Complass
German KRITIS Umbrella Act: resilience of critical facilities
A flood, an arson attack on a cable, a power cut lasting days: since March 2026 the German KRITIS Umbrella Act has required operators of critical facilities to plan for all hazards, not only cyber attacks. What applies, what is still missing and how to start now.
The German KRITIS Umbrella Act (KRITIS-Dachgesetz) has applied since 17 March 2026 and transposes the CER Directive (EU) 2022/2557 in Germany. It requires operators of critical facilities in ten sectors to strengthen their physical resilience against all hazards: from natural events and accidents through sabotage and terrorism to supply chain failures.
The whitepaper explains who is in scope and what is still open while the ordinance with the thresholds is missing, and walks through registration, risk analysis, resilience measures and the resilience plan, incident reporting, evidence and fines. A separate chapter sets the act apart from the German BSI Act (NIS2), followed by a 10-step plan and a checklist.
Each obligation chapter includes a short "Implementation in Complass" box with a platform screenshot: only features already live are named.
16 pages · Version 1.0 · as of 06.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.