KRITIS Umbrella Act: status, deadlines and physical security duties

Germany's KRITIS Umbrella Act (KRITIS-Dachgesetz) has been in force since March 17, 2026. It sets cross-sector rules for the physical security of critical facilities, such as perimeter protection, monitoring of the surroundings, access control and fixed alarm procedures. The widely quoted BBK registration deadline of July 17, 2026 no longer exists. Lawmakers deleted the date from the act at the end of July 2026.

In summary: The July 17, 2026 BBK deadline was deleted, and the BBK says there is currently no registration obligation. Registration, protective measures and incident reporting depend on an ordinance still being drafted. Operators can use the time to agree evidence requirements, reporting lines and staffing with their security provider.

For security firms guarding energy suppliers, waterworks or hospitals, the act still matters. The obligations fall on the operator, but the measures the act lists for operators explicitly include security management that covers the staff of external service providers. Security firms should know what their clients can therefore ask for in the guarding contract before the next tender comes around.

Current status: why the BBK deadline of July 17, 2026 no longer applies

The deadline is gone. Article 8 of an act dated July 21, 2026 (BGBl. 2026 I No. 221, published July 28, 2026) rewrote Section 8(1). Operators must now register with the BBK within three months of their facility being classified as critical. An ordinance from the Interior Ministry sets the categories, thresholds and cut-off dates (Section 5(1)).

Even the original text gave July 17, 2026 only as the earliest possible date. The Federal Office of Civil Protection and Disaster Assistance (BBK) says in its FAQ on the KRITIS Umbrella Act (retrieved October 29, 2026) that there is currently no registration obligation under the act. The ordinance, it adds, is still being drafted and coordinated.

Once the ordinance takes effect, a fixed sequence begins. The BBK sets out the registration procedure within four weeks, and operators register their facilities within three months of them being classified as critical. The risk assessment is due nine months after registration. After ten months, the resilience measures, incident reporting and the duties of senior management apply. The BBK publishes templates for resilience plans no later than eight months after the ordinance takes effect.

Nobody has to wait for the ordinance to prepare. Guarding contracts do not expire on the ordinance's schedule, and every new tender is a chance to write the requirements for the provider straight into the specification.

What the KRITIS Umbrella Act requires for physical security

Operators of critical facilities must take proportionate technical, security and organizational measures based on their own risk assessment. One of the four objectives in Section 13(1) is explicitly adequate physical protection of premises and critical facilities. The measures go into a resilience plan, which the operator applies and updates after every risk assessment.

The act transposes the EU Critical Entities Resilience Directive (CER Directive) and covers ten sectors, from energy, water and health care through transport, food and municipal waste disposal (Section 4(1)). Not every duty applies everywhere. For information technology and telecommunications, and for financial entities under the EU's DORA regulation, the risk assessment, resilience, evidence and reporting duties do not apply. For municipal waste disposal and for social insurance and basic income support, only the risk assessment remains (Section 4(2)). The default threshold is 500,000 people supplied. The Bundesrat had asked for 150,000 and did not get it.

As possible measures for physical protection, Section 13(3) lists perimeter protection such as fencing of premises, tools for monitoring the surroundings, detection equipment and access control. It adds predefined alarm procedures, security management for staff, and training and exercises. The list is open-ended (measures "can include" these) and gives way to existing sector-specific rules.

The duties at a glance:

• Registration with the BBK within three months of the facility being classified as critical (Section 8).
• Risk analysis and risk assessment when needed, and at least every four years (Section 12).
• Resilience measures and a resilience plan, including physical protection (Section 13).
• Incident reporting to the BBK without delay and no later than 24 hours after becoming aware, followed by a detailed report no later than one month after becoming aware of the incident (Section 18).
• Senior management must implement and oversee the measures. If it culpably breaches this duty, it is liable to its own organization under company law (Section 20).

Section 24 sets fines of up to one million euros for ignoring an enforceable BBK order in the registration procedure. Failing to submit an audit result, or submitting a wrong one, can cost up to 500,000 euros. Breaching orders from the competent authority under Section 16 can cost up to 200,000 euros, and other breaches up to 100,000 euros. Higher figures such as ten million euros or two percent of turnover come from Section 65 of the BSI Act and concern IT security under NIS-2.

What the KRITIS Umbrella Act means for contracted security providers

The obligations fall on the operator, meaning whoever exercises decisive influence over the critical facility (Section 2 No. 1). The measures in Section 13(3), however, include security management for staff, including the staff of external service providers (Section 13(3) No. 5). Where an operator applies this measure, it directly affects the security firm.

A guarding firm that runs patrols, the gatehouse and alarm response also delivers measures that Section 13(3) lists, namely monitoring of the surroundings, access control and predefined alarm procedures. If the authority asks for evidence on Section 13, that covers these parts too, and the data for them is created by the manned guarding staff on site.

For a security firm guarding a waterworks, this means it should be ready to answer, before the next contract renewal, how patrols, incidents and key handovers are documented, in which format the data reaches the client and how fast.

