German operators of critical installations now answer to two laws at once: the BSI Act for cyber security and the KRITIS-Dachgesetz (KRITIS-DachG) for physical resilience, and the second one runs on its own clock, its own authority and its own fines. The KRITIS-DachG transposes the EU Critical Entities Resilience Directive (EU) 2022/2557 and makes the Federal Office of Civil Protection and Disaster Assistance (BBK) the central point for registration and incident reports. This guide covers what the BSI Act guide does not: how a facility becomes a critical installation, the registration and staggered start dates in section 8, the risk analysis, resilience measures and resilience plan in sections 12 and 13, the 24-hour incident report in section 18, management duties in section 20 and the section 24 fines. It is for CISOs, security and resilience managers, and compliance leads at German operators. For the cyber side, see the Germany NIS2 Implementation Guide; for the EU directive, see the EU Critical Entities Resilience Directive Guide.
Status checked 9 November 2026. Section numbers and obligations come from the official consolidated text on gesetze-im-internet.de. The publication reference (BGBl. 2026 I Nr. 66) and the entry into force in March 2026 come from two secondary sources, buzer.de and IHK Heilbronn-Franken, which agree on both. The ordinance that sets sectors, facility categories and thresholds (the KRITIS-Verordnung under sections 4(3) and 5(1)) had not been confirmed as in force in the sources we could read; until it is, the BSI-KritisV of 2016 continues to apply. Confirm against the official text before relying on it. This page is not legal advice.
Key takeaways
- A second regime, not a replacement: the KRITIS-DachG adds all-hazards physical resilience duties on top of the BSI Act cyber duties for the same critical installations, with the BBK, not the BSI, as the lead authority.
- Thresholds come by ordinance: section 5 sets 500,000 people supplied by a facility as the general starting value, but the binding categories and values sit in the ordinance, which also ends the BSI-KritisV.
- Clocks start at registration: register within three months of a facility becoming critical; the risk analysis applies nine months after registration, and resilience measures, incident reporting and management duties ten months after.
- Reporting mirrors the cyber clock: an initial report within 24 hours of becoming aware of an incident and a detailed report within one month, through the joint BBK and BSI reporting point.
- Management is liable: section 20 obliges the management to implement and oversee the resilience measures and makes it liable to the entity for culpable breaches; section 24 fines reach EUR 1 million for ignoring an enforceable registration order.
How the KRITIS-DachG fits with the BSI Act
Germany used to run critical infrastructure (KRITIS) regulation through the BSI Act and the BSI-KritisV, which defined facility categories and thresholds per sector in nine annexes. The NIS2 reform moved cyber duties into the revised BSI Act (BSIG), and the KRITIS-DachG now owns the definition of a critical installation and the physical side. Section 12 of the BSI-KritisV states that the BSI-KritisV expires when the ordinance under sections 4(3) and 5(1) of the KRITIS-DachG enters into force.
| Question | BSI Act (cyber) | KRITIS-DachG (physical resilience) |
|---|---|---|
| Lead authority | BSI | BBK as central contact point, with the competent sector authority designated under section 3 |
| Who is caught | Essential and important entities, plus operators of critical installations | Operators of critical installations in the section 4 sectors |
| Core duty | Risk management measures (BSIG section 30, with section 31 extras for critical installations) | Risk analysis (section 12), resilience measures and resilience plan (section 13) |
| Proof | Audits, inspections or certifications every three years (BSIG section 39) | Risk-based requests, audits and on-site checks (section 16), reusing BSIG section 39 proof first |
| Incident report | 24 hours, 72 hours, one month (BSIG section 32) | 24 hours, then a detailed report within one month (section 18) |
| Registration | BSI portal (BSIG section 33) | Joint BBK and BSI channel (section 8) |
- Sectors (section 4(1)): energy; transport and traffic; finance; social insurance and basic income support for jobseekers; health; water; food; information technology and telecommunications; space; and municipal waste disposal.
- Carve-outs (section 4(2)): DORA financial entities and IT and telecommunications operators are exempt from most operator duties, including sections 12 to 16, 18 and 20. Waste disposal and social insurance operators are exempt from most duties but must still carry out the section 12 risk analysis.
- Energy proof: section 16(7) excludes significant electricity, gas and hydrogen operators from the section 16 proof regime; section 5f of the Energy Industry Act (EnWG) applies to them instead.
Is your facility a critical installation?
Section 5 makes the Federal Ministry of the Interior set, by ordinance, the facility categories, the supply thresholds, the reference date from which they apply and the categories that count regardless of threshold. The thresholds are to be based on, in principle, 500,000 inhabitants supplied by one facility, weighed against criteria such as user numbers, dependency of other sectors, duration and extent of outages, market share, geographic area and how easily the operator can be replaced.
- Individual determinations: the ministry can declare a facility critical even below the thresholds, or not critical even above them (section 5(3)).
- Notification: the BBK informs the operator in writing or electronically and, where the facility is critical, asks it to register (section 5(5)).
