What Counts as Critical Infrastructure?
What Is KRITIS?
KRITIS refers to critical infrastructures—organisations and facilities essential for the functioning of society. Their failure or disruption can cause:
long-term supply shortages
severe public safety impacts
far-reaching societal consequences
When Is Something Classified as Critical Infrastructure?
Not every public-facing organisation automatically qualifies as KRITIS. Key criteria include:
1. Systemic Importance
A facility is KRITIS if its failure would cause major supply shortages or security issues.
2. Threshold Values (BSI-KritisV)
Sector-specific quantitative thresholds, for example:
Energy: input/output capacity
Hospitals: ≥ 30,000 inpatients per year
Water: daily production volume
IT: data centre connection capacity > 3.5 MW
3. Functional Contribution
Highly networked or indispensable services also fall under KRITIS.
Classification occurs via:
self-identification, or
government designation
The 9 KRITIS Sectors at a Glance
Energy
Information Technology & Telecommunications
Water
Food Supply
Healthcare
Finance & Insurance
Transport & Traffic
Government & Administration
Media & Culture
Practical Examples
Hospital:
≥ 30,000 inpatients/year → KRITIS (Healthcare)
Data Centre:
3.5 MW connection capacity → KRITIS (IT)
Food Wholesaler:
Supplies millions daily → potential KRITIS relevance
KRITIS is more diverse than energy or water—it includes IT, logistics, and essential commerce.
Legal Foundations & Protection Concepts
Key regulations:
BSI Act (BSIG) – technical/organisational security measures
BSI-KritisV – sector thresholds and definitions
NIS2 Directive – expanded scope & stricter EU-wide requirements
Typical protection measures:
Information Security Management System (ISMS)
Risk analyses
Business continuity management (BCM)
Security policies, access controls, awareness training
Why Protecting Critical Infrastructure Is Becoming More Important
Drivers include:
more digitalisation → more attack surfaces
rising cyberattacks on hospitals, utilities, authorities
climate risks & extreme weather
geopolitical tensions
new laws like NIS2 and the KRITIS Framework Act
Resilience is evolving from a best practice to a legal requirement.
Conclusion
Critical infrastructures form the backbone of modern society. Understanding KRITIS classification, legal requirements and risks helps organisations implement the right measures early and remain resilient.
Q&A (English)
What counts as critical infrastructure? Organisations in sectors like energy, water, IT, healthcare, finance, transportation, government, media and waste management whose failure would severely impact society.
Who determines what KRITIS is? Legal regulations—primarily the BSI-KritisV—define the criteria.
Is every hospital or IT provider automatically KRITIS? No. Only after threshold values are exceeded (e.g. ≥ 30,000 inpatients/year).
What obligations do KRITIS operators have? Operate an ISMS, report incidents, conduct risk analyses, implement security measures.
Will regulations change due to NIS2 or the KRITIS Framework Act? Yes. More organisations will fall under the scope, and requirements will become stricter.
Srdan Manasijevic
CEO
Expert in information security, data protection and risk management with extensive experience advising enterprises and public-sector organizations. Specialized in ISO 27001, BSI and advanced risk methodologies.
