KRITIS · NIS-2 · CRA
Resilience is mandatory – physical and digital
For operators of critical facilities it is no longer enough for a retention basin to work technically. The facility must be protected against extreme weather, its condition must be monitored and incidents must be reported on time and verifiably.
Updated:
The three frameworks
What applies to operators now
KRITIS umbrella act
Implements EU Directive 2022/2557 (CER). Protects critical facilities against physical risks such as extreme weather and sabotage. Registration with the BBK within three months of designation as a critical facility, risk analysis after nine and resilience measures after ten months. The chain of deadlines only starts with the pending ordinance – postponed, not cancelled.
NIS-2 (BSIG)
Cybersecurity for essential and important entities, in force since 6 December 2025. Risk management, registration with the BSI, reporting duties with 24/72-hour deadlines and personal responsibility of management (Section 38 BSIG).
Cyber Resilience Act (CRA)
EU Regulation 2024/2847 for products with digital elements – including sensors and monitoring software. Reporting of actively exploited vulnerabilities and severe security incidents since 11 September 2026, all requirements from 11 December 2027.
Responsibility
Duties of management
Responsibility for resilience and cybersecurity can no longer be fully delegated.
- 01
Implement and supervise
Management must implement or approve the risk-management measures and supervise their implementation (Section 38 BSIG, Section 20 KRITIS-DachG).
- 02
Train regularly
Under Section 38(3) BSIG, management must attend training regularly in order to identify and assess risks. The law does not specify a fixed interval.
- 03
Liability
In the event of culpable breaches of duty, managers are liable to their entity under company-law rules. Traceable documentation of one's own diligence therefore gains importance.
- 04
Fines
BSIG: up to €10 million or 2% of worldwide annual turnover (essential entities), up to €7 million or 1.4% (important entities). KRITIS umbrella act: up to €1 million.
Reporting duties
Report – fast and verifiably
| 24 hours | Early warning to the BSI (NIS-2) or initial report to the BBK (KRITIS-DachG) |
|---|---|
| 72 hours | Notification with initial assessment of severity and impact (NIS-2) |
| 1 month | Final or detailed report with causes and measures |
Why the data basis matters
Reports must be based on reliable information and be traceable during audits or official inspections. Data leading to a report – sensor values, logs, timestamps – should therefore be stored so that subsequent changes become apparent.
Proven methods are cryptographic checksums (e.g. SHA-256), chained logs, write-once storage and digital signatures. The JUMBO BLOCK Dashboard uses chained audit logs and anchors integrity proofs on the IOTA mainnet.
The solution
What JUMBO BLOCK contributes
Physical resilience
Large-volume, heavy-duty retention right where the rain falls. Runoff peaks are buffered, sewers relieved, operational areas and utility lines protected from flooding – designed for 80–120 years.
Digital verifiability
The JUMBO BLOCK Dashboard monitors fill levels and sensors in real time, records events in a chained audit trail and anchors integrity proofs on the IOTA mainnet. Live since November 2025.
Tools for emergencies
The Engineering Suite contains tools for crisis teams and reporting: situation log, reporting-deadline assistant, checksums, encryption, certificates and inventory – usable offline, even from a USB stick.
In comparison
Why a walk-in structure
Unlike inaccessible plastic retention systems, JUMBO BLOCK is a full-scale walk-in structure. Operating staff can reach all areas directly; sediment can be removed mechanically for decades. Sensors can be retrofitted and maintained.
- Heavy-duty to LM1 and trafficable immediately after installation
- Corridors for water, power and fibre-optic lines
- Can be relocated and extended without destruction
- Precast construction: much shorter build time than cast-in-place concrete, no on-site curing
Note: this page summarises the legal situation as of 29 October 2026 and does not constitute legal advice. The legal texts and the requirements of the BSI and BBK are authoritative.
FAQ
Frequently asked questions
Is JUMBO BLOCK KRITIS-ready?
Yes. The system combines physical protection against heavy rain and flooding with digital monitoring and tamper-evident documentation. It supports operators with risk analysis, resilience measures and evidence. Whether a facility meets its legal obligations always depends on the operator's overall concept.
Since when does NIS-2 apply in Germany?
The German act implementing the NIS-2 Directive entered into force on 6 December 2025. The obligations are set out in the revised BSI Act (BSIG).
What does the German KRITIS umbrella act regulate?
The KRITIS-Dachgesetz implements EU Directive 2022/2557 (CER) and requires operators of critical facilities to implement physical resilience measures, risk analyses, resilience plans and incident reports to the BBK. It has applied since March 2026; the ordinance designating critical facilities is still pending.
Which incident reporting deadlines apply?
Under NIS-2: early warning to the BSI within 24 hours, incident notification within 72 hours, final report after one month. Under the KRITIS umbrella act: report to the BBK without delay and within 24 hours at the latest, detailed report after one month.
What fines apply?
Under the BSIG up to €10 million or 2% of worldwide annual turnover for essential entities and up to €7 million or 1.4% for important entities. The KRITIS umbrella act provides for fines of up to €1 million.
Read on
Dashboard & IoT
Real-time monitoring and tamper-evident documentation.
Municipalities
Heavy-rain preparedness for municipalities.
Industry & commerce
Site protection and business continuity.