08.10.2026 | 8 min read
The question “Does KRITIS apply to us?” is often asked too early and in overly general terms. What matters is not only whether a company operates in a particular sector. The decisive factor is whether specific facilities or services are so relevant to supplying the general public that their failure would have serious consequences for safety, supply or social stability.
This is where a common misunderstanding lies: KRITIS is not a simple list of industries. Rather, the term describes a functional and regulatory model that brings together different perspectives on critical infrastructure – from cybersecurity and physical resilience to civil protection.
For companies, this distinction has practical consequences. Whether a company is considered an operator of critical infrastructure – a KRITIS operator for short – under German regulation does not depend solely on its industry, size or profile. What counts is the specific facility, the critical service it provides, statutory thresholds and the regulations that apply in each case.
KRITIS is the German abbreviation for Kritische Infrastrukturen, or critical infrastructures. The term refers to organizations, institutions, facilities and systems whose failure or impairment could lead to significant supply shortages, threats to public safety or comparable consequences.
The Federal Office of Civil Protection and Disaster Assistance (BBK) describes critical infrastructures as an essential foundation for the functioning of the state and society. They include energy supply, water, healthcare, transport, information technology and telecommunications as well as other indispensable services.
The key is a functional perspective: what is critical is not an industry as such, but the service provided to supply the population or other critical systems. A company can therefore operate in a KRITIS-related sector without being classified as an operator of critical infrastructure under the regulations.
The regulatory classification of critical infrastructures has changed significantly in recent years. The reason is not a new definition of critical infrastructure, but the interplay of several legal frameworks with different objectives.
In practice, the following terms in particular are often confused:
Although all of these regulations concern the protection of critical services, they answer different questions.
The BSI-KritisV specifies in particular which facilities qualify as critical facilities based on defined thresholds and therefore fall within the scope of the BSI Act. Together, the BSI-KritisV and the BSIG primarily govern cybersecurity requirements for critical facilities.
The NIS2 regulation, by contrast, significantly expands the group of regulated entities. It affects numerous organizations that are not classic KRITIS operators but are nevertheless subject to extensive requirements for information security and risk management.
The KRITIS Umbrella Act takes yet another approach. It transposes the European CER Directive (Critical Entities Resilience Directive) into German law and strengthens the physical resilience of critical facilities and services. Its focus is on resilience, preparedness and protection against physical disruption.
These different perspectives are a frequent source of misunderstanding. Not every entity affected by NIS2 is also an operator of critical infrastructure. Nor is every critical facility assessed according to the same criteria.
The three regulatory areas pursue different objectives.
The BSI Act (BSIG) and the BSI-KritisV define in particular which operators of critical facilities must meet special information security requirements. These include technical and organizational security measures, reporting obligations and obligations to provide evidence of compliance to the Federal Office for Information Security (BSI).
NIS2 considerably expands the group of regulated entities. According to the BSI, the regulation affects around 29,500 essential and important entities. This group is significantly larger than that of classic KRITIS operators.
The KRITIS Umbrella Act adds the dimension of physical resilience to these requirements. The Act was signed into law on March 11, 2026, and in principle entered into force on March 17, 2026. However, individual provisions – in particular Section 14 (3) to (5) – will not take effect until January 1, 2030.
There is therefore no single “KRITIS law”. What matters for companies is which regulation applies to their specific facility or entity and which requirements follow from it.
There is no universally applicable list of sectors for critical infrastructures. Which classification is relevant depends on the regulation in question and its objectives.
The BSI-KritisV specifies critical facilities and the thresholds that apply to them within the framework of IT security law. The KRITIS Umbrella Act uses its own statutory system of critical services, while the BBK uses a classification agreed between the federal and state governments for civil protection.
The KRITIS Umbrella Act distinguishes between various sectors of critical services, which are often referred to as KRITIS sectors. They include:
However, belonging to one of these sectors does not automatically mean that a company is considered a KRITIS operator under the regulations. What remains decisive is whether a specific facility or service meets the statutory criteria of the applicable regulation.
