NIS2, KRITIS Umbrella Act & Physical Security: Concrete Steps for Critical Infrastructure Operators

"We are affected"—now what?

It usually starts with an email from legal counsel, a tip from an auditor, or an article in the trade press. Then comes the internal research—and the realization that your company falls under NIS2 or the KRITIS Umbrella Act. Suddenly, terms like registration obligation, risk analysis, resilience plan, and evidence duty to authorities are on everyone's lips. And the big question: What does this mean concretely for our physical security—and where do we start?

This post answers exactly that. No theory, no generic summary of the directive—but a concrete roadmap: what the law requires, which deadlines apply, and how a Physical Penetration Test fulfills the evidence obligations mandated by NIS2 and the KRITIS Umbrella Act.

NIS2 and the KRITIS Umbrella Act: Two Laws, One Mandate

Many companies stumble over the question: Am I affected by NIS2, the KRITIS Umbrella Act—or both? The answer depends on the sector and company size. Important: both laws can apply simultaneously but address different protection goals.

Who falls under which law—and how do I know?

The first and most important question is: Does my company fall under NIS2 or the KRITIS Umbrella Act? Both laws require operators to identify themselves—an authority will not proactively contact you. If you misjudge your status and fail to register, you are still liable.

NIS2 affects you if:

• Your company operates in one of the 18 defined sectors (see below)
• You are classified as an Essential Entity: > 250 employees OR > €50M turnover AND > €43M balance sheet total
• You are classified as an Important Entity: > 50 employees OR > €10M turnover AND > €10M balance sheet total
• Regardless of size, if you are already classified as a KRITIS operator

KRITIS Umbrella Act affects you if:

• You operate a critical facility whose failure affects at least 500,000 people
• Your specific Federal State has defined lower thresholds—then even with lower supply reach
• You have been identified as a KRITIS operator by the BBK or relevant specialist authority

The full list of sectors includes 18 areas—from energy and health to space and waste management. If you are unsure, the BSI provides an "affectedness checker" at bsi.bund.de. When in doubt, a legal assessment is worth the investment—the duty of self-identification applies regardless of whether an authority has contacted you.

The Roadmap: What to do by when

Combined, both laws create a tight calendar. The most important insight: With NIS2, there is no grace period for implementing measures. If you fell under the law when it came into force on Dec 6, 2025, you must already meet the requirements.

What concretely must be implemented—the physical part

Both NIS2 and the KRITIS Umbrella Act contain explicit physical security requirements. Many operators are surprised: they invested heavily in IT security, but the physical side was treated as secondary. This is fundamentally changing.

Five questions you should be able to answer today

If your company falls under NIS2 or the KRITIS Umbrella Act, these are the five questions you must have a documented answer for—not eventually, but now.

Why a Physical Penetration Test is the most direct answer to the Duty of Proof

The KRITIS Umbrella Act and NIS2 don't just require measures to exist—they require their effectiveness to be proven. This is a fundamental shift from previous requirements. A checklist and a technical data sheet of your ACS are no longer sufficient.

A Physical Penetration Test is the most effective preparation tool because it:

• Simulates real attack conditions: Not a theoretical test, but a controlled attempt to overcome physical protections using the same methods a real attacker would use.
• Provides auditable documentation: The test report contains a full list of tested attack vectors, vulnerabilities found, their risk potential, and concrete recommendations. This format is directly usable as evidence for the BSI and BBK.
• Creates the basis for risk analysis: A physical risk analysis under § 12 of the KRITIS Act builds on empirical findings—what a pentest finds is not theory, but measured risk.
• Prioritizes investment: Without a pentest, you either over-invest in the wrong areas or under-invest without knowing it. The report provides a prioritized roadmap for capital expenditure.
• Is repeatable: After structural changes, changes in service providers, or a security incident—a current pentest shows the actual state, not the state from three years ago.

Conclusion: Regulation is here—the time for waiting is over

NIS2 has been in effect since December 2025. The KRITIS Umbrella Act was passed in January 2026. Both laws bring binding physical security obligations with the weight of evidence—including personal liability for management and fines in the millions for violations.

The question is no longer whether you must act. The question is whether you act structured—with a clear plan for registration, risk analysis, implementation, and proof. Or whether you wait until an authority comes asking.

The first concrete step is almost always the same: understanding where your physical security actually stands today. Not in the documentation—but in reality.