KRITIS Protection Concepts Physical Digital

An integrated KRITIS protection concept combines physical security measures (perimeter protection, access control, video surveillance) with digital security measures (network segmentation, intrusion detection, encryption) into a holistic security architecture.The need arises from the convergence of physical and digital threats: cyberattacks can begin through physical access to systems, while physical sabotage can be orchestrated through digital manipulation. The KRITIS Umbrella Act has required operators to demonstrably secure both dimensions since 2026.Core components of an integrated protection concept:

The KRITIS Umbrella Act (effective since March 2026) transposes the EU CER Directive into German law and defines uniform standards for the physical resilience of critical infrastructures for the first time.Key requirements:

Physical and digital security address different threat vectors but are closely interlinked in critical infrastructures.Physical security includes:

All nine KRITIS sectors in Germany are subject to both IT security requirements under BSIG and physical resilience requirements under the KRITIS Umbrella Act.The nine sectors and their specific protection needs:

Creating an integrated KRITIS protection concept follows a structured five-phase approach:1. Inventory and protection needs assessment: Cataloging all physical and digital assets, classifying by criticality, identifying dependencies between physical and digital infrastructure2. Risk analysis: Assessing physical threats (natural hazards, sabotage, terrorism) and digital risks (cyberattacks, ransomware, insider threats). Identifying interactions between both dimensions3. Security architecture design: Defining security zones, selecting physical measures (perimeter, access, surveillance) and digital measures (segmentation, intrusion detection, encryption), integrating into a holistic concept4. Implementation: Deploying measures, training personnel, establishing monitoring and incident response processes5. Validation and operations: Penetration testing, red team exercises, regular audits, and continuous adaptation to new threats

Costs and timelines depend on the size of the infrastructure, the current maturity of security measures, and the KRITIS sector.Typical timelines:

4 to

8 weeks

6 to

12 weeks

3 to

12 months depending on scope

3 to

9 months

6 to

18 monthsKey cost drivers include structural measures (perimeter protection, access control systems), attack detection systems (mandatory SzA), and integration of existing legacy systems. ADVISORI provides vendor-independent advice and helps focus budgets on measures with the highest protection impact.

The KRITIS Umbrella Act extends previous IT-only obligations under BSIG with physical resilience requirements, creating an all-hazards approach.Key changes from the previous framework: