eco On The German Cabinet Approval of KRITIS Act: Act Swiftly, Avoid Duplication

Today, the German Federal Cabinet approved the draft bill for the German KRITIS Umbrella Act (KRITIS DG), paving the way for further parliamentary proceedings. For the first time, uniform nationwide requirements for the physical protection of critical infrastructure will be created and the European CER Directive (Critical Entities Resilience Directive) will be transposed into German law.

The industry association eco – Association of the Internet Industry welcomes the swift legislation in view of geopolitical turmoil and the EU’s ongoing infringement proceedings. However, it sees considerable areas for improvement: a lack of legal regulations, the threat of overlap with the NIS2 implementation law, and unclear responsibilities between the federal government, the states, and the German Federal Office for Civil Protection and Disaster Assistance (BBK) and the German Federal Office for Information Security (BSI).

“Urgency is necessary, but there must be no duplication of obligations for companies,” emphasises Ulrich Plate, head of eco’s Critical Infrastructure Competence Group. The association also takes a critical view of the proposed sanction mechanisms, which it considers to be too vague at this stage. Instead, eco calls for a transparent, tiered model that first allows for improvements to be made and only then imposes sanctions.

The association positively highlights that the law creates a uniform framework for the protection of critical infrastructures – beyond cyber security, also against physical threats such as natural disasters, sabotage or terrorism.

Three points are now crucial for the further debate:

• Regulatory ordinance on critical services and thresholds so that companies can clearly assess their obligations.
• Harmonisation with NIS 2 to avoid double regulation in risk analyses, audits and reporting obligations.
• Clear division of roles between the federal government, the states, the BBK and the BSI to prevent operational problems.

‘The KRITIS Umbrella Act is an important step towards greater resilience in Germany. However, it will only be effective if responsibilities are clearly defined and unnecessary duplication of work is avoided,” Plate sums up.