KRITIS Ongoing Compliance

KRITIS operators must demonstrate to the BSI every two years that they have implemented appropriate organizational and technical measures to prevent disruptions. Evidence is provided through security audits, assessments or certifications — such as ISO 27001 or BSI IT-Grundschutz. ADVISORI supports the preparation, execution and follow-up of these compliance audits.

Significant disruptions to IT systems must be reported to the BSI immediately, no later than within

24 hours. A detailed report is required within

72 hours. With NIS 2 and the KRITIS Umbrella Act, additional reporting obligations to the BBK for physical security incidents apply. We help you establish clear reporting processes and meet all deadlines.

NIS 2 significantly expands the scope of affected organizations and tightens requirements: executives are personally liable for cybersecurity oversight, reporting obligations become stricter, and higher fines apply (up to EUR

10 million or 2% of global annual turnover). The KRITIS Umbrella Act adds physical security requirements and mandates registration with the BBK by July 2026.

Initial implementation establishes the ISMS, technical safeguards and processes. Ongoing compliance covers continuous monitoring, regular risk assessments, adaptation to new threats and regulatory changes, staff training, and the recurring §8a audit every two years. Without systematic ongoing compliance management, gaps emerge that will surface during the next audit.

Violations of KRITIS requirements can result in fines of up to EUR

2 million under the KRITIS Umbrella Act. Under NIS2, penalties increase to up to EUR

10 million or 2% of global annual turnover for essential entities. Additionally, there are reputational risks and — under NIS 2 — personal liability for executives.

An Information Security Management System (ISMS) based on ISO 27001 or BSI IT-Grundschutz forms the backbone of ongoing KRITIS compliance. It structures risk assessments, documents measures, manages incident response and provides the framework for the §8a compliance audit. Continuous maintenance and development of the ISMS is essential to keep pace with new threats and requirements.

ADVISORI offers a comprehensive ongoing compliance package: continuous compliance monitoring, regular gap analyses and risk assessments, preparation and support for §8a audits, assistance with reporting obligations, employee training, and adaptation of your ISMS to new requirements such as NIS 2 and the KRITIS Umbrella Act.