Sector · Critical infrastructure

Physical security for critical infrastructure

Germany’s KRITIS Umbrella Act explicitly requires physical resilience from operators. We deliver the part that happens on site.

KRITIS Umbrella Act · Data centers · Logistics

KRITIS Umbrella Act

What applies since March 2026

The act implements EU Directive 2022/2557 and adds the physical side to NIS2. Data centers are covered as digital infrastructure.

Registration

Critical facilities are registered with the federal civil protection office (BBK).

Risk assessment

Risks assessed on the basis of the national risk assessment.

Resilience measures

Technical, organisational and personnel – including physical security.

Reporting duty

Significant incidents must be reported.

Article on the KRITIS Umbrella Act

Our contribution

The operational part of your resilience

Access & perimeter

Badge and visitor management, vehicle checks, patrols.

Vetted staff

Sec. 34a GewO, police clearance, NDA – own staff only.

Fire safety & emergency

Fire watch, first aiders, site paramedics, rehearsed emergency procedures.

Evidence

Digital guard log and reports as a basis for audits.

Data center experience

40+ data center projects in construction and operation.

Training

Fire safety, de-escalation and our own data center induction.

FAQ

Frequently asked questions

What does the KRITIS Umbrella Act require from operators?

Since 17 March 2026, operators of critical facilities must, among other things, register their facilities, carry out risk assessments, implement resilience measures – including physical and personnel security – and report significant incidents.

How does a security provider support implementation?

With the operational part on site: access control, perimeter protection, vetted staff, emergency procedures and documentation that serves as evidence.

Do you use subcontractors?

No. In Germany we deploy exclusively our own, directly employed staff – an important factor for personnel security.

Related services