BSIG · KRITIS-Dachgesetz · evidence under section 39
Since 2026, critical facilities must provide evidence on two levels.
Under section 28 BSIG, operators of critical facilities count as particularly important entities. Since March 2026, physical resilience under the KRITIS-Dachgesetz comes on top. We test both in one coordinated run and document it so that the report works as evidence.
Report as evidence document under section 39 BSIG
IT, OT and physical access in one test
No operational disruption
Two laws, one test run
CybersecurityBSIG as amended by the NIS2UmsuCGsince 6 Dec 2025
sections 30, 31 BSIGRisk management to the state of the art
section 39 BSIGEvidence to the BSI every three years, previously two
Physical resilienceKRITIS-Dachgesetzsince 17 Mar 2026
All-hazards approachSabotage, natural disasters and supply chain failures considered together
Resilience planEmergency response teams, site protection, backup supply
Physical accessControl room, server room and technical areas become subject to testing
One run, one report
Physical, infrastructure, OT and Active Directory in one coordinated test. Every finding with its section, severity and remediation measure.
Ten critical sectors
Energy
Water and wastewater
Health
Food
Finance and insurance
Transport and traffic
Digital infrastructure and ICT
Municipal waste disposal
Social security and basic income support
The tenth sector under section 4(1) KRITIS-Dachgesetz is space. Whether a facility counts as critical depends on facility-specific thresholds. They are all derived from the baseline threshold of 500,000 persons supplied; the values for each facility type are set out in Annexes 1 to 9 of the BSI-KritisV. As of June 2026, 1,231 operators with 2,180 critical facilities are registered with the BSI.
What we deliver and what we don't
From us
Pentest across IT, OT and physical access control, coordinated with your operations
Report as evidence document under section 39 BSIG, with management summary and remediation plan
Critical findings reported immediately, while the test is still running
Not from us
Registration and submission of the evidence to the BSI
Determining whether your facility reaches the thresholds of the BSI-KritisV
The resilience plan itself. We deliver the technical findings you use in it
If your documents still cite section 8a BSIG
section 8a BSIGMeasuressections 30, 31 BSIG
section 8a(3) BSIGEvidencesection 39 BSIG
section 8b BSIGReporting dutysection 32 BSIG
The NIS2UmsuCG restructured and renumbered the BSIG as of 6 December 2025. In substance, the new sections build on the previous structure but were tightened: an evidence interval of three years instead of two, more precise reporting deadlines, fines of up to €10m. If your previous evidence deadline fell within twelve months of the reform taking effect, the old deadline still applies once.
What the BSIG requires of operators
Sections 30 and 31 BSIG oblige operators of critical facilities to take appropriate technical and organisational measures to the state of the art. The penetration test is the recognised instrument for the evidence under section 39 BSIG.
Appropriate protective measures
Secure systems to the state of the art (section 30(1), section 31 BSIG).
Infra, physical, AD
Regular verification
Evidence to the BSI every three years (section 39 BSIG). The report is a central document for it.
all modules
Duty to report incidents
Tiered reporting under section 32 BSIG. That requires knowing your own attack surface.
OSINT, infrastructure
Access and entry control
Server rooms, control rooms and technical areas require special protection under section 31 BSIG, and since March 2026 they are also part of the resilience plans.
Physical
Network and system security
IT/OT segmentation, firewall rules, privileged access: does the network hold up as the barrier section 30 BSIG requires?
Infrastructure
Employee awareness
Social engineering is one of the most common entry points and is also part of the measures under section 30 BSIG.
Social engineering
Why we test differently in KRITIS environments
SCADA and ICS systems are often decades old and were never built to be networked. Aggressive test methods have no place there.
Exclusion zones and no-go areas are fixed as binding before the test, together with the people responsible for your operations.
Complete logging, close coordination during the test and an immediate stop as soon as anything looks unexpected.
Attacks on critical infrastructure pursue geopolitical goals, and state actors are more active here than elsewhere. Ransomware groups have explicitly named KRITIS operators as lucrative targets.
How does a KRITIS pentest work?
1
Scoping
Scope and critical systems defined.
2
Reconnaissance
Public sources, network footprinting.
3
Execution
Manual testing, closely timed with operations.
4
Assessment
Severity and impact on operations.
5
Report
Remediation plan, evidence under section 39 BSIG.
Example findings and their section
Control room: access without badge controlsection 31 BSIG
OT network directly reachable from ITsection 30 BSIG
SCADA system with active default passwordsection 30 BSIG
VPN without MFA for remote accesssection 30 BSIG
Examples from reports, not figures from a specific client. For every finding, the report states the section, the severity and the measure we recommend.
Ready for your KRITIS evidence?
In a free 30-minute initial consultation we clarify your environment and the scope. After that you receive a fixed-price offer.
