Recommended Measures (To-Dos):

• Registration with BSI / BBK: Registration as a critical infrastructure operator with the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) is legally required.
• IT Security according to § 8a BSIG: Proof of the "state of the art" through certifications (e.g., ISO 27001 or BSI IT-Grundschutz). Recurring audits every two years by recognized auditors.
• Physical Protection (KRITIS-DachG): Mandatory risk analysis and resilience plan to protect against physical threats (sabotage, attacks). Perimeter protection, access control, and audit trails are mandatory.
• Reporting obligation for security incidents: Significant security incidents must be reported to the BSI immediately (within 24 hours) and no later than 72 hours after becoming known.
• Supply chain security: Auditing and securing your own supply chain (suppliers, service providers) for security risks.

dormakaba Recommendation: As a leading provider of physical security solutions, dormakaba supports you in meeting the legal requirements of the KRITIS Umbrella Act (KRITIS-DachG): perimeter protection, access and identity management, tamper-proof audit trails, and certified high-security systems.

Recommended Measures (To-Dos):

• Cyber Security Risk Management: Mandatory risk management measures to secure network and information systems (Art. 21 NIS-2). This includes authentication, encryption, and access controls.
• Management Liability: The management is personally liable for the implementation of the cyber security measures and must provide proof of training (Art. 20 NIS-2).
• Reporting obligation for security incidents: Significant disruptions must be reported to the BSI within 24 hours (early warning) and 72 hours (full report).
• Supply Chain Security: You must also consider the cyber security of your direct suppliers and service providers and secure it contractually.
• Physical Access Control: No physical resilience plan according to KRITIS-DachG is required, but securing access to sensitive areas (server rooms, switchgear) is part of the technical measures according to NIS-2.

dormakaba Recommendation: Even without the KRITIS-DachG obligation, NIS-2 measures require the physical protection of sensitive IT areas. dormakaba offers access-secured server room solutions, identity management, and audit trails that support your compliance documentation

Recommended Measures (To-Dos):

• Recommendation: BSI IT-Grundschutz: Even without a legal obligation, it is advisable to follow the BSI IT-Grundschutz compendium to minimize operational downtime and fend off cyberattacks.
• Annual re-evaluation: Thresholds and regulatory requirements can change. Re-evaluate your status annually or in the event of significant company changes.
• Voluntary measures: Investments in physical security and access control increase operational security and can serve as proof in the event of a future regulatory obligation.

dormakaba Recommendation: Even without a legal obligation, a robust physical security infrastructure pays off. dormakaba offers scalable solutions that grow with your requirements