Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Who it’s for

Complass for critical infrastructure operators

You operate a critical facility, for example in energy, water, health or transport. Stricter obligations apply to you than to other NIS2 entities, and the German KRITIS Umbrella Act adds physical resilience. Complass brings both together in one programme.

Try for free Request a demo

What also applies to you

Operators of critical facilities count as essential entities regardless of their size. In addition to the obligations of all NIS2 entities, the following apply:

Frameworks: NIS2 · KRITIS Umbrella Act · IEC 62443 · ISO 27001 · In preparation: BSI IT-Grundschutz

  • Use attack detection systems § 31 Abs. 2 BSIG§ 31 BSIG Besondere Anforderungen an die Risikomanagementmaßnahmen von Betreibern kritischer Anlagen(1) Für Betreiber kritischer Anlagen gelten für die informationstechnischen Systeme, Komponenten und Prozesse, die für die Funktionsfähigkeit der von ihnen betriebenen kritischen Anlagen maßgeblich sind, im Vergleich zu anderen informationstechnischen Systemen, Komponenten und Prozessen besonders wichtiger Einrichtungen auch über das Schutzniveau dieser Einrichtungen hinausgehende Maßnahmen nach § 30 Absatz 1 Satz 1 …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  • Prove the implementation of the measures to the BSI every three years § 39 BSIG§ 39 BSIG Nachweispflichten für Betreiber kritischer Anlagen(1) Betreiber kritischer Anlagen haben die Umsetzung der Maßnahmen in Bezug auf kritische Anlagen nach § 30 Absatz 1 Satz 1 in Verbindung mit § 31 Absatz 1 und 2 Satz 1 zu einem vom Bundesamt im Benehmen mit dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe festgelegten Zeitpunkt, frühestens drei Jahre nachdem sie erstmals oder spätestens drei Jahre nachdem sie erneut als ein Betreiber einer kritischen …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  • Physical resilience under the KRITIS Umbrella Act: registration, risk analysis, resilience plan and incident reporting §§ 8, 12, 13 and 18 KRITISDachG§ 8 KRITISDachG Registrierung kritischer Anlagen; Geltungszeitpunkt(1) Ein Betreiber kritischer Anlagen ist verpflichtet, spätestens drei Monate, nachdem eine Anlage als kritische Anlage gilt, dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe über eine gemeinsam vom Bundesamt für Sicherheit in der Informationstechnik und dem Bundesamt für Bevölkerungsschutz und Katastrophenhilfe eingerichtete Registrierungsmöglichkeit folgende Angaben zu übermitteln: - 1. den Namen des …As of: 05.10.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  • Registration, risk management and incident reporting like all NIS2 entities §§ 30, 32 and 33 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗

Not sure which frameworks apply to you? Start the applicability check

Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

Sectors

Energy suppliers and grid operators

You structure control systems, grid control technology and generation plants with zones and conduits per IEC 62443. Complass does not currently maintain requirements from the German Energy Industry Act as a framework of its own.

Water and wastewater

Capture process control and telecontrol systems, prioritise vulnerabilities and prepare your evidence for the BSI.

Hospitals

Hospitals above the thresholds are operators of critical facilities. You keep medical technology, clinical IT and building services in one shared asset inventory.

How Complass helps

Compliance management

NIS2 and the KRITIS Umbrella Act side by side: measures, documents and evidence organised for the audit under Section 39 BSIG.

More about this feature

Asset management

Critical facilities and their components in one place, with zones and conduits per IEC 62443 and end of support of the components.

More about this feature

Risk management

Assess risks from both laws in one register, with risk appetite and treatment plan.

More about this feature

Incident management

Record incidents, check reporting obligations and track the deadlines with a countdown.

More about this feature

The right package

What you need at a minimum as an operator of critical facilities

The first selection covers the obligations in Complass if they apply to you. The free applicability check shows whether they do. To the applicability check

What you need at a minimum

If you operate a critical facility: this selection covers the resulting obligations in Complass. It is preselected when you start a trial or order.

Portal size Start

  • NIS2: Risk management measures and reporting duties; you prepare notifications in incident management (included). (§§ 30, 32 BSIG (opens in a new tab))
  • KRITIS Umbrella Act: Registration, risk assessment and resilience measures for critical facilities. (§§ 8, 12, 13 KRITIS-DachG (opens in a new tab))
  • Management cockpit: Management must implement the risk management measures, monitor their implementation and attend training regularly. (§ 38 BSIG (opens in a new tab)) (included)
  • Business continuity management (BCM): Resilience plan with emergency preparedness, training and exercises; the module adds a business impact analysis and ISO 22301. (§ 13 KRITIS-DachG (opens in a new tab))
  • Incident management: included
  • GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection): included
Price of the minimum selection
ItemNet price per month
Start S€179
NIS2included
KRITIS Umbrella Act€99
Business continuity management (BCM)€79
GDPR, AI Act and Whistleblower protection (HinSchG) (baseline protection)included
Total€357 net/month

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try free for 14 days: minimum selection operator of critical facilities Order: minimum selection operator of critical facilities

Adjust the selection in the price overview: minimum selection operator of critical facilities

Recommended for more impact Offer, not a duty

Business with Supplier Management

More impact with Risk management and Supplier Management, room for 10 users and 2 frameworks.

€548 net/month, €191 more than the minimum selection.

With annual payment, 12 months minimum term. Monthly payment with a 15 % surcharge. All prices net plus VAT, as of 16 October 2026.

Try with Business: minimum selection operator of critical facilities

View in the price overview: minimum selection operator of critical facilities

Good to know: You can also meet the obligations without Complass. Complass supports you with implementation and evidence but does not replace legal advice. Legal information

Further packages

available

Framework BSI IT-Grundschutz

  • Approach according to BSI Standards 200-1 to 200-3
  • Basic, core or standard protection
  • With the identifiers of the IT-Grundschutz Compendium
  • Modelling and IT-Grundschutz check per target object with implementation plan

from €179 per month plus VAT in the Start package, size S, annual payment

View and order: BSI IT-Grundschutz

All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.

Frequently asked questions

How do critical infrastructure operators differ from other NIS2 entities?

Operators of critical facilities count as essential entities regardless of their size. In addition, they must use attack detection systems and regularly prove implementation to the BSI.

What does the KRITIS Umbrella Act add?

The KRITIS Umbrella Act concerns physical resilience, for example against natural hazards, sabotage or supply failures. It applies in Germany only. Complass maintains it as a framework of its own alongside NIS2, so you document registration, risk analysis and resilience plan in one place.

Does Complass carry out the audit under Section 39 BSIG?

No. The audit is carried out by a suitable auditing body. Complass collects measures, evidence and documents so that you can present them to the auditors and the BSI in an orderly way.

Read on

Other roles

Operators

Companies that operate IT and OT systems

Go to page

Manufacturers

Machinery, controllers, components and software

Go to page

Suppliers and service providers

Evidence for your customers in the supply chain

Go to page

All audiences at a glance

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo