Germany’s KRITIS Umbrella Act: physical protection explained

Waterworks, substations, rail installations, hospitals: when one of them fails, many people are affected. Until recently, German law mainly covered the IT security of critical infrastructure. Since 17 March 2026, the KRITIS Umbrella Act (KRITIS-Dachgesetz, KRITISDachG) has set nationwide requirements for physical protection for the first time – fences, access points, surveillance, backup power and what happens when something goes wrong.

This article summarises what the Act requires, when the duties apply and where mobile security equipment can help. It reflects the position on 28 October 2026 and is not legal advice.

Where the Act comes from

The KRITIS Umbrella Act transposes EU Directive 2022/2557 on the resilience of critical entities (the CER Directive) into German law. It was signed on 11 March 2026 (BGBl. 2026 I No. 66), entered into force on 17 March 2026 and was amended once already in July 2026 (BGBl. 2026 I No. 221). The lead authority is the Federal Office of Civil Protection and Disaster Assistance (BBK), working closely with the Federal Office for Information Security (BSI).

What is new: IT security of critical facilities is governed by the BSI Act. The Umbrella Act adds physical resilience – protection against sabotage, attacks, natural hazards and other incidents that do not arrive over a network.

Who is covered

The Act applies to operators of critical facilities in ten sectors (section 4(1)):

Sectors under section 4 KRITISDachG
Energy	Water
Transport	Food
Finance	Information technology and telecoms
Social insurance and basic income support	Space
Health	Municipal waste disposal

Not every duty applies to every sector. Financial entities covered by the EU’s DORA regulation and operators in IT and telecoms, for example, are exempt from the resilience duties in section 13 because separate rules apply to them (section 4(2)).

Which individual facility counts as critical is set by an ordinance of the Federal Ministry of the Interior, which defines categories of facility and supply thresholds (section 4(3), section 5(1)). According to the specialist publications available to us, this ordinance was still at draft stage in summer and autumn 2026. The BBK website shows whether it has since been published. Operators should already check whether their facilities are likely to exceed the thresholds.

Deadlines: everything hinges on registration

The duties do not apply all at once but in sequence (section 8):

Step	Deadline	Provision
Registration with the BBK	no later than 3 months after the facility is deemed critical	s. 8(1)
Operator’s own risk assessment	first 9 months after registration, then as needed, at least every 4 years	s. 8(7), s. 12
Resilience measures and resilience plan	first 10 months after registration	s. 8(7), s. 13
Incident reporting	from 10 months after registration	s. 8(7), s. 18
Management duties	from 10 months after registration	s. 8(7), s. 20

Registration runs through a joint BSI/BBK platform. The BBK sets out the procedure within four weeks of the ordinance entering into force (section 8(8)), and publishes templates for resilience plans no later than eight months after it (section 13(5)).

Counting back, operators have little more than a year from designation to a finished resilience plan. For building work, tenders and permits, that is tight.

What section 13 requires for physical protection

Section 13 is the core of the Act. It sets operators four goals:

1. Prevent – stop incidents from happening in the first place.
2. Protect – secure premises and facilities physically to an “adequate” level.
3. Respond – fend off an incident and keep its effects small.
4. Recover – restore the critical service quickly afterwards.

Measures must be proportionate and based on the national risk assessments and the operator’s own risk assessment; they should reflect the state of the art, and economic aspects are taken into account (section 13(2)). The Act lists examples of what may count (section 13(3); terms from the statute):

• Site security: structural, technical and organisational protection, such as perimeter boundaries and intrusion-resistant facade elements
• Tools and procedures for monitoring the surroundings
• Detection equipment
• Access control
• Risk and crisis management and set procedures for alarms
• Business continuity, including backup power, and alternative supply chains
• Security management for staff, including contractors’ personnel
• Information, training and exercises for staff

All measures go into a resilience plan that sets out the reasoning, refers to the risk assessment and is kept up to date (section 13(4)). The Interior Ministry can specify minimum requirements by ordinance; industry bodies can propose sector standards, which the BBK assesses for suitability (section 14).

