Critical Infrastructure: Registration Mandatory & Liability

From initial calculation to digital monitoring: How the JUMBO BLOCK system bridges the gap between physical CRITIS resilience and the personal liability of management under NIS-2.

It is May 2026. The regulatory "summer" has begun: the transition periods for the CRITIS Resilience Act (KRITIS-Dachgesetz) are expiring, and the NIS-2 Implementation Act is already in full effect. For municipalities, public utilities, and industrial companies, this means that what used to be "good professional practice" is now a matter of strict compliance.

Responsibility is no longer delegable.

For managing directors and board members, the risk is now personal.

The law mandates that company leadership ensures physical security measures for critical facilities and maintains active risk management.

Violations can lead to direct recourse claims against management and result in liability involving private assets.

• Duty of Supervision: Management must organize and monitor the implementation of all security measures. This includes maintaining the resilience plan and conducting regular monitoring of security risks.

• Mandatory Training: Management is legally required to personally and regularly, at least every three years, participate in specialized training sessions on risk identification and management.

• Central Reporting Deadline (24 Hours): Significant incidents must be reported immediately, and at the latest within 24 hours, as an early warning. This deadline applies to both IT security incidents (NIS-2) and physical disruptions (CRITIS Resilience Act).

1. Early Warning (24h): Nature and severity of the incident.
2. Follow-up Report (72h): Comprehensive assessment, including root causes and impact.
3. Final Report (1 Month): Detailed analysis and documentation of the mitigation measures taken.

• Verification: All reports must contain verified information.

• Integrity and Audit-Proofing: To ensure that reports hold up in court or before authorities (BSI/BBK), simple documentation is not sufficient. Data integrity and audit-proof storage are critical factors in the exculpation of management.

• Verifiability: All reports and underlying logs must be documented in a way that serves as secure evidence during audits or official inspections.

• Forgery Resistance: For the submission of reports, the BSI utilizes the Reporting and Information Portal (MIP).

The data that triggers a report (logs, sensor data, access protocols) must be stored in a way that prevents retroactive manipulation. This is a legal requirement under the CRITIS Resilience Act and the NIS-2 implementation to ensure verifiability (Section 38 BSIG).

• Hashing Procedures: Timestamps and data packets are secured with cryptographic hash functions (e.g., SHA-256). Any subsequent change invalidates the hash value.

• WORM Storage: "Write Once Read Many" storage media for log files physically ensure that data, once written, cannot be overwritten.

• Digital Signatures: Reports transmitted via the BSI Reporting and Information Portal are encrypted and signed. This guarantees both authenticity (the data originated from you) and integrity (the data was not altered during transmission).

• Personal Responsibility & Liability: Managing directors and board members are personally and unlimitedly liable to their organization with their private assets for damages resulting from a culpable breach of duty regarding the implementation and active monitoring of resilience measures. As these duties are legally mandated, any failure to comply risks the loss of D&O insurance coverage (which typically excludes coverage for knowing or willful breaches of duty).

• No Liability Waiver: A waiver by the organization of compensation claims against management, as well as settlements regarding such claims, are ineffective under Section 38 (2) of the BSIG (applicable by analogy to the CRITIS Resilience Act). Consequently, management cannot be exonerated through internal resolutions in the event of a loss.

• Massive Financial Exposure: Violations of implementation or reporting duties are subject to drastic penalties. While the CRITIS Resilience Act (KRITIS-Dachgesetz) provides for fines of up to 1,000,000 euros, the closely linked BSIG (NIS-2) allows for sanctions of up to 10 million euros or 2% of the total global annual turnover of the entire corporate group—whichever amount is higher.