Short answer: KRITIS describes critical infrastructure. Germany’s NIS2 Implementation Act, often searched for as NIS2UmsuCG, establishes cybersecurity duties for a wider set of organizations. Critical-facility operators fall within the particularly important category under the BSIG, while the KRITISDachG separately addresses physical resilience. [1–5]
If you run IT for a German organization or support German clients as an MSP, understanding KRITIS and Germany’s NIS2 rules helps you identify which obligations to assess. This guide explains the terms, where they overlap, and what they mean for IT operations.
This article provides general information, not legal advice. Applicability depends on the organization’s services, structure, and current statutory criteria.
KRITIS vs. NIS2UmsuCG at a glance
| Aspect | KRITIS and critical facilities | Germany’s NIS2 framework |
| What it describes | Critical infrastructure and legally defined critical-facility operators. | Cybersecurity rules introduced by the NIS2 Implementation Act. |
| Legal basis | BSIG, relevant ordinances, and the separate KRITISDachG. | Primarily the revised BSIG and applicable sector legislation. |
| Coverage | Facility and critical-service criteria, thresholds, and applicable designations. | Listed entity types, size rules, and special categories. |
| Core duties | Cybersecurity duties plus applicable facility-specific requirements; separate physical-resilience duties. | Risk management, registration, significant-incident reporting, and management duties. |
| Authorities | BSI for cybersecurity; BBK and designated federal or state authorities for KRITISDachG duties. | Primarily BSI, subject to sector-specific arrangements. |
| Overlap | Critical-facility operators are particularly important entities under the BSIG. | Also covers many entities that operate no critical facility. |
This comparison separates critical-infrastructure status from the wider cybersecurity framework. Sector-specific exceptions and implementation dates still matter.
What does KRITIS mean?
KRITIS is short for Kritische Infrastrukturen, or critical infrastructure. It describes infrastructure whose disruption could seriously affect essential services or public safety. It is not the name of a single law. Binding duties depend on the applicable legal definition of an operator of critical facilities (Betreiber kritischer Anlagen), rather than on the broad KRITIS label alone. [3, 4]
Two legal tracks matter. The BSI Act (BSIG) governs cybersecurity. The KRITIS-Dachgesetz (KRITISDachG), which implements the EU Critical Entities Resilience Directive (EU) 2022/2557, addresses physical resilience and continuity against hazards such as natural disasters, accidents, and sabotage. It entered into force on 17 March 2026; this does not mean every operator duty applied immediately. [4, 5]
For cybersecurity classification, assess the applicable facility categories and thresholds, including the BSI-Kritisverordnung (BSI-KritisV) and current BSI guidance. Separately assess the KRITISDachG criteria and implementation arrangements. Operators of critical facilities are classified as particularly important entities under § 28(1) no. 1 BSIG, although sector-specific exceptions can change which duties apply. [2–4]
What is the NIS2UmsuCG?
