+49 (0) 611 950 123 20
Data centers · KRITIS
Critical infrastructure security for data centers and their construction sites
Data centers are critical infrastructure – regulated mainly through the BSI Act and NIS2, plus the security requirements of operators and clients. Physical resilience starts on the construction site, not only in operation. We deliver the part that happens on site.
KRITIS Umbrella Act
What the KRITIS umbrella act requires
The act implements EU Directive 2022/2557 and adds the physical side to NIS2. Important for data centers: operators in the IT and telecommunications sector are exempt from key obligations of the act, including risk assessment and resilience measures (Sec. 4(2) no. 2, Secs. 12–16 KRITISDachG). For them, the BSI Act and NIS2 are the main framework – the overview below shows the obligations for the other sectors. As of October 2026; not legal advice.
Registration
Critical facilities are registered with the federal civil protection office (BBK).
Risk assessment
Risks assessed on the basis of the national risk assessment.
Resilience measures
Technical, organisational and personnel – including physical security.
Reporting duty
Significant incidents must be reported.
Our contribution
The operational part of your resilience
Access & perimeter
Gates, badge and visitor management, vehicle checks, patrols – on the construction site and in operation.
Vetted staff
Sec. 34a GewO, police clearance, NDA – own staff only.
Fire safety & emergency
Fire watch, first aiders, site paramedics, rehearsed emergency procedures.
Evidence
Digital guard log and reports as a basis for audits.
Data center experience
48 data center projects in construction and operation.
Training
Fire safety, de-escalation and our own data center induction.
FAQ
Frequently asked questions
What does the KRITIS Umbrella Act require from operators?
Since the KRITIS umbrella act entered into force in 2026, operators of critical facilities must, among other things, register their facilities, carry out risk assessments, implement resilience measures – including physical and personnel security – and report significant incidents.
How does a security provider support implementation?
With the operational part on site: access control, perimeter protection, vetted staff, emergency procedures and documentation that serves as evidence.
Do you use your own staff?
Yes. We deploy our own, directly employed staff – fixed, inducted teams with planned cover – an important factor for personnel security.
Why already on the construction site?
Whoever later operates a critical facility must be able to show its risks and measures. Who had access to plant rooms, plans and systems during construction is part of that picture. Proper access control and complete records from the first construction phase lay the groundwork.
Related services
You may also need
Contact
Your facility, our concept
We assess your facility on site and show which measures we can take over.
Phone: +49 (0) 611 950 123 20