For companies, it is therefore less important to know individual sector lists by heart. The first step is to determine which regulation applies to their own facility or service. Only then does it become clear which requirements are relevant and whether, and to what extent, regulatory obligations apply.
Not every company within a KRITIS sector is automatically a KRITIS operator. As a rule, what matters is the specific facility and its significance for a critical service.
A company can operate several sites without all of them being relevant from a regulatory perspective. Conversely, a single facility can be classified as critical because of its supply function.
In its KRITIS statistics, the BSI reports a total of 1,231 registered operators with 2,180 facilities as of June 30, 2026. These figures illustrate why sweeping statements such as “around 1,700 companies” are misleading: operators, companies and facilities are different categories.
The frequently cited threshold of 500,000 people served should not be understood as a universal rule either. In certain areas it serves as a guideline, but it does not replace a sector-specific assessment. Whether a facility is considered critical depends on the critical service in question, the statutory thresholds and the applicable regulation.
The obligations companies must meet depend on the relevant legal framework.
In the context of the BSIG, BSI-KritisV and NIS2, the following topics are central:
The KRITIS Umbrella Act, by contrast, focuses on physical resilience. Typical requirements include:
Which measures are appropriate depends on the risk analysis for the respective site. Depending on the protection requirements, these may include perimeter security, video surveillance, electronic access control and a connection to a security operations center.
For companies, this means that KRITIS compliance does not consist of a uniform catalog of measures. It results from the correct regulatory classification of their own facilities and the resulting requirements for information security, physical security and organizational resilience.
Regulatory requirements are only one part of the picture.
Critical infrastructures form the foundation of modern societies. Energy supply, telecommunications, healthcare, water, transport and digital services are closely interconnected. If one area fails, disruptions can spread to numerous other sectors.
It is therefore not enough to view critical infrastructure solely as a collection of legal obligations. What matters is the ability to keep critical services running even in exceptional circumstances, or to restore them as quickly as possible.
For operators, this means taking a risk-based approach:
Only this holistic view connects regulatory compliance with effective protection of critical infrastructures.
This is exactly where our Resilience Health Check comes in: it assesses the state of a site’s physical and organizational security in a structured way, independent of any specific technology. It creates a solid starting point for a subsequent full risk and threat analysis. Our article on the Resilience Health Check describes how such an assessment works; our article on physical security consulting explains how a security concept is developed from it.
e-shelter security supports operators of critical facilities with physical security – not with legal classification, but with the question of how sites can be protected effectively and remain operational in the event of an incident. This includes the planning and implementation of security technology, systems integration and installation, through to ongoing operation via a 24/7 security operations center.
Our article on data center security shows how perimeter protection, access control and monitoring can work together at a particularly sensitive site.
Today, KRITIS is less an industry label than a functional and regulatory model for assessing critical services and facilities.
The key takeaway is this: not every company in a KRITIS sector is automatically a KRITIS operator. What matters are the specific facility, the critical service provided, statutory thresholds and the applicable regulation.
For companies, this means looking at KRITIS not only in terms of industries or sectors, but in terms of their actual supply function and regulatory exposure. Only on this basis can they determine whether requirements under the BSIG, the BSI-KritisV, NIS2, the KRITIS Umbrella Act or other sector-specific regulations are relevant.
Treating critical infrastructure purely as a compliance issue therefore falls short. Ultimately, the aim of all these regulations is to strengthen the resilience of critical services and to keep society supplied even in exceptional circumstances.
Would you like to know whether the physical security of your sites meets the requirements of the KRITIS Umbrella Act? The Resilience Health Check from e-shelter security is the fastest way to get started: a systematic assessment of the resilience of your facilities with prioritized recommendations for action. Discover our solutions or talk directly to our experts. We support you from the initial assessment through to a complete security concept.
You need to load content from reCAPTCHA to submit the form. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Turnstile. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Facebook. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from Instagram. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More InformationYou are currently viewing a placeholder content from X. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information
