Complying with the IT-Sicherheitskatalog: A guide for operators of critical energy installations

As attacks on European energy infrastructure move from the office network into the control room, German operators face a regime that treats IT security as a condition of safe supply: a single attack can hit several plants at once, and a damaged installation cannot simply be replaced. The Bundesnetzagentur published the IT-Sicherheitskatalog in December 2018, extending to energy installations the standards it set for grid operators in 2015. It rests on three protection goals — availability, integrity, and confidentiality — enforced through zone classification, a certified ISMS, risk treatment, and a named security contact.

t applies to operators of energy installations classified as critical infrastructure under the BSI-Kritisverordnung and connected to an energy supply network. With contact details due by 28 February 2019 and certificates by 31 March 2021, this is now a steady-state obligation: certification to DIN EN ISO/IEC 27001, supported by the energy sector control sets 27002 and 27019, audited by a DAkkS-accredited body. This guide breaks down the catalog chapter by chapter, outlines what your organization must implement, and shows how ManageEngine solutions help you operationalize and strengthen compliance.

What you’ll learn

• Identify which operators the catalog covers: installations classified as critical infrastructure under the BSI-Kritisverordnung and connected to an energy supply network.
• Understand the six-zone classification in Chapter C, and why a zone ranks a system by its importance to safe operation rather than by network segment.
• Work through Chapter D: the ISMS built on DIN EN ISO/IEC 27001, the 27002 and 27019 control sets, risk treatment across Zones 1 to 3, and the security contact in D.VI.
• Follow the certification route in Chapter E through a DAkkS-accredited body, plus the separate regime in Chapter F for nuclear facilities under the SEWD-Richtlinie IT.
• Map identity governance and security monitoring to the catalog's access, logging, detection, and incident obligations, and see where AD360 and Log360 fit.