Key Takeaways<\/p>\n
- \n
- Physical protection becomes mandatory.<\/strong> The KRITIS Umbrella Act transposes the EU CER Directive and establishes nationwide minimum standards for the physical resilience of critical facilities for the first time.<\/li>\n
- Two pillars, one risk.<\/strong> Alongside the cyber regime under BSIG and NIS2, a physical pillar now stands in parallel. Germany is building both layers of protection simultaneously.<\/li>\n
- Responsibilities remain blurred.<\/strong> The BBK, BSI and Interior Ministry share oversight, and according to the Bundestag the boundaries between them have yet to be drawn clearly.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>KRITIS Umbrella Act in Force: What Operators Must Implement Now<\/a> \/<\/span> Ransomware Resilience: Why German Companies Are Paying Less Often<\/a><\/p>\n
What the KRITIS Umbrella Act changes<\/h2>\n
Until 2026, the protection of critical infrastructure in Germany was fragmented. Cybersecurity was governed by the BSI Act; physical protection depended on a patchwork of sector-specific rules and state-level requirements. The KRITIS Umbrella Act consolidates this physical layer under a single national framework for the first time.<\/p>\n
What is the KRITIS Umbrella Act?<\/strong> The KRITIS Umbrella Act is Germany’s transposition of EU Directive 2022\/2557 on the resilience of critical entities, known as the CER Directive. It obliges operators of critical facilities to strengthen their physical resilience against every type of hazard – natural disasters, technical failure, sabotage and terrorism alike. Reporting obligations and state supervision come with it.<\/p>\n
The scope is defined by a threshold of 500,000 people supplied per facility. This brings an estimated 1,300 operators within the law’s reach. The all-hazards approach is the real break from the past: operators can no longer tick off individual scenarios but must instead prepare their facilities against the entire spectrum of conceivable disruptions.<\/p>\n
\napprox. 1,300<\/div>\noperators of critical facilities fall under the KRITIS Umbrella Act and must demonstrate their physical resilience.<\/div>\nSource: Bundestag \/ KRITIS Umbrella Act<\/div>\n<\/div>\nPhysical Resilience Becomes a Cyber Discipline<\/h2>\n
The most striking effect of the law is not the new obligation itself, but its proximity to cybersecurity. Anyone operating a substation or a waterworks now faces two parallel regimes: the KRITIS Umbrella Act for physical protection and the BSIG with NIS2 for the digital side. Both demand risk analyses, reporting channels, and documentation. In practice, they are nearly impossible to separate.<\/p>\n
An attack on the power grid rarely starts with bolt cutters and ends in the data centre – or the other way around. Sabotage of hardware and intrusion into control software are simply two routes to the same destination. That is precisely why the division between physical and digital resilience is artificial. The KRITIS Umbrella Act forces operators to consolidate both dimensions into a single operational picture, and that changes who inside an organisation is actually responsible for security.<\/p>\n
With the KRITIS Umbrella Act and the cyber regime built around the BSIG and NIS2, Germany is implementing both pillars in parallel, each with its own legislation. The compliance burden is real, but it closes a gap that attackers have been deliberately exploiting.<\/p>\n
Where Responsibilities Remain Blurred<\/h2>\n
As sensible as dual-layer protection is, its governance is far from clear. Under the KRITIS Umbrella Act, the Federal Office for Civil Protection and Disaster Assistance (BBK) becomes the supervisory authority for the physical pillar, while the BSI handles the cyber side and the Federal Ministry of the Interior provides overarching direction. The Bundestag itself has noted that the division of responsibilities between these bodies is not cleanly drawn.<\/p>\n
For operators, this is more than an administrative footnote. Anyone reporting an incident that touches both levels needs to know who to contact. Duplicate notifications, conflicting requirements, or gaps between authorities are a genuine risk as long as the interfaces between them remain undefined. The coming months of supervisory practice will show whether the roof actually holds.<\/p>\n
What Operators Should Do Now<\/h2>\n
Regardless of the open questions around jurisdiction, there is every reason to start. Three steps make sense before regulators come knocking for the first time.<\/p>\n
First, build a unified operational picture: consolidate physical and cyber risks into a single analysis rather than maintaining them in separate departments. Second, clarify the reporting chain: define which type of incident goes to which authority and rehearse the process before it actually matters. Third, consolidate responsibility: as physical and digital security converge, a single function needs oversight of both sides – not two siloed teams pointing at each other when something goes wrong.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nWhen did the KRITIS Umbrella Act take effect?<\/strong><\/summary>\n
