KRITIS Umbrella Act:
implementing physical security with legal certainty.
The KRITIS Umbrella Act puts the physical resilience of critical facilities into focus. Barricadix delivers the access- and vehicle-related physical risk analysis as a robust basis for your protective measures.
The KRITIS Umbrella Act obliges operators of critical facilities to ensure physical resilience — including registration, a regular physical risk analysis and a resilience plan with appropriate protective measures. Barricadix delivers the vehicle- and access-related physical risk analysis and standards-compliant design as a robust basis.
What operators must deliver.
The central operator obligations of the KRITIS Umbrella Act at a glance — as things currently stand and subject to the respective applicable legal text.
Registration
As things currently stand, operators of critical facilities must register with the responsible authority (including the BBK) and designate a contact for notifications.
Physical risk analysis
Regular physical risk analysis and risk assessment of the relevant threats — including physical attacks, sabotage and vehicle threats at access points and the perimeter.
Resilience plan & measures
A physical resilience plan with appropriate technical and organizational measures derived from the risk analysis and documented.
Notification obligations
As things currently stand, significant disruptions and security incidents must be reported to the responsible authority within defined deadlines.
Implementation deadline
As things currently stand, this is expected to be the cut-off date for implementation. Individual obligations may take effect in stages — the respective current legal status is decisive.
Possible sanctions
As things currently stand, in the event of violations fines of up to millions are possible; a responsibility of the management is also under discussion. The specific frameworks follow from the applicable legal text.
Note: The information reflects the current state of discussion or of the legislative procedure and does not constitute legal advice. The respective current state of legislation and regulation is always decisive.
NIS2 or KRITIS Umbrella Act?
Two sets of rules with a different focus — they complement each other.
Cyber & IT security
NIS2 primarily addresses the information security and cyber resilience of critical entities — network and system security, risk management for IT as well as the associated notification and evidence obligations.
Physical resilience
The KRITIS Umbrella Act targets the physical resilience of critical facilities — protection against physical threats such as sabotage, unauthorized access and vehicle attacks at access points and the perimeter.
Barricadix focuses on the physical, access- and vehicle-related level — protection against vehicle attacks as part of physical resilience.
How Barricadix supports.
Barricadix covers vehicle- and access-related physical protection — as a robust building block of your physical resilience plan.
Physical risk & threat analysis
Geodata-based analysis of the access points and the perimeter for vehicle threats — approach path, achievable speed and impact energy are assessed for each area.
Standards-compliant design
Derivation of the required protection or impact class for each access point according to the relevant standards (including DIN SPEC 91414-2, DIN ISO 22343) as an appropriate protective measure.
Auditable risk report
A comprehensible, documented risk report — usable as a basis and building block of the physical resilience plan for operators, planners and authorities.
Manufacturer-neutral tender
A manufacturer-neutral performance specification emerges from the analysis — the robust basis for the later implementation of the protective measures.
Honest distinction: Barricadix covers vehicle- and access-related physical protection — not the entire KRITIS or cyber compliance. We deliver the physical building block that fits into your resilience plan. More on the modules under Risk & threat analysis and in the vehicle access protection concept.
Frequently asked questions about the KRITIS Umbrella Act
What does the KRITIS Umbrella Act require of operators?
As things currently stand, the KRITIS Umbrella Act obliges operators of critical facilities to ensure physical resilience: registration with the responsible authority, a regular physical risk analysis, a resilience plan with appropriate technical and organizational protective measures, as well as notification obligations for significant disruptions. The respective current state of legislation is always decisive.
By when must the KRITIS Umbrella Act be implemented?
As things currently stand, 17.07.2026 is cited as the expected implementation deadline; individual obligations may take effect in stages. As the legislative process may still change, the respective current state of legislation and regulation applies. Operators should start early with the physical risk analysis in order to have lead time for measures.
What is the difference between NIS2 and the KRITIS Umbrella Act?
NIS2 primarily addresses the cyber and IT security of critical entities. The KRITIS Umbrella Act targets the physical resilience of critical facilities — protection against physical threats such as sabotage, unauthorized access and vehicle attacks. Both complement each other; Barricadix focuses exclusively on the physical, access- and vehicle-related level.
Who must carry out a physical risk analysis?
As things currently stand, operators of facilities classified as critical in the affected sectors are addressed. They bear the responsibility to systematically analyze and assess their physical risks. Whether a facility is specifically covered depends on the statutory sector and threshold definitions — the respective current legal status is decisive.
What sanctions apply for non-implementation?
As things currently stand, fines are envisaged in the event of violations, which depending on the case can reach into the millions; a responsibility of the management is also under discussion. The specific fine frameworks and liability rules follow from the respective applicable legal text — this is decisive in each individual case and does not replace legal advice.
The answers reflect the current state and do not constitute legal advice. The respective applicable legal text is decisive.
Ready for the physical risk analysis under the KRITIS Umbrella Act?
We show you how Barricadix delivers the access- and vehicle-related physical risk analysis — as a robust basis for your resilience plan.
Get in touch