KRITIS-Dachgesetz (KRITISDachG) — Audit-Readiness Rubric
Sourcing confidence note (read before use): all statute quotes below come from an automated fetch-and-summarize pass over the official German legal text repository (gesetze-im-internet.de), not a manual line-by-line read — they are labeled "near-verbatim (auto-extracted)" rather than certified-verbatim throughout. Article/paragraph numbers are corroborated by multiple independent secondary legal-analysis sources and are high-confidence; exact wording and some penalty-figure-to-violation mappings are not. The sector-specific thresholds ordinance (KRITIS-VO) was still in public consultation (comment period closed 16 June 2026) as of the sources fetched this session, with finalization status unconfirmed. See "Gaps / follow-ups" at the end for the full honest list.
What this is
The KRITIS-Dachgesetz ("KRITIS Umbrella Act" / KRITISDachG — full title: Gesetz über die Widerstandsfähigkeit kritischer Anlagen) is a German federal law creating a cross-sectoral framework for the physical and organizational resilience of critical infrastructure operators. Passed by the Bundestag 29 January 2026, published in the Federal Law Gazette 16 March 2026, entered into force 17 March 2026.
KRITISDachG implements the EU Critical Entities Resilience (CER) Directive (EU) 2022/2557 into German law. It is deliberately scoped to physical, operational, all-hazards resilience (natural disasters, technical failure, sabotage, terrorism, pandemics, supply disruption) — it does not cover cybersecurity, which remains governed by the BSI-Gesetz (BSIG) as amended by Germany's NIS2 Implementation Act (NIS2UmsG, in force 6 December 2025). Regscribe's companion docs/nis2-rubric.md covers that cyber side; the two are not duplicated — this rubric stays confined to physical/organizational resilience, BBK registration, and the § 18 incident-reporting regime.
Scope, confirmed: KRITISDachG is a general cross-sector German critical-infrastructure law — ten sectors in total (energy, transport, finance, social insurance, healthcare, water, food, IT/telecom, space, municipal waste disposal), not an oil-and-gas-specific regime. Healthcare ("Gesundheitswesen") is one of the ten and explicitly reaches hospitals above an inpatient-case threshold, pharmaceutical manufacturers, and blood/tissue institutions — directly relevant to Regscribe's pharma/biotech customer base wherever they operate qualifying facilities in Germany. Operators designated critical under KRITISDachG are also automatically classified as "particularly important entities" (besonders wichtige Einrichtungen) under the revised BSIG — same operator, two attached regimes (physical vs. cyber).
This document is for companies assessing their own KRITISDachG compliance readiness, and for auditors/consultants using Regscribe to score evidence against it.
Sourcing note
Primary source fetched: https://www.gesetze-im-internet.de/kritisdachg/BJNR0420B0026.html (official German government legal text repository), via automated fetch-and-summarize — quotes below are labeled "near-verbatim (auto-extracted)", not certified-verbatim.
Secondary sources fetched and used for cross-checking/paraphrase/figures:
- Baker Tilly — "Strengthening the resilience of critical infrastructures... KRITIS umbrella law" (
bakertilly.de) - Allen & Overy Shearman — "New German critical infrastructure law: Practical impact" (
aoshearman.com) - Freshfields — "Is your company critical? Prepare for Germany's new KRITIS Umbrella Act!" (
freshfields.com) - D3 Security — "KRITIS-Dachgesetz Compliance for the Autonomous AI SOC" (
d3security.com) - ad-hoc-news.de — two wire pieces on the 17 July 2026 registration deadline and ~1,300 affected operators
- Pharma Deutschland (industry association) — news item on the draft sector-specific ordinance, confirming pharma-manufacturer thresholds and consultation status
- German Wikipedia (Kritis-Dachgesetz) — legislative-history corroboration only (dates), not legal substance
Each rubric row is labeled near-verbatim (primary), paraphrased (primary), or secondary-sourced (name). Nothing in this document is fabricated — every citation, article number, and figure was returned by an actual search/fetch this session; anything not confirmed is flagged explicitly rather than guessed.
