Critical infrastructure-compliant rainwater retention system

These regulations have fundamentally shifted the playing field for decision-makers.

It is no longer just a question of whether a rainwater retention basin works technically.

The issue is whether the infrastructure is protected against extreme weather and sabotage (CER Directive) and whether the digital surveillance systems can withstand a cyber attack (CRA & NIS-2).

The responsibility can no longer be delegated.

For managing directors and board members, the risk is now personal.

The law obliges company management to ensure physical security measures for critical facilities and to implement risk management. 

Violations can lead to direct claims for recourse against management and personal liability .

• Monitoring obligation: Management must organize and monitor the implementation of the measures. This includes maintaining the resilience plan and regularly monitoring security risks.

• Training obligation: Management is legally obligated to personally and regularly participate in risk identification training, at least every three years.

• Central reporting deadline (24 hours): Significant incidents must be reported immediately , but no later than within 24 hours , as an early warning . This deadline applies to both IT security incidents (NIS-2) and physical disruptions (KRITISDachG).

1. Early warning (24h): Type and severity of the incident.
2. Follow-up report (72h): Detailed assessment, including causes and effects.
3. Final report (1 month): Detailed analysis and documentation of the coping measures.

• Verification: The message must contain verified information .

• Integrity and auditability: A simple document is insufficient to ensure that the report will stand up in court or before authorities (BSI/BBK). The integrity and auditability of the data are crucial factors for the management's exoneration.

• Verifiability: All reports and the underlying protocols must be documented in such a way that they can serve as reliable evidence during audits or official reviews .

• Anti-counterfeiting protection: The BSI uses the Reporting and Information Portal (MIP) for transmission .

The data that triggers the report (logs, sensor data, access protocols) must be stored in such a way that it cannot be subsequently manipulated. This is legally required by the KRITIS umbrella law and the NIS-2 implementation to ensure auditability (§ 38 BSIG). 

• Hashing method: Timestamps and data packets are encrypted using cryptographic hash functions (e.g., SHA-256). Changes invalidate the hash value.

• WORM storage: "Write Once Read Many" storage media for log files, physically ensuring that data written once cannot be overwritten.

• Digital signatures: Reports submitted via the BSI's reporting and information portal are encrypted and digitally signed before transmission. This ensures that the data originates from you (authenticity) and has not been altered in transit (integrity).

Massive risk of fines: Violations of the measures or reporting obligations will be severely punished.

While the KRITISDachG provides for fines of up to 1,000,000 euros, the closely intertwined BSIG (NIS-2) allows for sanctions of up to 10 million euros or 2% of the worldwide annual turnover of the entire group – whichever amount is higher.

• Personal Responsibility & Liability: Managing directors and board members are personally and fully liable to the organization with their private assets for damages resulting from culpable breaches of duty in the implementation and active monitoring of resilience measures. Since these duties are legally mandated, failure to comply risks the loss of D&O insurance coverage (exclusion in case of willful breach of duty).

• No waiver of liability: A waiver by the institution of claims for damages against management, as well as settlements regarding these claims, are invalid pursuant to Section 38 Paragraph 2 of the German IT Security Act (BSIG) (applicable analogously to the German Critical Infrastructure Protection Act (KRITISDachG)). Therefore, in the event of damage, management cannot be relieved of liability by internal resolutions.

From initial calculations to digital monitoring: How the JUMBO BLOCK system bridges the gap between physical critical infrastructure resilience and the personal liability of management under NIS-2.

The regulatory “summer” has begun:

The transitional periods for the KRITIS umbrella law expire on 17.07.2026, and the NIS-2 implementation law is already fully active.

For municipalities, public utilities and industrial companies, this means:

What was once considered "good professional practice" is now a matter of strict compliance.

To make entering this highly complex world as easy as possible, we have created a digital ecosystem at jumboblock.org . We alleviate planners' and decision-makers' fear of complexity by massively accelerating the planning process:

• JUMBO BLOCK Hydro: Calculate the required retention volume in seconds based on specific rainfall data.

• JUMBO BLOCK Plan: Translate hydrological requirements directly into a technical layout. See immediately how the system fits under your areas (streets, squares, buildings).

• JUMBO BLOCK Budget: Get an initial economic overview. Transparent data instead of vague estimates – the perfect basis for legally sound committee decisions.

Minimize your liability risk now:

A purely concrete solution will no longer be sufficient to meet legal requirements by 2026. The law mandates monitoring and reporting obligations. With the JUMBO BLOCK Dashboard, which has been live since November 2025, we offer the digital solution:

1. NIS-2 & CRA compliance: Our architecture is "Secure by Design". This means you meet the strictest IT security requirements of the EU.
2. Real-time monitoring: Levels, capacities and system states can be accessed at any time.
3. Documentation as exculpation: In the event of an audit or a damage incident, the dashboard serves as complete, legally sound proof that management has fully complied with its monitoring obligations.

The pilot project phase is over. The legal deadline for KRITIS registration on July 17, 2026, is fast approaching.

Rely on a system that not only stores water but also protects your personnel.

With JUMBO BLOCK, you build infrastructure that truly deserves the name "critical"—physically invincible, digitally sovereign, and instantly plannable thanks to our engineering tools.

Are your resilience plans already watertight?

Start your pre-planning now at jumboblock.org or experience digital surveillance live at jumboblock.net .

Note to editors: Images of the cross-section of the JUMBO BLOCK modules under traffic areas are available upon request.