NIS2 and KRITIS: How NIS2 Absorbs and Expands the KRITIS Universe

The Nisura Team · 28 July 2026 · Updated 18 August 2026

NIS2 does not replace KRITIS — it absorbs it. Germany’s NIS2 transposition (the NIS2UmsuCG) widens the regulated population from a few thousand critical-infrastructure operators to an estimated ~30,000 entities, and it places classic KRITIS operators at the very top of a new three-tier pyramid, carrying the strictest cybersecurity duties of all. If you were already a Betreiber kritischer Anlagen, NIS2 adds to your obligations; if you weren’t, you may now be in scope for the first time.

What is KRITIS — and how does NIS2 relate to it?

KRITIS (Kritische Infrastrukturen) is the German term for critical infrastructure — the operators of essential services in sectors like energy, water, health, food, finance, transport and IT whose failure would cause serious supply shortfalls or public-safety risks. Historically, KRITIS operators were regulated under the BSI-Gesetz (BSIG) and the KRITIS Ordinance (BSI-KritisV), with duties to register with the BSI, implement “state-of-the-art” security, run attack-detection systems, report incidents and undergo audits.

NIS2 — the EU Directive (EU) 2022/2555 — is transposed in Germany by the NIS2-Umsetzungs- und Cybersicherheitsstärkungs­gesetz (NIS2UmsuCG), which amends the BSIG. Rather than creating a parallel regime, NIS2 widens the existing one: it keeps KRITIS operators (with their extra duties) and layers a far larger population of “besonders wichtige” and “wichtige” entities on top of them. As one German analysis puts it, “durch NIS2 erweitert sich KRITIS” — through NIS2, KRITIS expands. For the EU-wide basics, see our complete guide to the NIS2 Directive.

The scope explosion: from a few thousand to ~30,000

This is the headline change. Under the old KRITIS rules, only operators above high sector thresholds (for example, serving 500,000 people) were federally regulated — on the order of ~1,800 Betreiber kritischer Anlagen, plus a limited set of digital and federal bodies. NIS2 replaces that narrow test with a general size-and-sector rule across 18 sectors, and the law’s own impact estimate puts the result at roughly 30,000 entities — about 8,250 besonders wichtige and 21,600 wichtige Einrichtungen. That’s several times the pre-NIS2 population. Not sure if that includes you? Check whether NIS2 applies to your company.

The three tiers of the German NIS2 regime

The NIS2UmsuCG sorts in-scope organisations into three categories, from the most heavily regulated down:

The key mental model: KRITIS operators are a subset of NIS2, sitting inside the “besonders wichtige Einrichtungen” tier — not a separate or competing regime. They inherit the full NIS2 Article 21 risk-management duties and keep their pre-existing KRITIS obligations on top.

The second pillar: the KRITIS-Dachgesetz (CER Directive)

NIS2 is only half of the EU’s critical-infrastructure package. Its twin is the CER Directive (Critical Entities Resilience, Directive (EU) 2022/2557), which Germany transposes through the KRITIS-Dachgesetz (the “KRITIS umbrella law”) — cleared by the Federal Cabinet on 6 March 2026 as the physical-resilience counterpart to the NIS2UmsuCG. The division of labour:

• NIS2UmsuCG → cybersecurity. IT risk management, incident reporting, technical and organisational measures.
• KRITIS-Dachgesetz → physical resilience. Protection of critical installations against sabotage, natural disasters and hybrid threats — and registration with the BBK (civil protection).

For KRITIS operators the two interlock: an entity identified as “critical” under the KRITIS-Dachgesetz is also a besonders wichtige Einrichtung under NIS2. Cyber and physical resilience are converging into one connected obligation.

What KRITIS operators must do under NIS2

• Register — with the BSI within three months of becoming identified (§ 33 BSIG), and additionally with the BBK as a KRITIS operator.
• Implement Article 21 risk-management measures (risk analysis, incident handling, business continuity, supply-chain security, cryptography, access control, MFA).
• Operate Systeme zur Angriffserkennung(attack-detection systems, § 31 BSIG) — the KRITIS-specific duty that survives into NIS2 — and demonstrate compliance every three years.
• Meet the 24h / 72h / 1-month incident-reporting timeline to the BSI.
• Ensure management accountability — under NIS2, the Geschäftsleitung approves and oversees the measures and can be held personally liable.

Note on timing: while the obligations apply now (there is no general grace period), the first formal proof of implemented measures for KRITIS operators is set at registration and is due, at the earliest, around three years after the law’s entry into force.

Why this matters now

Germany missed the EU’s October 2024 transposition deadline, and the Commission opened infringement proceedings — but the NIS2UmsuCG is now law, with no general grace period. Whether you are a long-standing KRITIS operator facing new duties, or a mid-sized supplier discovering you are in scope for the first time, the practical first step is the same: establish, in defensible terms, where your external posture actually stands.

This is where Cyber Risk Quantification helps. Instead of a static questionnaire, it maps your external attack surface, translates it into a board-ready Euro figure, and evidences your NIS2 posture on demand. See how the Nisura framework automates NIS2 Article 21 evidence, check your scope with the NIS2 Scope Checker, or run a free simulation to see your projected exposure and NIS2 liability in minutes.

Sources & official references

• OpenKRITIS — NIS2-Umsetzung im BSIG: Gesetz zur Cybersicherheit (status, entity estimates, § 33 registration, no transition period).
• secjur — NIS2 und KRITIS: der Unterschied (three tiers, ~1,800 KRITIS operators within ~30,000, § 31 duties).
• IHK Bremen-Bremerhaven — NIS2: Betroffenheit und Pflichten.
• grasp — Unterschied zwischen NIS2 und KRITIS.
• Directive (EU) 2022/2555 (NIS2) and (EU) 2022/2557 (CER); German NIS2UmsuCG and KRITIS-Dachgesetz, and BSI guidance for besonders wichtige und wichtige Einrichtungen and Betreiber kritischer Anlagen.

This article is general information, not legal advice. Entity estimates are the German legislator’s projections; scope classification and thresholds are set by national law and BSI/BBK ordinances — confirm your status with qualified counsel.