Rubric
1. Scope, Designation & Sectors (§§ 1–6)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| A "critical facility" (kritische Anlage) is one "material to the provision of a critical service" — "eine Anlage, die für die Erbringung einer kritischen Dienstleistung erheblich ist" | § 2 Nr. 3 KRITISDachG — near-verbatim (primary) | Documented, dated, version-controlled criticality assessment mapping company facilities/assets to the services they support | "Critical infrastructure" treated as an informal label rather than the formal statutory test being run against actual facilities — no documented in/out-of-scope basis |
| Ten sectors in scope, including Gesundheitswesen (healthcare): energy, transport, finance, social insurance, healthcare, water, food, IT/telecom, space, municipal waste disposal | § 4 Abs. 1 KRITISDachG — near-verbatim (primary); list cross-confirmed secondary-sourced (Freshfields, A&O Shearman) | Sector classification memo identifying which of the 10 sectors the company's German operations fall under, with legal sign-off | Multinational pharma group assumes "KRITIS = energy/water utilities" and never evaluates German manufacturing/hospital-adjacent operations against the healthcare-sector definition |
| Healthcare sector specifically includes hospitals above the inpatient-case threshold, pharmaceutical manufacturers, and blood/tissue institutions | Secondary-sourced (D3 Security); general inclusion corroborated by Freshfields, A&O Shearman | Evidence the company evaluated whether API/finished-dose manufacturing sites, distribution operations, or affiliated hospital/lab entities meet the healthcare-sector inclusion criteria | Pharma manufacturer assumes only "hospitals" are covered under "healthcare" and never assesses its own manufacturing/distribution facilities |
| Designation criteria: general illustrative threshold of 500,000 persons served; sector-specific thresholds (e.g. pharma packages/year) set by a separate ordinance | § 5 Abs. 2 KRITISDachG (general threshold) — near-verbatim (primary); pharma threshold of 4,650,000 prescription-drug packages/year and medical-device threshold of €90,680,000 annual turnover — secondary-sourced (Pharma Deutschland, draft KRITIS-Verordnung), not yet confirmed final | Threshold calculation worksheet against actual company figures, refreshed annually | Threshold calculation run once at go-live, never re-run as volume/revenue grows past the trigger point |
2. Registration (§ 8)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| Registration with the competent federal authority no later than three months after a facility qualifies as critical — "spätestens drei Monate, nachdem eine Anlage als kritische Anlage gilt" | § 8 Abs. 1 KRITISDachG — near-verbatim (primary) | Registration confirmation/timestamp from the BBK/BSI joint platform within the 3-month window from the qualification-triggering event | Headline 17 July 2026 date treated as a one-time deadline; the rolling 3-month clock for later-qualifying facilities (e.g. after a capacity expansion) is missed |
| Registration on the joint platform run by BBK (Bundesamt für Bevölkerungsschutz und Katastrophenhilfe) and BSI; required data includes operator name, legal form, commercial register number, address, contact point, sector, critical-component details | Paraphrased (primary, § 8); secondary-sourced (A&O Shearman, Baker Tilly) | Completed registration record plus a named, documented "central contact point" (§ 8(1) No. 6) | "Central contact point" fulfilled with a generic mailbox/unstaffed function, which fails the incident-reporting reachability test in practice |
| First hard registration window: pre-existing critical operators must register by 17 July 2026; ~1,300 operators nationally estimated affected in this first wave | Secondary-sourced (ad-hoc-news.de, corroborated by CMS, technologyslegaledge.com) | Registration timestamp on/before 17 July 2026, retained as an artifact | Registration done but no retained proof-of-submission artifact kept for audit purposes |
3. Risk Analysis (§ 12)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| Risk analysis and assessment at least every four years, or more often if necessary — "mindestens alle vier Jahre, eine Risikoanalyse und Risikobewertung" | § 12 Abs. 1 KRITISDachG — near-verbatim (primary) | Dated risk analysis report with version history showing a ≤4-year refresh cadence, signed off by an accountable owner | Risk analysis performed once at registration, never refreshed — the 4-year clock not tracked as a recurring obligation with an owner/due date |
| Must consider natural and man-made hazards, published national/sectoral risk assessments, and cross-sector interdependency risk | Paraphrased (primary, § 12); secondary-sourced (A&O Shearman) | Risk register covering natural hazards, technical failure, human/malicious action, and named cross-sector dependencies (power, water, IT feeding the facility) | Risk analysis addresses only internal operational hazards, omits dependency risk on external critical services feeding the facility |
4. Resilience Plan (§§ 13–17)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| Resilience measures must be documented in a resilience plan (Resilienzplan) — "Der Betreiber kritischer Anlagen muss die Maßnahmen nach Absatz 1 in einem Resilienzplan darstellen" | § 13 Abs. 4 KRITISDachG — near-verbatim (primary) | Standalone, current resilience plan document (not scattered across SOPs), mapped to the risk analysis findings that justify each measure | Resilience measures exist operationally (generators, access control) but are never consolidated into a single documented plan reviewable against § 13 |