The law entered into force on 16 March 2026. The Bundestag passed it on 29 January 2026, and the Bundesrat approved it on 6 March 2026. It transposes the EU’s CER Directive into national law.<\/p>\n<\/details>\n
\nWho falls under the KRITIS Umbrella Act?<\/strong><\/summary>\n
The law covers operators of critical facilities that supply at least 500,000 residents per installation. Estimates put the number of affected operators at around 1,300 – all of whom must demonstrate physical resilience.<\/p>\n<\/details>\n
\nWhat distinguishes the Umbrella Act from NIS2?<\/strong><\/summary>\n
The KRITIS Umbrella Act governs the physical protection of critical facilities; NIS2 and the BSIG govern cybersecurity. Both apply simultaneously, both require risk analyses and reporting obligations, and both hit many of the same operators at the same time.<\/p>\n<\/details>\n
\nWhich authority is responsible for supervision?<\/strong><\/summary>\n
The BBK becomes the supervisory authority for the physical pillar; the BSI handles the cyber side. According to the Bundestag, the precise delineation between the bodies involved is still considered insufficiently defined.<\/p>\n<\/details>\n
\nWhat should operators tackle first?<\/strong><\/summary>\n
Build a unified operational picture combining physical and cyber risks, clarify and rehearse the reporting chain for each incident type, and consolidate responsibility for both security layers under a single function rather than maintaining them in separate silos.<\/p>\n<\/details>\n
Editor’s Reading Tips<\/h3>\n
- \n
- Zero Trust at Energy Utilities: What NIS2 Audits Are Revealing Now<\/a><\/li>\n
- Zones and Conduits Become Mandatory in OT Environments<\/a><\/li>\n
- Ransomware Resilience: Why German Companies Are Paying Less Often<\/a><\/li>\n<\/ul>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/adaptive-mfa-nis2-bsi-zero-trust-mittelstand-fido2-2026-hero-250x167.jpg\")
<\/span>Editor’s Pick<\/span>Zero Trust at the energy supplier: What the NIS2 audits are now revealing<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/04\/st-20-04-ot-security-iec-62443-cra-2026-250x167.jpg\")
<\/span>Editor’s Pick<\/span>OT Security: Why IEC 62443 & EU Cyber Act Must Be Read Together<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/03\/ransomware-resilienz-reboot-germany-250x166.jpg\")
<\/span>Editor’s Pick<\/span>Ransomware Resilience: Why German Companies Pay Less Frequently<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-bsi-kritis-cloud-2026-nis2-dachgesetz-c5-90008061.jpg\")
<\/span>cloudmagazin<\/span>BSI KRITIS and the Cloud 2026: NIS2, the Umbrella Law and C<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-wie-synaforce-krankenhaeuser-transformie-89285657-250x156.jpg\")
<\/span>MyBusinessFuture<\/span>Hospital Digitalization: Synaforce Connects Care<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-industrie-5-0-als-fuehrungsentscheidung-61355365-250x143.jpg\")
<\/span>Digital Chiefs<\/span>Industry 5.0 as a Leadership Decision: Key Takeaways for CIOs from Hannover Messe 2026<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"KRITIS protection becomes physical: The umbrella law obliges around 1,300 operators to be resilient against all hazards.","protected":false},"author":50,"featured_media":17790,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Critical Infrastructure Act","_yoast_wpseo_title":"KRITIS Umbrella Law: When Physical Resilience Becomes a Cyber Discipline","_yoast_wpseo_metadesc":"Protect KRITIS physically: New law mandates 1,300 operators to enhance resilience against all threats. Why cybersecurity and fences unite.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[3,2,259],"tags":[],"class_list":["post-17898","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-aktuelles","category-innovation","category-strategie-governance-en"],"evm_reading_time_minutes":7,"wpml_language":"en","wpml_translation_of":17789,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/17898","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=17898"}],"version-history":[{"count":3,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/17898\/revisions"}],"predecessor-version":[{"id":21705,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/17898\/revisions\/21705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/17790"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=17898"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=17898"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=17898"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - Zones and Conduits Become Mandatory in OT Environments<\/a><\/li>\n
- Two pillars, one risk.<\/strong> Alongside the cyber regime under BSIG and NIS2, a physical pillar now stands in parallel. Germany is building both layers of protection simultaneously.<\/li>\n