KRITIS Continuous Monitoring Incident Management

Under Section 8a(1a) BSIG, the BSI requires KRITIS operators to deploy attack detection systems. The OH SzA guidance defines three areas: logging (continuous capture of security-relevant events), detection (identification of attack patterns through SIEM and IDS) and response (structured incident handling with defined escalation paths). Implementation maturity is assessed on a scale from 0 to 5, with level 3 as the minimum requirement.

KRITIS operators must report significant IT security incidents to the BSI without delay. Since NIS2 transposition, staggered deadlines apply: initial notification within 24 hours, detailed follow-up report within 72 hours and final report within one month. Incidents that affect the availability, integrity or confidentiality of critical services are reportable.

SIEM (Security Information and Event Management) collects and correlates log data from various sources for threat detection. A SOC (Security Operations Center) is the organisational unit with analysts who evaluate SIEM alerts and respond to incidents. MDR (Managed Detection and Response) is an outsourced service where an external provider handles monitoring, analysis and response — particularly suitable for KRITIS operators without their own SOC.

NIS2 significantly expands requirements for KRITIS operators: more sectors fall under regulation, reporting obligations are tightened and managing directors are personally liable for implementation. The NIS2 Implementation Act (NIS2UmsuCG) integrates existing BSIG requirements and additionally demands risk management, supply chain security and regular reviews of security measures.

A structured incident response process follows five phases: detection (automatic alerting through SIEM/IDS), analysis (assessment of severity and scope), containment (isolation of affected systems), eradication (removal of the threat and recovery) and post-incident review (forensics, BSI reporting, lessons learned). Each phase has defined roles, escalation paths and documentation requirements.

Costs depend on company size, IT landscape and the chosen model. An in-house SOC with SIEM requires significant investment in personnel and technology. Managed SOC or MDR solutions offer KRITIS operators a cost-effective alternative with monthly operating costs instead of high upfront investments. ADVISORI analyses your current situation and recommends the most economically viable model.

Integration requires careful planning as OT systems (Operational Technology) have special requirements for availability and real-time capability. Passive network monitoring sensors capture OT traffic without operational disruption. IT and OT data are consolidated in a central SIEM platform, using specialised parsers for industrial protocols (OPC UA, Modbus, IEC 104).