| Measures must be "appropriate and proportionate," state-of-the-art, covering the full lifecycle: prevention/protection, detection, response, recovery/continuity | Paraphrased (primary, § 13); secondary-sourced (A&O Shearman) | Plan structured across all four lifecycle phases with named owners and tested procedures each — not just preventive controls | Plan front-loaded with physical prevention (fencing, badges); no documented detection, response, or recovery/continuity procedures |
| Plan must be updated following each risk-assessment cycle and after material incidents | Paraphrased (primary, §§ 12–13) | Version history showing updates triggered by risk-assessment refreshes or post-incident reviews, not just calendar edits | Plan updated on an arbitrary annual schedule disconnected from actual risk-assessment/incident timeline |
| Documentation must "enable evidence of compliance" for supervisory review; senior management bears responsibility for implementation and oversight | § 16 Abs. 2 KRITISDachG — paraphrased (primary); management-responsibility point secondary-sourced (A&O Shearman) | Named management-level owner (not just operational staff), evidenced by governance minutes, sign-off, or charter | Plan owned entirely by facility-security/EHS manager with no documented senior-management accountability |
5. Incident Reporting (§ 18)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| Initial notification of a significant incident "without delay, no later than 24 hours" after becoming aware — "unverzüglich, spätestens 24 Stunden nach Kenntnis" — to the joint reporting office (gemeinsame Meldestelle) | § 18 Abs. 1 Satz 1 KRITISDachG — near-verbatim (primary), corroborated secondary-sourced (A&O Shearman, D3 Security) | Incident log with "time of awareness" vs. "time of initial notification" fields, and a documented internal escalation SOP capable of meeting the 24-hour clock | Internal escalation chain (site → country → global) structurally exceeds 24 hours end-to-end; no fast-track path for KRITIS-reportable events |
| Detailed/final report due within one month of the incident — "spätestens einen Monat" | § 18 Abs. 1 Satz 3 KRITISDachG — near-verbatim (primary) | Closed-loop incident file with the final report filed within the one-month window, cross-referenced to the initial notification | Ownership transfers from crisis-response to a follow-up function without a tracked deadline; final report slips |
| Cross-border notification triggered where an incident significantly impacts six or more EU Member States | Paraphrased (primary, § 18); "six" figure secondary-sourced, not independently re-verified against enacted text this session | Documented cross-border impact assessment for any reportable incident, even if the conclusion is "not applicable" | Multinational operator reports only to German authorities, never assesses cross-border CER-driven notification obligations |
6. Oversight, Audits & Penalties (§§ 16, 20, 24)
| Requirement | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|
| Operators must produce audit results/compliance evidence on request: risk assessments, action plans, test/exercise reports, training records | § 16 KRITISDachG — paraphrased (primary); documentation list secondary-sourced (Baker Tilly) | Centrally indexed, retrievable set: risk assessment reports, resilience plan versions, emergency-scenario test results, staff training certificates | Evidence exists somewhere but isn't centrally indexed — a retrievability failure, not a substance failure |
| Failure to submit audit results on request: fine up to €500,000 | § 16 Abs. 3 / § 24 KRITISDachG — near-verbatim citation (primary), figure corroborated secondary-sourced (ad-hoc-news.de) | N/A — penalty provision; evidence is the underlying audit-evidence-production capability above | — |
| Breach of registration orders under § 8 Abs. 2: fine up to €1,000,000 (reportedly raised from €500,000 in the government draft to €1,000,000 as enacted) | § 24 KRITISDachG (referencing § 8 Abs. 2) — near-verbatim citation (primary), figure secondary-sourced (ad-hoc-news.de) | N/A — penalty provision | — |
| Other registration/reporting/documentation/access violations carry administrative fines varying by provision (a lower ~€100,000 tier reported for certain registration lapses) | § 24 Abs. 1 KRITISDachG — paraphrased (primary); tiered figures secondary-sourced, sources not fully reconciled — see Gaps | N/A — penalty provision | — |
| Management/senior leadership can face personal liability under general corporate-law principles referenced by the Act | § 20 Abs. 1–2 KRITISDachG — paraphrased (primary), secondary-sourced (A&O Shearman) | Governance record showing management-level sign-off and active oversight (ties to § 16 Abs. 2 evidence above) | KRITISDachG treated as a facilities/security-team matter with no board/C-suite visibility — no evidence of the management oversight the liability provision assumes |
Common failure patterns (cross-cutting)
- Scope-determination gap. Companies assume KRITIS-style regulation is utilities/energy-only and never run the formal sector + threshold test against German pharma manufacturing, distribution, or hospital-adjacent operations.
