Glossary term
KRITIS
Also: Critical Infrastructures (Germany)
Critical infrastructures under the German BSI Act and KritisV. Facilities whose failure would lead to substantial supply disruption or threats to public safety. NIS2 substantially extends KRITIS.
KRITIS spans nine sectors: energy, water, food, IT and telecommunications, health, finance and insurance, transport and traffic, media and culture, municipal waste management, state and administration. Thresholds set in the BSI KritisV.
Duties: BSI registration, appropriate technical and organisational measures by state of the art (proof every two years), immediate notification of significant IT disruptions to the BSI, KRITIS umbrella law additionally requires physical and all-hazard resilience.
In practice
Relationship with NIS2: NIS2 extends the scope beyond KRITIS but does not replace it. Many companies are both KRITIS and NIS2 entities; the KRITIS umbrella law and NIS2UmsuCG are transposed in parallel.
Related terms
NIS2
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
BSI C5
Cloud audit catalogue of the German BSI that defines minimum security baseline and transparency duties. Evidenced via an ISAE 3000 C5 attestation. De facto standard for cloud procurement in the German market.
ISO 27001
International standard for information security management systems. Current version ISO/IEC 27001:2022. Certifiable through accredited bodies. Core framework for ISMS implementation, risk treatment, continuous improvement.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.