The BSI Act defines nine critical sectors. Operators of essential facilities above defined thresholds are required to undergo regular security reviews.
Paragraph 8a BSIG requires KRITIS operators to implement appropriate technical and organisational measures. A penetration test is the recognised instrument for providing this evidence.
KRITIS operators must secure their systems according to the state of the art. A pentest demonstrates that this requirement is taken seriously.
Security measures must be demonstrated to the BSI every two years. A pentest report is a central piece of evidence for this.
To correctly classify and report incidents, the attack surface must be known. A pentest creates this transparency.
Physical access to server rooms, control rooms, and technical areas requires special protection. We test whether your access controls hold up.
IT/OT segmentation, firewall configurations, privileged accounts: we test whether your network is a real barrier.
Social engineering is one of the most common entry points. We test how well your staff recognise and deflect manipulation attempts.
KRITIS pentests require special care: clear scope definitions, close coordination with operations, and complete documentation for BSI evidence.
Joint definition of the test scope with explicit consideration of operationally critical systems. Exclusion zones and no-go areas are binding.
Information gathering from public sources, network footprinting, and planning of realistic attack paths against your environment.
Manual testing within the agreed scope. We work closely with your operations team and communicate critical findings immediately.
Assessment of each finding by technical severity and operational business impact - with focus on the specific characteristics of your KRITIS environment.
Complete documentation of all findings with recommendations, management summary, and BSI evidence documentation per Paragraph 8a BSIG.
KRITIS environments have special requirements. These three modules cover the most critical attack vectors and deliver the strongest BSI evidence.
Control rooms, server rooms, technical areas: physical access is often the underestimated attack vector for KRITIS operators. We test whether your access controls hold up.
Learn moreIT/OT segmentation, SCADA access, firewall configurations, privileged accounts: we test the network holistically with particular care for operationally critical systems.
Learn morePrivilege escalation, lateral movement, weak accounts: a compromised AD in a KRITIS environment can have catastrophic consequences.
Learn more
Think like an Attacker, Act as a Partner