Key Takeaways<\/p>\n
- \n
- New framework for the physical side.<\/strong> The KRITIS umbrella law implements the EU CER directive and regulates the resilience of critical infrastructures at a federal level for the first time. It complements the IT obligations from NIS2 without replacing them.<\/li>\n
- The supplier is within the scope.<\/strong> Suppliers and service technicians with physical or digital access are subject to the same integrity and reliability requirements as their own employees.<\/li>\n
- The deadline starts in July.<\/strong> From July 17, 2026, operators will register on the joint platform of the BBK (Federal Office of Civil Protection and Disaster Assistance) and the BSI (Federal Office for Information Security), at the latest three months after being classified as a critical infrastructure.<\/li>\n
- Control instead of snapshot.<\/strong> A one-time supplier audit does not close the vector. Access, access rights, contracts, and restarts must continuously include the supply chain.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/strong> The Cyber Resilience Act also affects your inventory<\/a> · Five key figures that the supervisory board really understands<\/a><\/p>\n
What the Critical Infrastructure Protection Act Changes in the Supply Chain<\/h2>\n
The KRITIS Protection Act has been in effect since March 17, 2026. The cabinet had decided on it on January 29, and the Federal Council agreed. Legally, it implements the EU Directive 2022\/2557 on the resilience of critical infrastructure, also known as the CER Directive. This creates a nationwide, cross-sectoral framework for the physical protection and resilience of critical facilities for the first time.<\/p>\n
Important for classification: The law is the physical complement to the IT side, which is covered by NIS2 and the BSIG (Federal Office for Information Security). Around 1,300 operators fall under the scope of the CER logic and must in the future fulfill reporting obligations, provide business continuity management, demonstrate physical security and personnel reliability, and operate a robust crisis management system. The supply chain is included in each of these areas, not as an appendix, but as part of the facility.<\/p>\n
The CER Directive consciously thinks of resilience in a broad sense. It does not only mean cyberattacks, but also failures in general: through sabotage, through a natural event, through the loss of a supplier, or through a combination of these. At this point, the physical world meets the digital world. A manipulated remote maintenance access is a cyber incident with physical effects, and a cut cable is a physical incident with digital effects. The operator must know both chains, as both ultimately lead to a supplier.<\/p>\n
\n\nJuly 17<\/div>\nStart of registration on the platform of BBK (Federal Office of Civil Protection and Disaster Assistance) and BSI (Federal Office for Information Security) (2026)<\/p>\n<\/div>\n
\n1,300<\/div>\nOperators within the scope of the CER implementation<\/p>\n<\/div>\n
\n3 months<\/div>\nDeadline for registration after being classified as a critical facility<\/p>\n<\/div>\n<\/div>\n
The Supplier Suddenly Falls Under the Scope<\/h2>\n
The sentence that separates procurement from security is eliminated with the umbrella legislation. Suppliers and service technicians with physical or digital access to a critical facility are subject to the same integrity and reliability requirements as internal employees. The remote maintenance access of a manufacturer, the technician in the control room, the cloud service behind the process control system: all three are, from the facility’s perspective, insider-near, not external.<\/p>\n
For operators, this shifts a responsibility. Previously, the service provider was a procurement issue with a framework contract. Now, it is a security issue with access control, access rights, background checks, and a clear understanding of who was in which system at what time. Anyone who delegates this responsibility to the supplier and leaves it there has not fulfilled it.<\/p>\n
\nDefinition · Critical Facility<\/p>\n
A facility whose failure would significantly disrupt the supply of essential services to the population, such as energy, water, healthcare, or transportation. The umbrella legislation makes its resilience an operator’s obligation and draws its suppliers into the same obligation.<\/p>\n<\/div>\n
Why an Audit List Doesn’t Close the Vector<\/h2>\n
A supplier can be thoroughly vetted, approved, and checked off, yet still leave the system vulnerable. The remote maintenance channel remains in place, the technician’s laptop moves from customer to customer, and the subcontractor may not even be mentioned in the contract. A snapshot in the procurement process fails to capture any of these states, creating a false sense of security and merely checking a box in the table.<\/p>\n
True resilience is only achieved when access is continuously managed. This includes implementing least privilege for external parties, time-limited access, logged remote maintenance, and an incident reporting chain that kicks in even when the incident originates with the service provider. This is not a one-time project, but an ongoing operational mode.<\/p>\n
The channel doesn’t end with the direct supplier, either. Their own cloud provider, remote maintenance platform, and subcontractors extend the chain with links that often aren’t even included in the contract. Those who only scrutinize the contractual partner see the risk ending one level too soon. For critical systems, it’s precisely this hidden depth of the supply chain where reliability on paper and actual operational reliability diverge.<\/p>\n
Responsibility Remains at the Top<\/h2>\n
The umbrella legislation addresses operators, not their service providers. This direction is intentional. The responsibility for the resilience of a critical facility lies with its management and cannot be transferred by contract. An operator can purchase services, but they cannot buy liability for their security with it.<\/p>\n
For management, this means a duty to provide evidence. They must be able to demonstrate that supplier risks have been identified, assessed, and controlled. A register that documents this review makes all the difference in a serious case between proven due diligence and an open accusation. The regulatory authority will not ask whether a service provider has failed, but rather whether the operator had them under control.<\/p>\n
What Operators Must Regulate in the Supply Chain Now<\/h2>\n