NIS2UmsuCG is a term associated with the earlier NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz bill. The enacted law is titled Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung. This article calls it Germany’s NIS2 Implementation Act. It implements Directive (EU) 2022/2555, principally through a new BSIG and amendments to other legislation. [1]
The NIS2 Implementation Act was published in the Bundesgesetzblatt on 5 December 2025 and entered into force on 6 December 2025. It is enacted law, not a pending proposal. For current obligations, use the consolidated BSIG and applicable sector legislation, rather than earlier drafts. [1, 2]
The BSIG distinguishes besonders wichtige Einrichtungen (particularly important entities) and wichtige Einrichtungen (important entities). These German statutory categories determine supervision and duties; they should not be confused with the broader everyday meaning of “critical infrastructure.” [2]
The key differences between KRITIS and NIS2UmsuCG
Legal function
KRITIS describes critical infrastructure. Germany’s NIS2 Implementation Act establishes a broader cybersecurity framework. The separate KRITISDachG adds a framework for physical resilience. An organization may need to assess all three concepts. [1–5]
Organizational scope
Critical-facility rules focus on specified facilities and their operators. Germany’s NIS2 rules cover many additional entity types, including certain manufacturers, digital providers, MSPs, and managed security service providers (MSSPs). An organization can therefore be in scope without operating a critical facility. [2, 3]
Applicability criteria
Facility-based classification depends on the relevant critical-service criteria, facility categories, thresholds, and any applicable individual designation. NIS2 coverage also depends on the entity type and size rules in § 28 BSIG and Annexes 1 and 2. [2–4]
For a first screening, the general important-entity rule for listed Annex 1 or 2 activities is at least 50 employees, or both annual turnover and an annual balance-sheet total above €10 million. For listed Annex 1 activities, the general particularly important threshold is at least 250 employees, or both turnover above €50 million and a balance-sheet total above €43 million. Special categories, group calculations, and statutory exceptions can change the result. These are not universal cutoffs. [2]
Obligations
Where the relevant BSIG provisions apply, covered entities must document proportionate cybersecurity risk-management measures, report significant incidents, and register. Critical-facility operators have additional requirements, including attack-detection systems under § 31 and evidence through audits, examinations, or certifications under § 39, subject to exceptions and transitional rules. The KRITISDachG separately provides for risk assessments, resilience measures, and a resilience plan. [6–10]
Governance and oversight
The BSI is the principal cybersecurity authority under the BSIG, with sector-specific arrangements in areas such as energy and telecommunications. Under the KRITISDachG, the BBK is the central contact point and has specified registration and reporting functions. Supervision is shared with designated federal and state authorities; the BBK is not the sole regulator for every sector. [2, 5]
Management responsibility
Under § 38 BSIG, management must implement and oversee the required cybersecurity risk-management measures and participate in regular training. Assigning operational tasks to an IT team or MSP does not remove those management duties. [11]
Registration and incident reporting
Under § 33 BSIG, relevant entities must register within three months of first or again meeting the statutory criteria. For entities in scope on 6 December 2025, the ordinary initial deadline was 6 March 2026. Registration does not determine whether the law applies. The BSI Portal is the NIS2 registration channel; critical-facility operators should also follow the BSI’s separate current KRITIS registration instructions. [3, 9]
For significant cybersecurity incidents under § 32 BSIG, submit an early warning without undue delay and within 24 hours of awareness, then an incident notification without undue delay and within 72 hours. The final report is generally due within one month after the incident notification. If the incident is ongoing, submit a progress report at that point and a final report after handling is complete. A reportable incident is not the same as every alert or software vulnerability. [8]
The KRITISDachG has a separate timetable. Under § 8(7), risk-assessment duties first apply nine months after registration; resilience, reporting, and management duties first apply ten months after registration. Once § 18 applies, report qualifying incidents without undue delay and within 24 hours of awareness, with a detailed report within one month of awareness. Relevant ordinances and registration arrangements must also be considered. These timings do not defer existing BSIG duties. [5, 10]
Where the frameworks may overlap
Some organizations face both. The scenarios below are hypothetical illustrations, not legal determinations.
- Scenario A, a water operator: an operator of a qualifying critical water facility falls within the particularly important category under the BSIG. Physical-resilience duties also require assessment under the KRITISDachG and its applicable timing and scope rules. [2–5]
- Scenario B, a manufacturer: a business within a manufacturing category listed in Annex 2 may qualify as an important entity because of its size, even if it operates no critical facility. Manufacturing as a general label is not enough to establish coverage. [2]
- Scenario C, an MSP: an MSP may have its own direct NIS2 obligations because MSPs and MSSPs are listed in Annex 1. It may also need to meet contractual security and incident-cooperation requirements from regulated clients. Serving a KRITIS client alone does not determine the MSP’s legal classification. [2, 12]
In-scope MSPs and certain other digital providers must also consider Commission Implementing Regulation (EU) 2024/2690, which specifies cybersecurity risk-management measures and significant-incident criteria for those provider types. [12]
The takeaway: KRITIS and NIS2UmsuCG are neither interchangeable nor mutually exclusive.
Does the NIS2UmsuCG replace KRITIS?