- One-time compliance, not a recurring program. Risk analysis (4-year cycle), resilience-plan updates, and the rolling 3-month registration trigger are treated as one-off projects rather than owned, recurring obligations.
- Prevention-heavy, response-light resilience plans. Physical prevention is well documented; detection, response, recovery/continuity are thin or missing.
- Documentation exists but isn't retrievable. Evidence exists somewhere in the organization but isn't centrally indexed for rapid production on regulator request — carries its own penalty exposure (§ 16 Abs. 3).
- Reporting-clock structural failure. Multinational escalation chains structurally can't meet the 24-hour initial-notification requirement; one-month final-report ownership isn't clearly assigned.
- No management-level ownership. Resilience programs owned by facility-security/EHS with no documented senior-management sign-off — weakens § 16/§ 20 audit evidence and leaves personal liability exposure unaddressed.
- Central contact point is a mailbox, not a person. Registration's "central contact point" fulfilled with a generic distribution list rather than a reachable, accountable individual.
Gaps / follow-ups before this goes into production scoring
- Sector-specific thresholds ordinance (KRITIS-VO) not confirmed final. Consultation closed 16 June 2026 per the Pharma Deutschland source fetched this session; given today's date (2026-08-17) it may since be finalized, but this was not independently re-verified. Confirm the ordinance's final in-force text — and whether the 4,650,000 packages/year and €90,680,000 turnover figures changed — before scoring real evidence against exact thresholds.
- Penalty figures not fully reconciled across sources. €500,000 (audit/reporting-evidence failures) and €1,000,000 (registration-order breaches) are corroborated, but exact figure-to-violation mapping differs slightly between the auto-extracted primary source and secondary reporting. Recommend a manual read of § 24 before using this table to score penalty exposure precisely.
- No verbatim, manually-verified German statute text obtained this session — all primary quotes came from an automated fetch-and-summarize pass, not a manual line-by-line read. Article/paragraph numbers are high-confidence (multi-source corroborated); exact wording should be re-confirmed against the official Bundesgesetzblatt text before being cited as verbatim statutory language in a customer-facing report.
- Cross-border (six-Member-State) notification trigger not independently confirmed against primary text this session — consistent with the general CER Directive framework in secondary commentary, but the specific figure for KRITISDachG itself should be checked against the enacted text.
- Hospital inpatient-case threshold (reported elsewhere as ~30,000 inpatient cases/year under the existing BSI-KritisV Annex 5) came from a general web search result, not a direct authoritative fetch, and was not cross-checked against the new KRITIS-VO draft for healthcare. Confirm before using in scoring.
- No pharma/healthcare-specific exemptions found — absence of evidence is not confirmation of absence; treat as "not found," not "confirmed there are none."
- Relationship to NIS2/BSIG described directionally only (physical vs. cyber, same operators often dual-regulated) — the precise mechanics of how a KRITISDachG-critical designation triggers "particularly important entity" status under BSIG were not traced to a specific BSIG article this session.
docs/nis2-rubric.mdindependently verifies and owns that citation rather than relying on this document's characterization. - BBK/BSI joint registration platform's practical process (forms, attachments, confirmation format) described only at summary level — sufficient to score "did the company register," not detailed enough to score submission completeness/quality. Further research needed if field-level registration scoring is wanted.