The first step is straightforward: creating an honest map of who has physical or digital access to the facility from the outside. This yields five levers that the law demands.<\/p>\n
- \n
- Map Access.<\/strong> Every external individual with access or system access belongs in a current directory, including sub-contractors.<\/li>\n
- Pass on Obligations by Contract.<\/strong> Reliability, reporting channels, and auditing rights belong in the contract, not in a letter of intent.<\/li>\n
- Control Access and Authorization.<\/strong> Temporary rights, background checks for security-relevant roles, and logged remote maintenance.<\/li>\n
- Include Restart Procedures.<\/strong> Emergency and Business Continuity Management (BCM) plans must account for the failure of a supplier, not just one’s own.<\/li>\n
- Close Reporting Chains.<\/strong> The 72-hour deadline to the BSI (Federal Office for Information Security) also applies if an incident occurs via a service provider.<\/li>\n<\/ul>\n
The deadline is not a mere formality.<\/p>\n
\n\n17. M\u00e4rz 2026<\/div>\nKRITIS umbrella law comes into effect<\/div>\n<\/div>\n\n17. Juli 2026<\/div>\nRegistration on the BBK and BSI platform begins<\/div>\n<\/div>\n\n+3 Monate<\/div>\nRegistration requirement after being classified as a critical facility<\/div>\n<\/div>\n<\/div>\nThe three months may seem like a buffer. In practice, the time passes with what was previously lacking: a complete picture of one’s own suppliers. Those who do not have this map today should create it before the deadline, not afterwards.<\/p>\n
Frequently Asked Questions<\/h2>\n
Every question is locked. A tap unlocks the answer.<\/p>\n
\nWhat does the KRITIS umbrella law regulate?<\/strong><\/summary>\n
It implements the EU CER (Critical Entities Resilience) Directive and creates a nationwide framework for the physical resilience of critical infrastructure: reporting requirements, Business Continuity Management, physical security, personnel reliability, and crisis management. The IT obligations under NIS2 (Network and Information Security 2) remain unaffected by this.<\/p>\n<\/details>\n
\nWhen are operators required to register?<\/strong><\/summary>\n
Registration on the joint platform of BBK (Federal Office of Civil Protection and Disaster Assistance) and BSI (Federal Office for Information Security) will be possible starting July 17, 2026. It will become mandatory at the latest three months after being classified as a critical infrastructure.<\/p>\n<\/details>\n
\nDo suppliers really fall under the same requirements?<\/strong><\/summary>\n
Suppliers and service technicians with physical or digital access to the facility are subject to the same integrity and reliability requirements as internal employees. The operator remains responsible, even if they have outsourced the service.<\/p>\n<\/details>\n
\nHow does the DACH-specific “Dachgesetz” (Roof Act) relate to NIS2, the European Union’s Network and Information Security Directive?<\/strong><\/summary>\n
NIS2 and the BSI Act (Federal Office for Information Security Act) cover IT security, while the Umbrella Act (Dachgesetz) addresses the physical aspect and organizational resilience. For many operators, both regimes apply in parallel. They should be considered as one governance system, rather than two separate projects.<\/p>\n<\/details>\n
\nWhat is the first concrete step?<\/strong><\/summary>\n
A comprehensive directory of all external personnel with access to the facility, including sub-contractors. Without this register, it is not possible to properly manage contracts, control access, or regulate authorization.<\/p>\n<\/details>\n
<\/p>\n
Editor’s Picks<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/tprm-lieferkettenrisiko-nis2-dora-programm-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>Supply Chain Risk Is a Program, Not an Audit Checklist<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/geschaeftsfuehrung-nis2-dokumentationspflicht-bsig-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>What Management Must Document Under NIS2<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/ciso-mandat-entscheidungsrechte-eskalation-cover-hero-250x143.jpg\")
<\/span>Editor’s Pick<\/span>Which CISO Decision Rights Must Be Set Out in Writing<\/span><\/span><\/a><\/p>\nMore from the MBF Media Network<\/h3>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-geopolitik-datacenter-roadmap-lieferkett-8054517-250x143.jpg\")
<\/span>Digital Chiefs<\/span>Geopolitics Meets the Data Center Roadmap: What CIOs Must Secure Now<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-eu-ai-act-2026-kennzeichnungspflichten-m-35346140-250x143.jpg\")
<\/span>MyBusinessFuture<\/span>EU AI Act from August 2026: What labelling obligations really affect SMEs<\/span><\/span><\/a>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-xfs4iot-cloud-geldautomat-plattform-syna-61345494.jpg\")
<\/span>cloudmagazin<\/span>XFS4IoT Meets the Cloud: The ATM Becomes a Platform<\/span><\/span><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"The KRITIS roof law makes supplier reliability a mandatory duty for operators. Governance roadmap to registration.","protected":false},"author":50,"featured_media":22055,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"KRITIS supply chain","_yoast_wpseo_title":"Weakest Supplier Opens Critical Facility","_yoast_wpseo_metadesc":"The KRITIS roof law holds suppliers with access to critical facilities accountable. What operators must regulate by July 2026 for registration.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-22074","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":9,"wpml_language":"en","wpml_translation_of":22054,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22074","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=22074"}],"version-history":[{"count":1,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22074\/revisions"}],"predecessor-version":[{"id":22077,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/22074\/revisions\/22077"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/22055"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=22074"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=22074"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=22074"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} - Pass on Obligations by Contract.<\/strong> Reliability, reporting channels, and auditing rights belong in the contract, not in a letter of intent.<\/li>\n
- The supplier is within the scope.<\/strong> Suppliers and service technicians with physical or digital access are subject to the same integrity and reliability requirements as their own employees.<\/li>\n