KRITIS Ongoing Compliance: Continuous Obligations for Critical Infrastructure Operators

KRITIS operators must demonstrate to the BSI every two years that they have implemented appropriate organizational and technical measures to prevent disruptions. Evidence is provided through security audits, assessments or certifications — such as ISO 27001 or BSI IT-Grundschutz. ADVISORI supports the preparation, execution and follow-up of these compliance audits.

Significant disruptions to IT systems must be reported to the BSI immediately, no later than within 24 hours. A detailed report is required within 72 hours. With NIS2 and the KRITIS Umbrella Act, additional reporting obligations to the BBK for physical security incidents apply. We help you establish clear reporting processes and meet all deadlines.

NIS2 significantly expands the scope of affected organizations and tightens requirements: executives are personally liable for cybersecurity oversight, reporting obligations become stricter, and higher fines apply (up to EUR 10 million or 2% of global annual turnover). The KRITIS Umbrella Act adds physical security requirements and mandates registration with the BBK by July 2026.

Initial implementation establishes the ISMS, technical safeguards and processes. Ongoing compliance covers continuous monitoring, regular risk assessments, adaptation to new threats and regulatory changes, staff training, and the recurring §8a audit every two years. Without systematic ongoing compliance management, gaps emerge that will surface during the next audit.

Violations of KRITIS requirements can result in fines of up to EUR 2 million under the KRITIS Umbrella Act. Under NIS2, penalties increase to up to EUR 10 million or 2% of global annual turnover for essential entities. Additionally, there are reputational risks and — under NIS2 — personal liability for executives.

An Information Security Management System (ISMS) based on ISO 27001 or BSI IT-Grundschutz forms the backbone of ongoing KRITIS compliance. It structures risk assessments, documents measures, manages incident response and provides the framework for the §8a compliance audit. Continuous maintenance and development of the ISMS is essential to keep pace with new threats and requirements.

ADVISORI offers a comprehensive ongoing compliance package: continuous compliance monitoring, regular gap analyses and risk assessments, preparation and support for §8a audits, assistance with reporting obligations, employee training, and adaptation of your ISMS to new requirements such as NIS2 and the KRITIS Umbrella Act.

The NIS2 Implementation Act (NIS2UmsuCG), effective since December 2025, requires KRITIS operators to conduct regular cybersecurity training for all employees. Management must personally participate in risk management and IT security training — this obligation cannot be delegated. Additionally, Section 8a of the BSI Act requires proof of adequate organizational measures, which explicitly includes training programs. Violations can result in fines of up to 10 million euros or 2 percent of annual turnover.

A BSI-compliant KRITIS training covers: recognition of phishing and social engineering, secure handling of credentials and access rights, incident reporting procedures, sector-specific threat scenarios for your KRITIS sector, physical security in critical areas, and NIS2 compliance fundamentals. Content is tailored to specific roles — executives receive different focus areas than operational staff or IT specialists.

KRITIS operators must demonstrate adequate security measures to the BSI every two years. In practice, this means: annual mandatory training for all employees at minimum, quarterly phishing simulations for effectiveness monitoring, and ad-hoc training for new threat situations or after security incidents. Continuous awareness campaigns with monthly micro-content complement the formal training sessions.

KRITIS training is a structured program with defined learning objectives, attendance verification, and knowledge testing — it fulfills regulatory requirements of the BSI Act and NIS2 Directive. An awareness campaign is a complementary measure that maintains security consciousness in daily work: through posters, short videos, simulated phishing emails, or interactive quiz formats. Both elements work together and are jointly required for KRITIS operators.

Effectiveness is measured through multiple KPIs: phishing simulation rates (click rates before and after training), knowledge test results, number of security incidents reported by employees, average incident response time, and BSI audit outcomes. ADVISORI provides a reporting dashboard with these metrics so you can demonstrate training progress to auditors and management.

All eight KRITIS sectors (energy, water, food, IT and telecommunications, healthcare, finance and insurance, transport and traffic, municipal waste disposal) have fundamental training obligations. Particularly stringent requirements apply in healthcare (patient safety), energy (OT security for control systems), and finance (BaFin requirements in addition to BSI). Our training content is adapted to each sector.

Implementing a KRITIS training program typically takes 4 to 8 weeks: needs analysis and concept development (1‑2 weeks), creation of role-specific content (2‑3 weeks), pilot delivery and refinement (1‑2 weeks), rollout and awareness campaign launch (1 week). Costs depend on organization size, number of sectors, and preferred training formats — contact us for a customized proposal.

The law sets no fixed interval for ongoing adaptation — what matters is that measures reflect the state of the art. Evidence is provided to the BSI on a two-year cycle, which is currently shifting from §8a BSIG to the new §§30 and 31 BSIG under the German NIS2 implementation act. Common practice is an annual review cycle supplemented by event-driven adaptations. We anchor both levels in your ISMS.

Event-driven adaptation applies to new BSI warnings or advisories affecting products you operate, security incidents at your organisation or within your sector, material changes to your IT architecture, new regulatory requirements such as NIS2 or the KRITIS Umbrella Act, and findings from audits and emergency exercises. Each trigger should initiate a documented review and decision step.

Threat intelligence is only effective when coupled to a decision process. We assess incoming information — BSI notifications, CERT-Bund advisories, sector-specific sources — for relevance to your specific facilities and derive prioritised measures. Documentation is decisive: which advisory led to which adaptation? That traceability makes providing evidence to the BSI considerably easier.