KRITIS Reporting Obligations Authority Communication

KRITIS operators must report significant IT security incidents to the BSI using a three-stage process. The early warning must be submitted within

24 hours of detection — the deadline starts when the incident is recognized, not when analysis is complete. A detailed follow-up report is due after

72 hours. A final report must be submitted within one month, or a progress report if the incident is still ongoing. For the early warning, speed takes priority over completeness — missing details can be supplemented in follow-up reports.

An IT security incident is reportable when it significantly impairs or could impair the availability, integrity, authenticity, or confidentiality of IT systems. EU Implementing Regulation 2024/2690 defines specific thresholds: financial losses exceeding EUR 500,000, disclosure of trade secrets, or threats to health. Even disruptions that have not yet caused an actual outage but have the potential to do so must be reported. When in doubt, the BSI recommends a precautionary report.

Reports are submitted through the BSI Reporting and Information Portal (MIP) at portal.bsi.bund.de. KRITIS operators use online forms for initial, follow-up, and final reports. The forms are available even before NIS 2 registration is complete. Alternatively, reports can be submitted via S/MIME or PGP-encrypted email or by phone through the BSI 24/7 contact point. Each report must include details about the affected facility, the critical service, and the impact.

The KRITIS reporting obligation under BSIG applies to operators of critical infrastructures above defined thresholds. The NIS 2 reporting obligation under the NIS 2 Implementation Act expands the scope to essential and important entities — approximately 30,

000 companies in Germany. Both use the BSI reporting portal and follow the 24h/72h/1-month scheme. NIS 2 introduces stricter penalties (up to EUR

10 million), a mandatory registration by March 2026, and expanded supply chain security requirements.

Violations of KRITIS reporting obligations can result in fines up to EUR 50,

000 under IT-SiG. Under NIS2, penalties increase significantly to up to EUR

10 million or

2 percent of global annual turnover. Beyond direct fines, organizations face intensified BSI audits, additional compliance requirements, and increased reporting obligations. Indirectly, violations affect cyber insurance premiums, customer trust, and ESG ratings. Structured preparation with automated reporting procedures significantly reduces these risks.