attack-enabling information and protect it with encryption, segmentation, and least-privilege permissions.
• Test continuity assumptions against sabotage scenarios Validate whether hospitals, transport links, and communications can keep operating when one critical node is lost and access controls must be expanded under pressure.

Key takeaways

• The Berlin blackout shows that resilience depends on more than hardening physical assets, because access to operational data can widen the effect of sabotage.
• The article ties a single attack on cable infrastructure to service loss across households, businesses, transport, healthcare, and communications.
• KRITIS programmes should treat access control, MFA, and restricted infrastructure data as core continuity controls, not secondary compliance tasks.

Key terms

• Critical Infrastructure Resilience: Critical infrastructure resilience is the ability of essential services to keep operating when systems, suppliers, or dependencies fail. It depends on visibility, response speed, and proof that controls still work under stress, not just on having documented policies in place.
• Operational Data Exposure: The release or over-sharing of information that helps an attacker understand how a service is built, connected, or recovered. This includes maps, dependencies, supply points, and runbooks that can make sabotage or disruption easier to plan and harder to contain.
• Emergency Access: Emergency access is elevated access granted for urgent operational or recovery needs, often under tighter monitoring and time limits. In ERP systems, it must be attributed, approved, and reviewed because it can bypass normal role boundaries and create hidden privilege concentration.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the resilience and access decisions that underpin critical systems.