KRITIS – Understanding and Protecting Critical Infrastructure

Modern societies’ dependence on networked systems makes large-scale outages a high-impact risk, even if their probability is low. A German Parliament technology assessment (with KIT) framed a widespread power failure as a prime example of cascading damage whose consequences cannot be fully controlled, only mitigated, motivating stronger resilience across critical infrastructure. In Germany, “KRITIS” defines organizations and institutions whose failure would cause sustained supply shortages, major public safety disruption, or other dramatic consequences. Protection efforts are shaped by EU initiatives (EPCIP, Directive 2008/114/EC, NIS Directive) and German laws and regulations (BSIG, IT-SiG, BSI-KritisV), with KRITIS now structured into nine sectors and 29 industries.

German operators must maintain a 24/7 liaison contact, report significant IT disruptions, implement state-of-the-art technology, and prove compliance to BSI every two years, often via certifications or audits. Sector-specific requirements are refined through UP KRITIS working groups and B3S “industry-specific security standards,” which are approved by BSI, vary in availability, and commonly define protection objectives, threat situations, risk management, and verifiability. Across sectors such as energy, food/water, transport, healthcare, and finance/insurance, common themes emerge: detailed asset documentation, risk-based controls, protection of automated and operational systems, and the need to prevent and detect both human error and targeted attacks.

A scenario-based transport (rail) example illustrates how seemingly routine changes and disruptions rely on authenticated access, authorization, monitoring, approval workflows, and rapid “break-glass” recovery. Overall compliance centers on a continuously operated ISMS aligned with DIN ISO/IEC 27001, supplemented by threat intelligence and SOC capabilities. Privileged Access Management integrated with IAM is emphasized because compromised privileged accounts drive many attacks; controls such as least privilege, MFA, session monitoring, vaulting, rotation, and governance for both human and technical accounts are positioned as high-leverage risk mitigations, including in cloud and DevOps environments where API keys replace hardcoded passwords.

• A German Parliament Office for Technology Assessment report with KIT (2010) analyzed large-scale power failure as cascading damage with consequences that cannot be fully controlled, only mitigated.
• The EU initiated the European Programme for Critical Infrastructure Protection (EPCIP) in 2006.
• EU Council Directive 2008/114/EC defined identification and designation of European critical infrastructure and assessing the need to improve protection.
• The EU NIS Directive (2016) established legal measures to improve the overall level of cybersecurity in the EU.
• Germany’s IT Security Act (IT-SiG) was issued in July 2015 and augmented by the BSI-KritisV regulation in 2016.
• KRITIS is structured into nine sectors and 29 industries.
• German KRITIS operators must provide a liaison contact reachable at any time and report significant IT disruptions.
• German KRITIS operators must prove implementation of “state of the art technology” to BSI every two years.
• Lloyd’s and the University of Cambridge estimated a cyber-attack on the US power grid could impact the US economy by $243bn, with an extreme scenario exceeding $1trn.
• BAIT’s 2017 revision defined a KRITIS security objective for banks focused on maintaining security of supply for cash supply, card payments, conventional payments, and clearing/settlement of securities and derivatives.

• “Criticality is the relative degree to which an infrastructure is important in terms of the consequences that a disruption or malfunction has for the security of supply of important goods and services to society.”
• “Nine sectors and 29 industries are currently considered as critical infrastructure, including health care, power supply, transport and financial services.”
• “A basic requirement for modern labor-based economies, which rely on the mobility of goods and people, is a functioning and efficient transport and transport system”
• “IT security and cyber resilience can be considered the common denominator of all sectors.”
• “IT security is a scenario of the weakest link; the defender has to protect many different systems and components, while the attacker only has to identify one - or a few - vulnerabilities in order to penetrate critical IT and thus critical infrastructure.”
• “The isolated implementation of individual measures (antivirus software, firewalls, etc.) is considered insufficient.”
• “Threat intelligence is a vital part of cyber-defense and cyber-incident response, providing information about the threats, TTPs, and devices that cyber-adversaries employ; the systems and information that they target; and other threat-related information that provides greater situational awareness.”
• “The cause of most documented attacks is compromised privileged user accounts.”
• “Cloud users should keep in mind, that security is a shared responsibility between the cloud service provider (CSP) and the user.”
• “The best thing to do with your own IT is not to wait for legal regulations to come into effect after the first critical incident.”