Who it’s for
You generate, distribute or supply electricity, gas, heat or hydrogen, operate storage facilities or charging points. Energy is a core sector of NIS2 and of the German KRITIS Umbrella Act, and your control systems need security concepts of their own. Complass combines information security, OT security and physical resilience in one programme.
Network control centres, telecontrol systems and protection devices often run for many years without updates. Remote access by service providers enlarges the attack surface.
The BSI Act, the Energy Industry Act and the KRITIS Umbrella Act interlock. Which requirements apply to which plant depends on your activity and the thresholds.
An outage hits households, hospitals and industry. Contingency plans, exercises and reporting channels must be in place before things get serious.
Energy companies are listed in Annex 1 of the German BSI Act. From medium size you are an important entity; from 250 employees or more than EUR 50 million turnover and EUR 43 million balance sheet total, and as the operator of a critical facility, an essential entity.
Frameworks: NIS2 · EnWG (In preparation) · KRITIS Umbrella Act · IEC 62443 · ISO 27001 · In preparation: BSI IT-Grundschutz
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Electricity, gas, heat and often water under one roof, with network control centre and many outstations.
Power plants, wind and solar parks, battery storage and direct marketers with remote control.
Sales, trading and pooling of flexibility: information security and incident reporting under the BSI Act.
Charging infrastructure with backend and remote maintenance, within the scope of NIS2 from medium size.
Maintain measures, documents and evidence once and use them for several frameworks, organised for audits and inspections.
More about this featureCapture control systems, telecontrol components and the network without agents, divide them into zones and conduits per IEC 62443-3-2 and keep an eye on end of support.
More about this featureBusiness impact analysis, contingency plans and the resilience plan under the KRITIS Umbrella Act with template and exercise programme.
More about this featureCheck reporting obligations under NIS2 and track the deadlines with a countdown; for the KRITIS Umbrella Act with a reporting template of its own.
More about this feature
For control systems the industry template with IEC 62443 and asset management is a good fit. The KRITIS Umbrella Act adds physical resilience.
available
from €526 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
That depends on your activity. Operators of energy supply networks and energy plants that are subject to the IT security requirements of the Energy Industry Act are exempt from most duties of the BSI Act (Section 28(5) BSIG). For other activities, such as sales or charging points, the BSI Act applies. The applicability check helps you classify your company.
It concerns the physical resilience of critical facilities, for example against natural hazards, sabotage or supplier failures. This includes registration, a risk analysis of your own, resilience measures with a resilience plan and the reporting of incidents.
The series of standards is the widely used framework for the security of industrial automation and control systems. For operators, the security programme, the division into zones and conduits and the system requirements are the most important parts. Complass guides you through these steps.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