What evidence the authorities can demand

There is no fixed audit cycle for physical security. The competent authority selects operators on a risk basis and can request evidence, the resilience plan and audit results (Section 16). It may inspect on site and use qualified independent third parties to do so. The operator must grant access to business premises and facilities and open its records.

Which authority is competent depends on the critical service (Section 3(2)). The BBK is the single point of contact, runs registration and receives incident reports. For electricity, natural gas and hydrogen, the evidence rules in Section 16(1) to (6) do not apply, and Section 5f of the Energy Industry Act applies instead (Section 16(7)). The BBK may set requirements for evidence and auditors (Section 16(8)), and it describes the cross-sector minimum requirements as still under coordination.

Claims that the BSI audits physical security every three years against a maturity model have no basis in the KRITIS Umbrella Act. A three-year cycle exists only for IT evidence under Section 39 of the BSI Act.

For site security, Section 16(3) is what counts. The authority can request the documentation behind an audit, and under Section 17(1) operators may also use resilience documents they have produced voluntarily or obtained. If the resilience plan says that patrols monitor the site, that should be verifiable too.

What operators should require from their security provider in the contract

We recommend that the guarding contract mirrors the parts of the resilience plan the provider delivers. Six points belong in it: the measures it takes on, how it documents them, how long records stay available, how fast it reports incidents, how it briefs and trains staff, and who organizes security clearances if needed.

A specification that follows the resilience plan

The specification should name the Section 13(3) measures the provider takes on, such as patrols with fixed checkpoints, access control and alarm response procedures. The resilience plan must set out the reasoning behind the measures (Section 13(4)). A specification that only lists hours and posts contributes little to that.

Evidence format and operator access

The contract should define how a patrol is evidenced: a time stamp per checkpoint, flags for skipped or substituted checkpoints, and incidents with location and time. The operator should be able to access this data directly or receive it at fixed intervals, so that it is already on hand when the authority asks. Officers on site should also be allowed to answer an inspector's questions, because the operator owes the authority access and support (Section 16(4)).

Retention and hand-over at the end of the contract

The KRITIS Umbrella Act sets no retention period for evidence. The contract should therefore set one, agreed with the data protection officer. It should also provide that the data passes to the operator in a readable format if the provider changes.

Incident reporting line

The operator must report incidents to the joint BSI and BBK reporting office without delay, and no later than 24 hours after becoming aware of them. To make that possible, a report from the guard should reach the responsible person at the operator directly. The contract should specify which events are reported immediately, to whom, through which channel and with which details, such as duration and the area affected, which the operator itself has to report (Section 18(2)).

Staff, site briefings and exercises

Section 13(3) lists security management for external providers' staff, as well as training and exercises, among the possible measures. We recommend that the contract specifies three things: which qualification and vetting records the deployed staff provide, how new officers are briefed on the site, and that the provider takes part in the operator's exercises. Frequently changing relief staff without a site briefing are hard to justify in a resilience plan.

New since October 28, 2026: the Sabotage Protection Ordinance

On October 28, 2026, the federal cabinet adopted a revised version of the Security Clearance Designation Ordinance as the Federal Sabotage Protection Ordinance (Sabotageschutzverordnung des Bundes). According to the federal government, it adds further industries and use cases for facilities that are vital to the population. The ordinance rests on the Security Clearance Act (SÜG) and its rules on screening staff to prevent sabotage, a framework separate from the KRITIS Umbrella Act. Under Section 1(4) SÜG, this covers anyone who is or will be employed in a security-sensitive position within a facility vital to the population or to defense.

The government's announcement does not say which industries are added or whether guards employed by a contracted security firm are covered. The published ordinance text will decide, and it does not need the Bundesrat's consent (Section 34 SÜG). Operators of vital facilities should clarify the question before they next fill posts, and the contract should state who organizes the clearances.

How patrol and incident data should be prepared as evidence

For the contract points above, we recommend data that is created automatically with a time stamp and that the operator can call up directly. An online guard tour system provides this data for the part of physical security that the guarding firm delivers. The BBK may set requirements for evidence under Section 16(8).

Here is how it works in COREDINATE, a guard tour and patrol system:

• Checkpoint scans via NFC carry a time stamp, optionally with GPS coordinates, alongside GPS checkpoints and geofences. Patrol monitoring shows in real time which checkpoints are done, and the patrol report flags substitute scans.
• The digital duty log writes itself from scans, events and the start and end of each shift, in chronological order and without re-entry. Key handovers can be documented in the same system.
• Incident reporting records photos and dictated descriptions, and the portal shows whether a photo was taken with the camera or picked from the gallery. Notification rules automatically email the client once an incident reaches a set impact level, and with the SMS module they also send a text message.
• With optional client access, the operator sees the data released to it in real time. Reports come as PDFs at the click of a button or automatically according to configured delivery rules.
• The data is stored on servers in Germany.

Software of this kind does not replace the risk assessment or the resilience plan. It provides the data on the measures the security provider delivers on site, and the operator decides which of it to use as evidence.

Frequently asked questions about the KRITIS Umbrella Act and physical security