No. Critical-facility operators remain expressly covered by the BSIG. The NIS2 Implementation Act replaced and expanded the previous cybersecurity framework; it did not abolish critical-infrastructure status. The KRITISDachG adds a separate resilience framework with its own scope, exceptions, and implementation schedule. Existing controls and evidence should be mapped to the current requirements. [1–6]
How to assess whether your organization may be affected
- Identify each legal entity, its sector, and the actual services it provides; map them to the BSIG annexes.
- Calculate the relevant employee and financial figures, including applicable partner- and linked-enterprise rules.
- Assess special entity categories, exemptions, and sector rules, including energy, telecommunications, and DORA-regulated financial entities.
- Assess critical facilities separately using the relevant ordinance, thresholds, and current BSI and BBK guidance.
- Record existing KRITIS registrations, notices, audit dates, and evidence obligations.
- Confirm jurisdiction for cross-border services. Special EU main-establishment rules apply to providers such as MSPs and cloud providers under § 60 BSIG. [12]
- Document the classification decision, obtain qualified advice where needed, and assign owners for registration, reporting, and reassessment.
What this means for IT operations
The following examples translate legal requirements into operational work. They are not an exhaustive compliance checklist, and the evidence shown is illustrative. BSIG § 30 expressly covers risk analysis, incident handling, continuity, supply-chain security, vulnerability management, effectiveness testing, training, cryptography, personnel security, access control, asset management, and authentication. [6]
| Regulatory theme | Examples of operational work and evidence |
| Asset and access management | Maintain inventories and owners; reconcile unmanaged devices; review access, MFA, and privileged remote sessions. |
| Vulnerability management | Prioritize vulnerabilities, deploy and verify patches, and record exceptions and compensating controls. |
| Continuity and recovery | Define recovery objectives; test restores and record results, dependencies, and corrective actions. |
| Detection and incident handling | Maintain detection and escalation workflows; preserve relevant logs; exercise reporting deadlines and decision ownership. |
| Supply-chain security | Assess suppliers and MSPs; record dependencies, security terms, and incident-notification arrangements. |
| Governance and effectiveness | Maintain risk decisions, management training records, control reviews, and cryptography policies. |
| Critical-facility requirements | Where applicable, maintain attack-detection systems and audit evidence under §§ 31 and 39 BSIG. |
| Physical resilience | Where applicable, assess site hazards, physical access, continuity arrangements, and the resilience plan under KRITISDachG. |
Select controls and evidence based on the organization’s risks, legal scope, and applicable sector requirements.
MSPs should note that accountability and legal obligations cannot automatically be delegated. An MSP can run controls and produce evidence, but the regulated organization generally remains responsible for its own compliance.
KRITIS and NIS2UmsuCG readiness checklist
Legal applicability work
- Document applicability under the current BSIG, KRITISDachG, and relevant ordinances.
- Record the entity category and the rationale for inclusion or exclusion.
- Confirm registration obligations, submission dates, and current portal instructions.
- Map existing KRITIS obligations to current audit and evidence requirements.
- Assign responsibility for monitoring legal, organizational, and service changes.
- Resolve uncertain classifications and sector exceptions with qualified German counsel.
Technical readiness work
- Inventory systems, endpoints, software, services, dependencies, and owners.
- Document risk assessments, approved controls, management oversight, and training.
- Review vulnerability identification, risk-based patching, remediation verification, and exceptions.
- Exercise incident detection, escalation, legal reporting, and evidence-preservation procedures.
- Test backup integrity, restoration, and continuity plans against recovery objectives.
- Review supplier security, privileged access, MFA, cryptography, and control effectiveness.
How NinjaOne can support operational readiness
NinjaOne supports internal IT teams, including enterprise organizations, and MSPs with endpoint management, patch management, vulnerability management, backup, and remote access. Depending on the products deployed and configuration, teams can centralize device visibility, coordinate remediation, and collect operational records to support their security program. [13]
These capabilities can support controls and evidence, but do not establish or certify NIS2 or KRITIS compliance. Organizations still need governance, legal scoping, incident reporting, appropriate detection and response, and any applicable physical-resilience measures.