- Practical step now: run your existing BSI-KritisV threshold calculation for every site, keep the workings, and re-run it against the final ordinance on the day it is published.
Registration and the staggered start dates
Section 8 drives the timetable. Every later duty is measured from the date you register, so a late registration does not buy time; it just adds a fine risk.
| Step | Deadline | Source |
|---|---|---|
| Register each critical installation with the BBK | No later than three months after the facility becomes critical | Section 8(1) |
| BBK confirms registration | Should be within four weeks | Section 8(5) |
| Report changed supply values | Once a year | Section 8(6) |
| Report other changes | Without undue delay, at the latest two weeks after becoming aware | Section 8(6) |
| Risk analysis and assessment applies | Nine months after registration | Sections 8(7) and 12 |
| Resilience measures, incident reporting and management duties apply | Ten months after registration | Sections 8(7), 13, 18 and 20 |
| Repeat the risk analysis | As needed, at least every four years | Section 12 |
| BBK templates for the resilience plan | At the latest eight months after the ordinance enters into force | Section 13(5) |
The registration record is detailed: operator name, legal form and register number; contact details; facility name, sector, branch and critical service; category, supply values, location, service area and public IP ranges where relevant; EU member states served; a contact point reachable at all times; and the types of critical components used. The critical component data goes only to the BSI. If you do not register, the BBK can demand records to decide whether the facility is critical and, after hearing you, register it itself (section 8(2) and (3)).
Risk analysis, resilience measures and the resilience plan
Section 12 requires an operator risk analysis and assessment built on the national risk analyses under section 11 and other trustworthy sources. It must cover dependencies in both directions: your reliance on critical services from other operators, including other sectors, neighbouring EU states and third countries, and other sectors' reliance on your service.
Section 13 then requires proportionate technical, security and organisational measures, with the state of the art to be observed, serving four goals: prevent incidents, ensure adequate physical protection of sites and facilities, respond to and limit the effects of incidents, and restore the critical service quickly. The law's own examples:
| Goal (section 13) | Example measures in the law | Practical evidence to keep |
|---|---|---|
| Prevent incidents | Emergency preparedness | Hazard register, emergency plans, exercise records |
| Physical protection | Perimeter fencing, barrier facade elements, surroundings monitoring, detection equipment, access control | Site security concept, access control policy, badge and visitor logs, CCTV coverage maps |
| Respond and limit effects | Risk and crisis management procedures, defined alarm procedures | Crisis management manual, call trees, alarm runbooks |
| Recover | Business continuity measures such as emergency power, identifying alternative supply chains | Continuity plans, generator test logs, alternate supplier list |
| Personnel (no. 5) | Security management for staff, including external service provider staff | Screening policy, contractor onboarding and offboarding records |
| Awareness (no. 6) | Information material, training and exercises | Training records, exercise reports |
The measures go into a resilience plan that shows the reasoning behind them, refers back to the section 12 assessment, and is updated when needed and after every new risk analysis. Section 14 allows cross-sector and sector minimum requirements and industry resilience standards by ordinance, so plan on today's text and expect more detail later. See the Business Continuity and Disaster Recovery Guide for the continuity planning method.
Incident reporting under section 18
- What: incidents (Vorfälle) at a critical installation. Reporting duties under other laws, including the BSI Act, stay in place.
- To whom: the BBK, through the joint reporting point run by the BBK and the BSI.
- When: without delay and at the latest 24 hours after becoming aware; update it while the incident runs; a detailed report at the latest one month after becoming aware.
- Content: what you know that allows nature, cause and possible cross-border effects to be assessed, in particular the number and share of people affected, duration so far and expected, and the geographic area affected, including whether it is geographically isolated.
- What happens next: the BBK confirms receipt, may send response and resilience guidance, informs other member states where effects cross borders, and informs the European Commission where continuity is affected in at least six member states.
A physical sabotage that also takes systems offline can trigger both section 18 and BSIG section 32. Build one triage step that asks both questions. The EU Incident Reporting Clocks guide lines up the clocks.
Proof, oversight and management duties
- Proof first from the BSI: under section 16(1) the authority asks the BBK, which asks the BSI, for the parts of your BSIG section 39 proof that cover section 13 measures. Make sure your section 39 audit scope explicitly covers physical and environmental controls so it can be reused.
- Risk-based requests: if that is not enough, the authority can ask selected operators for more information and evidence, including the resilience plan, based on risk exposure, size, likelihood and severity of incidents, and societal impact (section 16(2)).
- Audits and inspections: operators must hand over audit results including deficiencies, allow access to premises during normal working hours, produce records and answer questions; the authority can bring in a qualified independent third party and order a remediation plan within a reasonable period (section 16(3) to (5)).
- Management (section 20): the management must implement the section 13 measures and ensure they are carried out through suitable organisation. Culpable breaches make managers liable to the entity under the company law rules for their legal form.
