Critical infrastructure:
evidence, threat detection and crisis communication for KRITIS operators in Germany
What do German KRITIS operators have to do today?
The IT obligations are set out in the German BSI Act (BSIG) as amended on 6 December 2025. Operators of critical facilities register with the BSI (Section 33), implement the minimum measures of Section 30, report significant security incidents in three stages: within 24 hours, within 72 hours and after one month (Section 32), and prove their implementation to the BSI (Section 39).
The KRITIS umbrella act (KRITIS-Dachgesetz) adds to this but mainly covers physical resilience. There is currently no registration duty under it: according to the Federal Office of Civil Protection and Disaster Assistance (BBK), the ordinance that defines critical facilities is still being drafted and coordinated (BBK, FAQ on the KRITIS umbrella act, in German). Risk analysis and resilience measures fall due for the first time nine and ten months after registration. For the details of the BSI Act, see our page on the NIS2 Directive.
How do you prove the state of your mobile devices?
With data from day-to-day operations rather than spot checks. ISEC7 SPHERE provides cross-vendor monitoring and management for UEM environments, including setups where several UEM systems run side by side, and shows the patch status and known vulnerabilities of your devices.
If ISEC7 runs your mobile environment as a managed service, you receive reports on operations, patch status and incidents that feed into your evidence. This does not outsource your obligations under the BSI Act; they stay with your organization. If you want BlackBerry UEM from the cloud without access by the vendor or third parties, the Sovereign Cloud that ISEC7 hosts and runs in Germany covers that. More on ISEC7 SPHERE
Who detects attacks if you don't run your own SOC?
An external security operations center that watches your systems around the clock. According to the BSI, the biggest gap that its evidence reviews under Section 39 BSIG reveal among operators is in attack detection systems (BSI-Magazin 2026/01 and BSI monthly report for July 2026).
ISEC7 delivers managed detection and response with a 24/7/365 SOC through its partner Arctic Wolf. Arctic Wolf runs the SOC, in Frankfurt according to the company, assesses alerts and reports confirmed incidents with recommended actions. ISEC7 connects your mobile estate to detection. You implement the recommendations yourself, or we do: patches, configurations and policies in the UEM. Whether an incident is significant and must be reported is your organization's decision. More on endpoint security
How does a crisis team make encrypted calls?
Section 30(2), second sentence, no. 10 BSIG lists among the minimum measures secured voice, video and text communication and, where appropriate, secured emergency communication systems within the organization. For calls on smartphones, ISEC7 runs ISEC7 MANAGED SECURE VOICE, a managed service for encrypted mobile calling on Apple and Samsung devices.
The service is built on Secusmart's SecuVOICE app. The SecuVOICE app holds a BSI operating permission (Einsatzerlaubnis) up to VS-NfD, the lowest German classification level, BSI-VSA-11057 (SecuVOICE for iOS and Android, version 6.x), valid until 31 August 2027. Secusmart makes the app, ISEC7 runs the service. Calls between SecuVOICE users are end-to-end encrypted; calls to any other number (breakout) are encrypted only as far as the federal infrastructure. Classified content therefore does not belong in breakout calls.
Because the service uses German federal cryptographic material, we provide it only to German companies and public authorities. Subscriptions start at 25 users. Register details per BSI list 7164, checked on 8 October 2026. More on ISEC7 MANAGED SECURE VOICE
Frequently asked questions on critical infrastructure in Germany
Do I already have to register under the German KRITIS umbrella act?
No, not at the moment. According to the Federal Office of Civil Protection and Disaster Assistance, there is no registration duty under the KRITIS umbrella act yet, because the ordinance that defines critical facilities is still being drafted and coordinated. Risk analysis and resilience measures fall due for the first time nine and ten months after registration. Registration with the BSI under Section 33 of the BSI Act is a separate matter.
What is the difference between the KRITIS umbrella act and the BSI Act?
The BSI Act governs IT security: risk management, reporting duties and evidence to the BSI. The KRITIS umbrella act mainly governs the physical resilience of critical facilities. An operator can fall under both laws, but their obligations and deadlines run separately.
What does Section 30 of the BSI Act require for communication?
Section 30(2), second sentence, no. 10 requires the use of multi-factor or continuous authentication, secured voice, video and text communication and, where appropriate, secured emergency communication systems within the organization. Which solution is appropriate is assessed by the organization based on its risk exposure, size and implementation costs.
Can I outsource my obligations under the BSI Act to a service provider?
No. A provider can take over operations, monitoring and reporting, but the obligations stay with your organization. Under Section 38 of the BSI Act, management is responsible for implementing the risk management measures, and reporting significant incidents remains the organization's task.
How quickly does a significant security incident have to be reported in Germany?
Under Section 32 of the BSI Act, in three stages: an early warning within 24 hours of becoming aware, a notification within 72 hours with an initial assessment including severity and indicators of compromise, and a final report after one month. For the 72-hour notification you therefore need log data that has already been analyzed.
Who runs the SOC if I buy managed detection and response through ISEC7?
Arctic Wolf. According to the company, Arctic Wolf runs the security operations center in Frankfurt, which opened in November 2021. ISEC7 connects your mobile estate to detection and, if you wish, fixes the vulnerabilities found in your systems.
Where do KRITIS operators have the biggest gaps according to the BSI?
In attack detection systems. In its evidence reviews under Section 39 of the BSI Act, the BSI rates maturity levels for ISMS, BCMS and attack detection, and attack detection scores lowest. Most incident reports come from the information technology and telecommunications sector (BSI-Magazin 2026/01 and BSI monthly report for July 2026).
Can operators outside Germany use ISEC7 MANAGED SECURE VOICE?
No. Because the service uses German federal cryptographic material, ISEC7 provides it only to German companies and public authorities.
Talk to us about your evidence
Patch status of company phones, a connection to threat detection, or encrypted calling for your crisis team: tell us through the form which question is open for you right now, and we will get back to you.