KRITIS Umbrella Act: What It Means for Security on Data Center Construction Sites

7. October 2026 by Sharif Jusufi

Germany’s KRITIS Umbrella Act (KRITIS-Dachgesetz) has been in force since spring 2026. It transposes EU Directive 2022/2557 (the CER Directive) into German law and, for the first time, explicitly obliges operators of critical facilities to ensure physical resilience – alongside cybersecurity under NIS2. The sectors covered include information technology and telecommunications – but important exemptions apply to data centers (see below).

Key obligations at a glance

Registration of critical facilities with the Federal Office of Civil Protection and Disaster Assistance (BBK).
Risk assessments based on the national risk assessment.
Resilience measures and a resilience plan – technical, organisational and security-related, including emergency preparedness, physical and personnel security and regular training.
Reporting obligations for significant incidents.
Management accountability for implementation – breaches can lead to substantial fines.

Important for data centers: Operators of critical facilities in the IT and telecommunications sector – which includes data centers – are exempt from key parts of these obligations under Sec. 4(2) no. 2 KRITISDachG, including risk assessment and resilience measures (Secs. 12 to 16). For them, the main framework is the BSI Act as amended for NIS2, plus the contractual requirements of operators and clients. In practice, physical and personnel security remain on the agenda – just on a different legal basis. As of October 2026; not legal advice.

Deadlines are linked to registration. Which facilities are covered is determined by thresholds set by ordinance – every operator needs to assess its own situation.

Why it matters on the construction site

A data center does not become critical infrastructure only when it goes live. Controlling and documenting access, keys, materials and personnel during construction lays the groundwork operators will later need to evidence in their risk assessment and resilience plan. Gaps from the construction phase – unclear access rights, unvetted staff, missing records – are hard to close once the site is operational.

What this means when choosing a security provider

Personnel security: vetted staff with police clearance, registered in the German security register, with NDAs – extended checks on request.
Fixed staff pool: named teams instead of rotating floaters.
Documented access control: badges, visitors, keys, tool and material checks – recorded audit-proof.
Training records: inductions, fire safety assistant, first aid, de-escalation – evidenced.
Incident management: clear reporting and escalation paths with complete reports.
Seamless transition from construction to live operations without changing provider.

How Solid Safety supports you

Solid Safety specialises in data centers and has supported 48 data center projects – with experience at KRITIS facilities. Our teams work with a digital logbook, documented patrols and PDF reports, with our own staff instead of floaters, certified to ISO 9001 and DIN 77200. More at Data center security company.

Note: this article provides a general overview and is not legal advice. For your specific facility, please consult your legal or compliance advisers.

Data center project in planning? Talk to us →

Sharif Jusufi – Managing Director of Solid Safety.

← All insights