Enforcement and penalties
| Breach (section 24) | Maximum fine |
|---|---|
| Ignoring an enforceable BBK order to provide registration information (section 8(2)) | EUR 1,000,000 |
| Not submitting audit results correctly, completely or on time (section 16(3) and (5)) | EUR 500,000 |
| Ignoring enforceable orders on proof and remediation (section 16) | EUR 200,000 |
| Registration information not given correctly, completely or on time (section 8(1)) | EUR 100,000 |
| Refusing access, records or information during an inspection (section 16(4)) | EUR 100,000 |
The BBK enforces the registration offences; the competent authority designated under section 3 handles the rest.
Where identity fits
The KRITIS-DachG is about physical resilience, but several section 13 measures are identity controls in practice. Physical access control, contractor staff security and recovery all depend on who and what can reach a site or a control system.
- Badges and building systems as identities: access control systems, CCTV and building management platforms run on service accounts, controller credentials and API integrations. Inventory and rotate them as you would any other non-human identity. See the Critical Infrastructure Identity Security Guide.
- External service providers: section 13(3) no. 5 names staff of external providers. Tie their physical badges and remote access to one joiner, mover and leaver process with an expiry date.
- Emergency access: recovery plans often rely on break-glass accounts and shared site keys. Test them in exercises and log every use.
Framework mapping
| KRITIS-DachG duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Section 12 risk analysis, dependencies | ID.RA-03, GV.OC-04, GV.SC-07 | RA-3 |
| Section 13 physical protection | PR.AA-06 | PE-3, PE-6 |
| Section 13 response and recovery, resilience plan | ID.IM-04, RC.RP-01 | CP-2, CP-4 |
| Section 13 personnel and awareness | GV.RR-02 | PS-3, AT-2 |
| Section 18 incident reporting | RS.CO-02 | IR-6 |
Compliance steps
- Map facilities: list every site and asset that delivers a service in a section 4 sector, run the BSI-KritisV threshold calculation now and record the inputs.
- Prepare the registration record: collect the section 8(1) data, including public IP ranges and critical component types, and name a contact point reachable at all times.
- Register on time: diarise the three-month window from the trigger date and the nine and ten-month duty dates from your registration date.
- Run the section 12 analysis: start from the national risk analyses, add your upstream and downstream dependencies, and agree an owner for the four-yearly repeat.
- Write the resilience plan: map existing site security, continuity and crisis documents to the six section 13 headings, close gaps, and switch to the BBK template once published.
- Join up reporting: one runbook that tests every incident against section 18 and BSIG section 32 and reaches the joint reporting point within 24 hours.
- Align proof: extend BSIG section 39 audits to cover physical controls so they can satisfy section 16(1) requests.
- Brief the management: record their section 20 oversight in board minutes alongside BSIG section 38 training.
Common failure patterns
- Waiting for the ordinance: teams that do no work until the KRITIS-Verordnung appears find themselves with three months to register and ten months to a full resilience plan.
- Cyber team owns it alone: the duties are about fences, power and people as much as IT. Facility management, HR and procurement need named owners.
- Two separate incident processes: a site incident logged only with the facility team misses the 24-hour report.
- Dependency analysis stops at the gate: section 12 asks about other sectors and other countries; a list of local suppliers is not enough.
- Contractors forgotten: external service staff hold badges and remote access for years after contracts end.
Practitioner checklist
- Every candidate facility has a documented threshold calculation and a named owner.
- Registration data, including a 24/7 contact point, is ready and kept current within two weeks of changes.
- The nine and ten-month duty dates are in the compliance calendar for each facility.
- A section 12 risk analysis covers national risks and dependencies in both directions.
- A resilience plan maps measures to the four goals plus personnel and awareness.
- Incident triage checks both section 18 and BSIG section 32 and meets the 24-hour clock.
- BSIG section 39 audit scope includes physical and environmental controls.
- Service accounts on access control, CCTV and building management systems are inventoried and rotated.
- Management oversight of section 13 measures is minuted.
Standards and references
- Federal Ministry of Justice: KRITIS-Dachgesetz (KRITISDachG), consolidated text
- Federal Ministry of Justice: KRITISDachG section 8, registration and start dates
- Federal Ministry of Justice: KRITISDachG section 13, resilience duties and resilience plan
- Federal Ministry of Justice: KRITISDachG section 18, incident reporting
- Federal Ministry of Justice: KRITISDachG section 24, fines
- Federal Ministry of Justice: BSI-KritisV section 12, expiry
- Federal Ministry of Justice: BSIG section 39, proof for critical installations
- buzer.de: KRITISDachG, publication and in-force details (secondary)
- IHK Heilbronn-Franken: KRITIS-Dachgesetz tritt in Kraft (secondary)
Related NHI Mgmt Group resources: Germany NIS2 Implementation Guide · EU Critical Entities Resilience Directive Guide · Critical Infrastructure Regulation Map · BSI IT-Grundschutz Guide. This guide summarises the German KRITIS-Dachgesetz and is not legal advice.