Kritis

The KRITIS Framework Act (Law for the Implementation of Directive (EU) 2022/2557 and Strengthening the Resilience of Critical Facilities) was passed by the Federal Cabinet on November 6, 2024, and introduced into the parliamentary process. The goal of the law is to improve the protection of critical infrastructures (KRITIS) in Germany and to strengthen resilience against potential threats and disruptions.

The law includes several measures to increase IT security and emergency preparedness in system-relevant sectors such as energy supply, healthcare, and finance. Key elements of the law include:

Mandatory security requirements
Organizations in the KRITIS sector must adhere to security standards to better protect their systems and data from cyberattacks and other threats.
Risk assessments
Organizations are required to regularly assess risks that could jeopardize their operations and supply readiness in order to take preventive measures to mitigate those risks.
Reporting obligations
In the event of security incidents or attacks, companies are obligated to report these to the relevant authorities immediately to enable a rapid response and countermeasures.

Through these and other provisions, the law aims to enable a swift response to attacks or disruptions, thereby ensuring supply security and strengthening Germany’s resilience to attacks on critical supply infrastructures. The overarching goal is to minimize failures of critical infrastructures and to enhance society’s resilience against crises and attacks.