What do KRITIS requirements mean for temporary protection measures?

Conversions and maintenance can temporarily impair existing protection measures. Operators who are affected therefore face the question of how to meet their legal security requirements during this phase as well. A time-limited solution has to fit the specific protection task and the risk.

Derive requirements from the risk assessment

Section 13 of the KRITIS Umbrella Act links the physical protection of critical facilities to appropriate technical and organisational measures. They are to be selected on the basis of risk assessments and be proportionate. The act names, for example, access control, monitoring of the surroundings and emergency power supply; it does not prescribe any particular mobile product [1].

For interim phases, the professional conclusion is this: if an intervention changes the protective effect, it should be assessed which functions are still required and how they will be fulfilled temporarily. Whether the act applies in the specific case and when the respective obligations begin must be clarified beforehand.

Integrate temporary technology into operations

A fictitious example: during a conversion, the previously secured access to an operating area is relocated. An interim solution combines a suitable boundary, access control and, where appropriate, surveillance. Responsibilities and responses to unauthorised access are integrated into existing procedures.

If networked devices are used for this, their IT security has to be considered as well. For entities covered by the BSI Act, section 30 includes access control, supply chain security and business continuity, among other things. A temporary solution should therefore also be checked for its effects on the protected IT systems [2].

Record responsibility and decisions

Section 13 requires the measures to be set out and applied in a resilience plan, and that plan to be updated as needed [1]. Section 20 addresses management’s responsibility for organising the implementation [3].

For security-relevant interim operations, it is therefore advisable to handle changes and substitute measures traceably within the existing security management: who decides on the solution? Under which conditions may it be used? When will its suitability be reassessed?

The legal task is to ensure the protective effect required in each case. Mobile infrastructure can contribute to this if its function, operating period and organisational integration are suitable for the specific deployment.

Legal status: 2 November 2026. The obligations under the KRITIS Umbrella Act mentioned here apply in stages after registration. According to the BBK, implementing ordinances are still being prepared. Obligations under the BSIG and other law that already apply have to be considered separately [4].

Read more: Which insurance obligations apply during temporary protection gaps? on insurance questions during temporary protection gaps and Germany’s KRITIS Umbrella Act: physical protection explained on registration, deadlines and site security. How the suitability of an interim solution can be tested and documented is described in How can the suitability of temporary security measures be demonstrated?

Context: research as of 2 November 2026. General orientation, not an assessment of any individual case. The explanations on interim operations are professional conclusions drawn from the legal framework. A conversion does not automatically trigger a particular substitute measure or an incident report. No general obligation to procure mobile technology, no product certification and no automatic proof of legal compliance is claimed.