KRITIS Umbrella Act Consulting in Germany

You’re not sure whether you’re affected? Take the free quick check.

In just a few clicks, get our assessment for your company
START QUICK CHECK

Germany’s Umbrella Act for Critical Infrastructure Protection (KRITIS-Dachgesetz) establishes a cross-sector framework for strengthening the physical and organisational resilience of critical facilities. It is commonly referred to in English as the KRITIS Umbrella Act.

Operators must assess relevant risks, implement appropriate resilience measures and document them in an operational resilience plan.

3-core provides professional KRITIS Umbrella Act consulting for German and international organisations operating critical facilities in Germany. We support you from the initial applicability assessment through risk analysis and resilience planning to practical implementation.

Our approach combines physical security, business continuity management, emergency preparedness and crisis management in one coordinated framework.

What is the KRITIS Umbrella Act?

The KRITIS Umbrella Act implements the European Critical Entities Resilience Directive, commonly known as the CER Directive, in German law. It introduces uniform cross-sector requirements for the physical resilience of critical facilities and the protection of essential services.

Its all-hazards approach considers a wide range of potential disruptions, including:

  • natural hazards and extreme weather;
  • technical failures and supply interruptions;
  • human error and organisational weaknesses;
  • sabotage, unauthorised access and physical attacks;
  • dependencies on suppliers, utilities and external service providers.

The objective is not only to prevent incidents. Operators must also be able to limit their impact, maintain critical services and restore operations within an appropriate period.

Which organisations may be affected?

The Act applies to operators of critical facilities in legally defined sectors. Whether a particular facility falls within its scope depends on factors such as the critical service provided, the type of facility, the number of people supplied and the applicable thresholds or official determinations.

Relevant sectors include areas such as energy, transport, health, water, food, information technology and telecommunications, finance and other essential services. The Act defines the legal framework, while supplementary regulations and authority decisions may further specify its application.

Our KRITIS Umbrella Act consulting helps you clarify:

  • which legal entities, sites and facilities should be assessed;
  • which critical services your organisation provides;
  • whether applicable thresholds are reached;
  • which existing regulatory obligations must be considered;
  • which registration, reporting and governance duties may apply;
  • how the assessment should be documented.

A structured applicability assessment provides a reliable foundation for all further implementation activities.

Four people in business attire sit around a rectangular wooden table in a modern office, viewed from above, discussing KRITIS implementation. The table holds notebooks, drinks, coffee cups, a potted plant, and bottled water.

Our KRITIS Umbrella Act consulting services

3-core helps you translate regulatory requirements into practical structures and measures.

Our services include:

  • applicability and scope assessments;
  • risk analysis and risk evaluation;
  • resilience gap assessments;
  • development of resilience measures;
  • preparation of resilience plans;
  • physical security concepts;
  • business continuity and emergency management;
  • crisis management structures and exercises;
  • governance, reporting and documentation.

Existing security, BCM and crisis management structures are considered and integrated wherever appropriate.

Risk assessment and resilience planning

The operator risk assessment provides the basis for selecting suitable and proportionate resilience measures. The resulting resilience plan should connect prevention, physical protection, incident response, business continuity and recovery.

Our KRITIS Umbrella Act consulting ensures that these elements form one coherent and operational framework rather than a collection of isolated documents.

Four people in business attire are gathered around a conference table, looking at a laptop. They appear engaged in discussion, possibly strategizing the implementation of the KRITIS umbrella law for critical infrastructure in a modern office setting.

Why work with 3-core?

3-core combines expertise in:

  • physical security;
  • business continuity management;
  • emergency and crisis management;
  • corporate resilience;
  • risk analysis and governance.

Our approach is independent, practical and adapted to your organisation. We develop structures that support regulatory compliance while improving your actual ability to respond to disruptions and crises.

Start your KRITIS-Dachgesetz implementation

Do you operate facilities in Germany and need support assessing your obligations or preparing a resilience plan?

Discuss your situation and the next steps with our experts.

Learn more about the differences and interaction between the KRITIS-Dachgesetz and NIS2 in Germany.

We'll get you ready to go in a 30-minute turbo kick-off session.

3-core supports you in evaluating your current position, identifying the relevant requirements and defining an appropriate implementation approach.

Four people in business attire are discussing in front of a whiteboard covered with colorful sticky notes and lists. One person holds a clipboard while another gestures, and the group appears engaged in a crisis management team meeting.