Reporting, evidence, accountability

• Incident reporting: incidents must be reported to the BBK without delay and no later than 24 hours after becoming aware of them, via the joint BSI/BBK reporting office. A full report follows within one month (section 18(1)). Reports must include, among other things, the number of people affected, the duration and the area concerned (section 18(2)).
• Evidence: the competent authority can request evidence, in particular the resilience plan (section 16).
• Senior management: must implement the resilience measures and ensure they are carried out; it is liable under company law for damage caused culpably (section 20).
• Fines: depending on the breach, up to EUR 100,000, 200,000, 500,000 or one million (section 24).

Austria and Switzerland

In Austria, the Resilience of Critical Entities Act (RKEG) serves the same EU directive (BGBl. I No. 60/2025, section 25) and has applied since 1 March 2026. The route is different: rather than operators registering themselves against thresholds, the Federal Minister of the Interior designates an entity as critical by formal decision (sections 4 and 11). The deadlines run from that decision and closely mirror Germany’s:

Duty in Austria	Deadline from designation	Provision
Own risk assessment	within 9 months, then when risks change, at least every 4 years	s. 14 RKEG
Resilience measures, including adequate physical protection, set out in a resilience plan	after 10 months	s. 15 RKEG
Reporting security incidents to the Interior Ministry	from 10 months: within 24 hours, follow-up within one month	s. 17 RKEG

Switzerland is not an EU member, so the CER Directive does not apply there. For companies with sites in several countries, it still makes sense to build risk assessment and protection planning on a common basis.

Where mobile security equipment helps

The Act does not prescribe a particular fence or camera. It requires protection that matches the risk – and that holds up when things do not go to plan. That is exactly where fixed systems leave gaps:

• Construction and conversion: while a facility is extended or modernised, fences are open, cameras are removed and access routes move.
• Maintenance and failure: when existing security equipment fails or is replaced, protection still has to be in place.
• Until fixed systems are installed: building measures need planning, tenders and permits – while the deadlines are already running.
• Remote sections: pipelines, pumping stations and outlying areas often have no power or network connection.
• Exercises: the Act explicitly mentions training and exercises. Mobile equipment can be set up specifically for exercise scenarios.

Mobile equipment does not replace building measures or a security concept. It bridges and supplements them – and should be described as such in the resilience plan: for which situation, with which protection goal and with which procedures.

How MOVETOS supports this

The MOVETOS SET consists of masts with camera, lighting and loudspeaker. They bring their own power and radio and so do not depend on the grid of the facility they protect. In the MOVETOS OPS platform you define fence lines and restricted zones on the map; anyone entering them triggers a warning with an evidence photo. Over the loudspeaker on the affected mast, your control centre addresses the person directly. No video is recorded.

Warnings, approvals and announcements are logged in full – with time and evidence. The live picture runs where your security service works; at Munich Airport, MOVETOS OPS is integrated into the control centre.

With Security Continuity, MOVETOS temporarily maintains defined protective functions when existing equipment is restricted – prepared, agreed and rehearsed. We define which functions together with you in advance. How mobile surveillance for construction sites and properties is set up is described in Mobile site surveillance.

Checklist for operators

• Check whether you are covered: is the facility in one of the ten sectors, and is it likely to exceed the thresholds in the ordinance?
• Track the ordinance: has it been published? From then on, you have three months to register.
• Assign responsibility: who registers, who reports incidents within 24 hours, who in senior management owns the resilience plan?
• Prepare the risk assessment: what threats exist for perimeters, access points and remote sections – including during construction and maintenance?
• Name the gaps: where are site security, monitoring of the surroundings, detection or access control missing today?
• Plan transitions: how does protection stay in place while fixed systems are built, serviced or replaced?
• Set procedures: what happens when an alarm goes off, who responds, how is it recorded?
• Exercise: are training and exercises planned for staff and contractors?
• Keep the evidence: can you show later what happened when and who responded?

Conclusion

The KRITIS Umbrella Act turns physical protection into a duty with deadlines, reporting channels and personal accountability for senior management. The starting signal still depends on the ordinance – but once it arrives, there is little time until the resilience plan is due. Operators who map risks, gaps and transition phases now can decide in a targeted way what to solve through building work, through organisation and through mobile equipment.