COMPLIANCE · KRITIS
KRITIS demandsbiennial proofof state of the art.
Operators of critical infrastructure must demonstrate every two years – under §8a BSI-Gesetz – that their security measures meet the state of the art. We deliver the technical evidence that auditors and the BSI accept.
01 · SCOPE
Who is in scope – and why §8a does not disappear with NIS-2.
KRITIS covers operators of critical infrastructure across energy, water, food, IT and telecommunications, finance and insurance, transport, health, municipal waste disposal, as well as state and administration. The BSI-Kritisverordnung defines the thresholds that trigger the §8a obligations. NIS-2 widens the regulatory landscape, but §8a evidence remains the established mechanism through which the BSI verifies the state of the art – and continues to drive the audit cadence in many sectors.
02 · OBLIGATIONS
What §8a actually requires from operators.
- BLOCK · 01
State of the art every two years
§8a Abs. 3 BSIG requires operators to provide evidence at least every two years that organisational and technical precautions reflect the state of the art. The §8a-Nachweis is the formal artefact submitted to the BSI through a prüfende Stelle.
- BLOCK · 02
Attack detection (§8a Abs. 1a BSIG)
Since the IT-Sicherheitsgesetz 2.0, operators must run systems for attack detection. We test detection coverage against realistic attack paths and document where signals are missing or unreliable.
- BLOCK · 03
B3S sector standards
Where Branchenspezifische Sicherheitsstandards exist, they specify the controls. We map our test scope to the relevant B3S so the §8a-Nachweis can reference it directly.
- BLOCK · 04
Incident reporting under §8b BSIG
Significant ICT disruptions must be reported to the BSI. We support the technical analysis required for accurate, timely notification – and prepare the forensic baseline to back it up.
03 · OUR CONTRIBUTION
How we feed the §8a-Nachweis.
The §8a-Nachweis stands or falls on the quality of the underlying evidence. We test the relevant attack paths against operational and IT systems, map findings to B3S or sector-specific control catalogues and deliver retest results that close the loop. The output integrates directly into the document body the prüfende Stelle submits to the BSI.
§8A PREPARATION
The next §8a deadline arrives faster than you think.
We review with you the open findings from your last §8a-Nachweis, the gap to the current state of the art and the test scope for the upcoming submission.