Critical infrastructure: preparing and passing the BSI evidence
Inventory, gap analysis, implementation and audit preparation for operators of critical infrastructure — from Singen, within 100 kilometres.
ISO 27001 · Microsoft Solution Partner
Operators of critical infrastructure in Germany must demonstrate to the Federal Office for Information Security every two years that their IT security matches the state of the art. We support that process — from taking stock through the technical measures to the documentation an auditor will want to see.
What is KRITIS and who is affected?
KRITIS is the German term for critical infrastructure: facilities whose failure would endanger public supply. The BSI Act names nine sectors and sets thresholds per sector above which an operator falls under the regulation.
Energy: electricity, gas, fuel, district heating
Water: drinking water supply and waste water disposal
Food: production, trade and supply
Health: hospitals, laboratories, pharmaceutical supply
Information technology and telecommunications
Transport, finance and insurance, municipal waste, government and administration
What must an operator demonstrate?
Every two years, evidence under section 8a(3) of the BSI Act: that appropriate organisational and technical precautions are in place to prevent disruptions to availability, integrity, authenticity and confidentiality.
An information security management system that is lived, not merely documented
Attack detection: systems that report anomalies before anyone notices them
Reporting channels to the authorities that work under pressure
Evidence of effectiveness, not just of existence
How does KRITIS differ from NIS2?
KRITIS follows German law and affects a small number of very large operators. NIS2 is an EU directive and widens the circle considerably — to companies with 50 or more employees across eighteen sectors. Many companies with no KRITIS exposure fall under NIS2.
Those covered by KRITIS generally meet the NIS2 requirements as well. The reverse does not hold. More on our page about NIS2 compliance.
How do we support you?
In four steps, and the first is always an honest inventory — even when it is uncomfortable.
Inventory: what exists, what is missing, what is documented and what merely practised
Gap analysis against the security standard for your sector
Implementation: technical measures, attack detection, reporting processes, training
Audit preparation: presenting the evidence so that an auditor accepts it
The obligation remains yours. There is no such thing as a KRITIS certification for service providers, and no one can take the responsibility off your hands. What we can do is make sure you do not face it alone.
What qualifies NMS?
Certified to ISO 27001 — we operate an information security management system ourselves
Microsoft Solution Partner for Modern Work
Our clients include operators of critical infrastructure and companies under NIS2
Based in Singen am Hohentwiel, catchment area reaching Zurich
If your data must not leave the building, we also run language models locally — in our own data centre or on your premises.
How do we start?
With a conversation you need not prepare for. You describe your situation, we say where we see a need to act and what a sensible first step would be. Book a meeting or write via the contact form.
Solutions in a new dimension.
One conversation is enough to find out where IT, Microsoft Cloud and AI can take real weight off day-to-day business.
Your contact: Jan Emmerich, Managing Director