Your 2026 guide to complying with Germany's KRITIS-Dachgesetz (KRITIS Umbrella Act)

As hybrid threats against European infrastructure move from scenario planning into the incident log, Germany has put the physical resilience of critical installations on a statutory footing for the first time. The KRITIS-Dachgesetz transposes Directive (EU) 2022/2557, the CER Directive, and applies an all-hazards standard that treats natural disaster, accident, and deliberate attack alike. It obliges operators to register their installations, analyze risk, adopt proportionate resilience measures, document them in a resilience plan, and report significant incidents.

In force since March 17, 2026, the Act reaches operators of critical installations across ten sectors, with the default threshold set at supplying 500,000 people. Registration falls due within three months of identification; the first risk analysis follows nine months after registration, and resilience measures, the plan, and reporting arrangements ten months after. Management carries ultimate responsibility. This guide breaks down the Act section by section, outlines what your organization must implement, and shows how ManageEngine solutions help you operationalize and strengthen compliance.

What you’ll learn

• Understand which installations fall in scope across the Act's ten sectors, how the 500,000-person supply threshold works, and why federal states may set it lower.
• Distinguish the KRITIS-Dachgesetz from the BSI Act and NIS 2: this law governs physical resilience, and its incident definition deliberately excludes pure cybersecurity events.
• Work through the core duties — registration under § 8, four-yearly risk analysis under § 12, the resilience plan under § 13, and evidence, audits, and on-site inspection under § 16.
• Map the compliance clock: three months to register, nine to complete the first risk analysis, ten to implement measures, and 24 hours to report a significant incident.
• See how identity governance and security monitoring evidence the access control, audit trail, and incident detection duties — and where physical measures remain outside their reach.