Critical infrastructure-compliant rainwater retention system: We are here for your safety!

The responsibility can no longer be delegated.

For managing directors and board members, the risk is now personal.

The law obliges company management to ensure physical security measures for critical facilities and to implement risk management. 

Violations can lead to direct claims for recourse against management and personal liability .

• Monitoring obligation: Management must organize and monitor the implementation of the measures. This includes maintaining the resilience plan and regularly monitoring security risks.

• Training obligation: Management is legally obligated to personally and regularly participate in risk identification training, at least every three years.

• Central reporting deadline (24 hours): Significant incidents must be reported immediately , but no later than within 24 hours , as an early warning . This deadline applies to both IT security incidents (NIS-2) and physical disruptions (KRITISDachG).

1. Early warning (24h): Type and severity of the incident.
2. Follow-up report (72h): Detailed assessment, including causes and effects.
3. Final report (1 month): Detailed analysis and documentation of the coping measures.

• Verification: The message must contain verified information .

• Integrity and auditability: A simple document is insufficient to ensure that the report will stand up in court or before authorities (BSI/BBK). The integrity and auditability of the data are crucial factors for the management's exoneration.

• Verifiability: All reports and the underlying protocols must be documented in such a way that they can serve as reliable evidence during audits or official reviews .

• Anti-counterfeiting protection: The BSI uses the Reporting and Information Portal (MIP) for transmission .

The data that triggers the report (logs, sensor data, access protocols) must be stored in such a way that it cannot be subsequently manipulated. This is legally required by the KRITIS umbrella law and the NIS-2 implementation to ensure auditability (§ 38 BSIG). 

• Hashing method: Timestamps and data packets are encrypted using cryptographic hash functions (e.g., SHA-256). Changes invalidate the hash value.

• WORM storage: "Write Once Read Many" storage media for log files, physically ensuring that data written once cannot be overwritten.

• Digital signatures: Reports submitted via the BSI's reporting and information portal are encrypted and digitally signed before transmission. This ensures that the data originates from you (authenticity) and has not been altered in transit (integrity).

Massive risk of fines: Violations of the measures or reporting obligations will be severely punished.

While the KRITISDachG provides for fines of up to 1,000,000 euros, the closely intertwined BSIG (NIS-2) allows for sanctions of up to 10 million euros or 2% of the worldwide annual turnover of the entire group – whichever amount is higher.

• Personal Responsibility & Liability: Managing directors and board members are personally and fully liable to the organization with their private assets for damages resulting from culpable breaches of duty in the implementation and active monitoring of resilience measures. Since these duties are legally mandated, failure to comply risks the loss of D&O insurance coverage (exclusion in case of willful breach of duty).

• No waiver of liability: A waiver by the institution of claims for damages against management, as well as settlements regarding these claims, are invalid pursuant to Section 38 Paragraph 2 of the German IT Security Act (BSIG) (applicable analogously to the German Critical Infrastructure Protection Act (KRITISDachG)). Therefore, in the event of damage, management cannot be relieved of liability by internal resolutions.

From the first calculation to digital monitoring: how the JUMBO BLOCK system bridges physical CRITIS resilience and the personal liability of management under NIS-2.

The regulatory "summer" is in full swing — and still shifting:

The NIS-2 Implementation Act is already fully legally binding; the standard BSI registration deadline has passed. For the CRITIS Umbrella Act, the original 17 July 2026 deadline was struck from the law by legislative amendment: registration is now tied to the still-pending regulation defining critical facilities — only once that regulation takes effect does the three-month window for BBK registration begin, followed by nine months for the risk analysis and ten months for the complete resilience plan.

For municipalities, public utilities, and industrial operators, this means:
What used to count as "good professional practice" is now a matter of hard compliance — a chain of deadlines that keeps shifting in timing but grants no real delay. Those who wait now only shorten their own preparation time once the regulation is issued.