How can the suitability of temporary security measures be demonstrated?

If a protective function is temporarily replaced during a conversion, the operator needs a traceable basis for the decision. A data sheet describes the properties of a product. Whether the solution deployed fulfils the required task at the specific site has to be assessed in addition.

Define test criteria before selection

The starting point is the protection task, the risks considered and the conditions of use. It has to be defined, for example, which areas are monitored, how long the function must be available and who responds to an alert. Permissible interruptions and the behaviour in the event of faults are also part of the assessment.

These requirements form the basis for the demonstration. Product documentation, calculations, test reports and required certificates can contribute to it. How much they prove depends on whether they cover the configuration actually deployed and the intended conditions.

Test the entire functional chain

A fictitious example: mobile surveillance is to secure a temporarily relocated access point. A test checks under representative conditions whether a defined event is detected, the alert is transmitted and recognised at the responsible point. It is then checked whether the agreed response works.

Power supply, communication link, permissions and operating staff are part of this functional chain. A successfully transmitted camera image alone does not prove that the measure as a whole is suitable. Longer operating periods additionally need a reliable basis for dimensioning; a short function test does not demonstrate availability over several days.

Document results and limits of use

A test record should link requirement, configuration, conditions, result and open defects. The person carrying out the assessment, the operational approval and triggers for retesting, such as changes of location or interventions in the supply, should also be recorded.

For affected IT systems, section 30 of the BSI Act requires the risk management measures and procedures for assessing their effectiveness to be documented [1]. The test framework presented here is a professional conclusion for temporary solutions. It does not replace any mandatory tests or official verification procedures. According to the BBK, the verification procedure under the KRITIS Umbrella Act is still being coordinated as of the research date [2].

The result is a traceable statement of which protective function was tested under which conditions and which limits apply to its use.

Read more: What do KRITIS requirements mean for temporary protection measures? on the legal context of temporary protection measures, Which insurance obligations apply during temporary protection gaps? on insurance questions during temporary protection gaps and What has to be prepared before an unplanned outage for a temporary replacement solution? on preparing before an outage.

Context: research as of 2 November 2026. The test steps described are professional recommendations, not a binding certification scheme. Site-specific and sector-specific requirements have to be considered in addition.