KRITIS Protection Concepts Physical Digital

An integrated KRITIS protection concept combines physical security measures (perimeter protection, access control, video surveillance) with digital security measures (network segmentation, intrusion detection, encryption) into a holistic security architecture.

The need arises from the convergence of physical and digital threats: cyberattacks can begin through physical access to systems, while physical sabotage can be orchestrated through digital manipulation. The KRITIS Umbrella Act has required operators to demonstrably secure both dimensions since 2026.

Core components of an integrated protection concept:

The KRITIS Umbrella Act (effective since March 2026) transposes the EU CER Directive into German law and defines uniform standards for the physical resilience of critical infrastructures for the first time.

Key requirements:

The act closely links physical security with existing IT security obligations under BSIG and NIS2 implementation.

Physical and digital security address different threat vectors but are closely interlinked in critical infrastructures.

Physical security includes:

Digital security includes:

The challenge lies in integration: access control systems are themselves IT systems, SCADA systems control physical processes, and an effective SOC must correlate physical and digital alerts.

All nine KRITIS sectors in Germany are subject to both IT security requirements under BSIG and physical resilience requirements under the KRITIS Umbrella Act.

The nine sectors and their specific protection needs:

Specific thresholds are defined by the BSI KRITIS Ordinance per sector.

Creating an integrated KRITIS protection concept follows a structured five-phase approach:

1. Inventory and protection needs assessment: Cataloging all physical and digital assets, classifying by criticality, identifying dependencies between physical and digital infrastructure

2. Risk analysis: Assessing physical threats (natural hazards, sabotage, terrorism) and digital risks (cyberattacks, ransomware, insider threats). Identifying interactions between both dimensions

3. Security architecture design: Defining security zones, selecting physical measures (perimeter, access, surveillance) and digital measures (segmentation, intrusion detection, encryption), integrating into a holistic concept

4. Implementation: Deploying measures, training personnel, establishing monitoring and incident response processes

5. Validation and operations: Penetration testing, red team exercises, regular audits, and continuous adaptation to new threats

Costs and timelines depend on the size of the infrastructure, the current maturity of security measures, and the KRITIS sector.

Typical timelines:

Key cost drivers include structural measures (perimeter protection, access control systems), attack detection systems (mandatory SzA), and integration of existing legacy systems. ADVISORI provides vendor-independent advice and helps focus budgets on measures with the highest protection impact.

The KRITIS Umbrella Act extends previous IT-only obligations under BSIG with physical resilience requirements, creating an all-hazards approach.

Key changes from the previous framework:

Operators already running an ISMS under ISO 27001 or BSI IT-Grundschutz must extend it to cover physical security aspects. Integrating both dimensions into a unified management system is the most efficient path to compliance.