KRITIS Readiness Assessment: How Ready Is Your Organization?

A KRITIS Readiness Assessment systematically evaluates how well your organization is prepared for the legal requirements for protecting critical infrastructures. It is particularly relevant when you have been newly identified as a KRITIS operator, are approaching a section 8a audit, when the KRITIS Umbrella Act or NIS2 introduces new requirements for your organization, or when you need to reassess your compliance status after a merger or restructuring. ADVISORI reviews technical measures, organizational processes, and documentation against BSI requirements and sector-specific standards.

The assessment reviews your compliance against all relevant regulatory requirements: the BSI Act (section 8a BSIG) and IT Security Act 2.0, the KRITIS Umbrella Act (CER Directive), sector-specific requirements such as the Energy Industry Act, DORA, or the Telecommunications Act, sector-specific security standards (B3S), BSI IT-Grundschutz and ISO 27001/27002, and the requirements for attack detection systems (SzA). We also evaluate physical security measures, which are regulated for the first time under the KRITIS Umbrella Act.

A readiness assessment is a preparatory evaluation that determines your current maturity level and identifies gaps before a formal audit is due. The section 8a audit, by contrast, is the legally required examination by qualified auditors whose results are submitted to the BSI. The readiness assessment gives you the opportunity to address weaknesses early and prepare specifically for the audit, rather than being confronted with deficiencies during the examination.

The duration depends on the size and complexity of your organization. For a single facility or manageable infrastructure, we estimate four to six weeks. For complex organizations with multiple sites, interconnected OT systems, or multiple KRITIS sectors, the assessment may take eight to twelve weeks. We coordinate interview schedules and document requests closely with your teams to minimize disruption to your day-to-day operations.

The KRITIS Umbrella Act transposes the European CER Directive (2022/2557) into German law and significantly broadens the focus beyond IT security: Physical security such as access controls and sabotage prevention is regulated for the first time, the scope of affected sectors and operators is expanded, risk analyses must be conducted and documented more comprehensively, and resilience plans including recovery measures become mandatory. Existing KRITIS operators must supplement their security concepts accordingly.

Yes, we provide end-to-end support from assessment through demonstrated compliance. After the assessment, we assist with implementing prioritized measures, introducing or extending an ISMS in accordance with ISO 27001, developing emergency and business continuity concepts, preparing for section 8a audits and regulatory inspections, and training your staff on KRITIS-relevant topics.

A KRITIS emergency concept under BSI Standard 200‑4 comprises several core components: a Business Impact Analysis (BIA) to identify critical business processes, a risk analysis of relevant threat scenarios, documented recovery plans with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), crisis communication plans for internal and external stakeholders, and an exercise programme with regular tests. BSI Standard 200‑4 provides a three-tier model: Reactive BCMS, Build-up BCMS, and Standard BCMS, enabling organisations to incrementally develop a complete Business Continuity Management system.

The KRITIS Umbrella Act sets the following timelines: Registration as a critical facility must be completed by July 2026. Operators then have approximately 9 months to conduct a full risk analysis and a further 10 months to implement the resulting measures, including emergency concepts. Resilience plans must be regularly updated and revised when the threat landscape changes significantly. ADVISORI recommends starting early, as developing robust emergency concepts typically takes 6 to 12 months.

Resource planning in Business Continuity Management goes beyond standard budgeting: it systematically captures all resources needed to maintain critical services during an emergency. This includes personnel with key competencies and their deputies, technical fallback capacities and redundancies, crisis communication infrastructure, contracts with emergency service providers and suppliers, and stockpiles of critical spare parts. The challenge lies in finding the right balance between holding costs and recovery speed. ADVISORI uses data-driven models to optimise this trade-off individually for each KRITIS sector.

The NIS2 Directive significantly expands emergency management requirements for KRITIS operators. It mandates measures for security incident handling, Business Continuity Management including backup management and disaster recovery, and crisis management procedures. NIS2 also tightens reporting obligations: significant security incidents must be reported to the BSI within 24 hours as an early warning and within 72 hours with a full notification. ADVISORI seamlessly integrates NIS2 requirements into existing emergency concepts, ensuring both regulatory frameworks are satisfied in parallel.

BSI Standard 200‑4 and the KRITIS Umbrella Act require regular reviews and exercises. In practice this means: at least annual emergency exercises with varying scenarios (tabletop exercises, functional tests, and full-scale exercises in rotation), event-driven revisions following organisational changes, new threats, or actual incidents, and a formal review of all emergency documentation at least every two years. ADVISORI supports the design and execution of exercises and assists with systematic evaluation so that identified weaknesses feed directly into improved emergency concepts.