Nachweis über die Einhaltung des Standes der Technik für Betreiber Kritischer Infrastrukturen Überprüfung

If you operate critical infrastructures, you must prove that the security of your information technology corresponds to the state of the art. You must submit proof to the Federal Office for Information Security (BSI) every two years.

Critical infrastructures (KRITIS) are organizations and facilities that are important for the state community. If these facilities fail or are impaired, this can lead to supply bottlenecks, significant disruptions to public safety or other dramatic consequences. Regular proof of compliance with the state of the art is therefore required by law. KRITIS includes the following sectors, for example:

• Energy,
• health,
• information technology and telecommunications,
• transportation and traffic,
• water,
• finance and insurance,
• nutrition,
• municipal waste disposal.

As an operator of critical infrastructures, you must ensure that the security of your information technology systems, components and processes, which are fundamental to their operation, corresponds to the state of the art. You must prove this to the Federal Office for Information Security (BSI) at least every two years.

To protect your information technology against failure and external attacks, you must take organizational and technical measures and precautions. This also includes the use of attack detection systems.
You can have this documented by security audits, tests or certifications from auditing bodies. In the next step, you submit the results of these audits to the BSI using a verification document, including any security deficiencies discovered.

The BSI then checks whether your precautions and measures meet the legal requirements. The BSI can request the submission of further test documents and, in the event of security deficiencies, the rectification of the security deficiencies.

• Verification document KI: Information on the operator, the tested critical infrastructure and contact person
• Verification document P: Information on the inspection.
  • must be signed by an employee of the verifying body who is authorized to sign.
  • must contain the following information:
    • Section PD: Information on the performance of the test
      • Appendix PD.A: Description and graphic representation of the scope of the inspection
      • Annex PD.B: Information on the test procedure
      • Appendix PD.C: Description of the test basis
    • Section PE: Information on the test result and the safety deficiencies detected
      • Appendix PE.A: List of safety deficiencies including implementation plan
    • Section PS: Information on the suitability of the inspecting body and the inspection team
      • Annex PS.A: Proof or evidence of qualification additional test procedure competence for § 8a BSIG or equivalent proof of competence
        

• You operate critical infrastructure
• You are registered with the BSI
• You have a corresponding operator ID/institution ID

There are no costs for you for submitting the certificates to the BSI.

You can submit your evidence via the online service, by encrypted e-mail or by post.

If you submit evidence via the online service:

• To use the online service, you need an ELSTER organization certificate and ELSTER company account.
• Go to the federal portal verwaltung.bund.de and complete the online application.
• You can upload your documents directly.
• The KRITIS office of the Federal Office for Information Security (BSI) will check your details.
• If the KRITIS office has any questions for you during the review or requests additional documents, it will contact you by email.
• After the formal check, the KRITIS office will send you a confirmation by e-mail and inform you of the new deadline for your next proof.

If you submit evidence by encrypted e-mail:

• Download the proof document KI from the BSI website.
• Fill out the form.
  • You can either complete the form digitally
  • or print it out first and then fill it in.
• Sign the form.
• Send the form and your verification documents by email to the BSI's KRITIS office.
  • The KRITIS Office will accept your verification documents by encrypted e-mail.
  • For encryption, use the S/MIME certificate of the KRITIS office on the BSI website.
• The next steps are the same as for the online service.

If you are submitting evidence by post:

• Download the KI verification document from the website of the Federal Office for Information Security.
  • You can either fill out the form digitally and print it out,
  • or print it out first and then fill it in.
• Sign the form and add the necessary verification documents.
• Send your proof to the BSI's KRITIS office.
• All further steps correspond to the procedure of the online service.

There are no indications or special features.

There are no legal remedies.

• Proof of compliance with the state of the art for operators of critical infrastructures Verification
• Critical infrastructure operators must continuously take measures and precautions to ensure the security and functionality of their facilities
• Critical infrastructure operators must prove every 2 years that they have taken sufficient measures to protect the information technology of their facilities in accordance with the state of the art
• Operators can have the state of the art of the systems checked and documented by
  • an independent audit
  • as a supplement to another audit
    • ISO 27001 certification based on IT baseline protection
    • ISO 27001 certification process (native)
    • Internal company security audit
    • Audit
• Audit teams prepare and sign the verification document P, which they hand over to the operator
• Operators send the verification document together with other documents to the Federal Office for Information Security (BSI)
• The verification documents can be sent via
  • the online service,
  • an encrypted e-mail or
  • by post
• responsible: Federal Office for Information Security

Forms available: Yes
Written form required: Yes
Informal application possible: No
Personal appearance necessary: No

Online services available: Yes