How can ManageEngine support KRITIS compliance?
With ManageEngine Log360 (SIEM), operators of critical installations can align with the BSIG duties through continuous attack detection across the systems that keep the installation running, real-time monitoring of system, database and directory activity, automated incident response, and retained, searchable audit evidence. These capabilities support the risk-management measures under § 30, the attack detection required by § 31, the reporting deadlines in § 32, management accountability under § 38, and the three-yearly evidence obligation under § 39.
§ 30 BSIG§ 30 BSIG — Risk-management measures
| Clause | Functionality | Explanation |
|---|---|---|
| Abs. 1 Satz 1: Take appropriate, proportionate and effective technical and organisational measures to avoid disruptions to the availability, integrity and confidentiality of the IT systems, components and processes used to provide services, and to keep the impact of security incidents as small as possible. | Log360 - Centralized log collection from 750+ sources, real-time security analytics, MITRE ATT&CK-mapped detection rules, security and risk posture management. | Log360 collects and correlates events across servers, network devices, databases, endpoints and cloud platforms, surfacing availability and integrity disruptions while they are still containable. Its security and risk posture management identifies misconfigurations and attack-surface exposure in Active Directory and MS SQL before they escalate. |
| Abs. 1 Satz 3: Compliance with the obligation under Absatz 1 Satz 1 must be documented by the entity. | Log360 - Audit-ready compliance report templates, custom compliance report builder, scheduled report delivery, exportable log search results. | Log360 produces scheduled and exportable reports from retained event data, and its report builder lets operators define templates matching the measures they have documented. The result is a documentation trail that accumulates automatically rather than being assembled before an audit. |
| Abs. 2 Nr. 1: Concepts relating to risk analysis and to information technology security. | Log360 - Security and risk posture management, attack-surface exposure insights, UEBA risk scoring, detection coverage dashboards. | Log360 assesses Active Directory and MS SQL configurations for weaknesses and presents prioritised risk findings that feed directly into a risk analysis. UEBA risk scores maintain a continuously updated view of which users and entities carry the most exposure, so the risk picture reflects current behaviour rather than the last review cycle. |
| Abs. 2 Nr. 2: Handling of security incidents. | Log360 - Vigil IQ TDIR, Incident Workbench, incident management console with ticket assignment rules, SOAR with 50+ default playbooks and visual playbook builder, ITSM integrations. | Log360 detects incidents through correlation, anomaly and threat-intelligence rules, raises them in the incident console, and assigns them automatically to the right analyst. Response playbooks execute on detection to contain the threat before an analyst intervenes, and the Incident Workbench carries the investigation to a documented conclusion with ITSM integration tracking the case to closure. |
| Abs. 2 Nr. 4: Security of the supply chain, including security-related aspects of relationships with direct suppliers or service providers. | Log360 - Dark web monitoring for supply-chain credential leaks, threat intelligence with IP/URL/domain reputation, privileged user monitoring (PUMA) reports. | Log360's dark web monitoring surfaces leaked credentials tied to the organisation and its suppliers before they are used, and threat intelligence flags traffic to known malicious infrastructure. Privileged user monitoring shows what a service provider actually did in the environment, turning supplier oversight into observed activity rather than attestation. |
| Abs. 2 Nr. 6: Concepts and procedures for assessing the effectiveness of information security risk-management measures. | Log360 - Detection rule coverage and tuning insights, 1000+ analytical widgets and custom dashboards, scheduled compliance reports. | Log360's dashboards and tuning insights show which detections are firing, which rules are noisy, and where coverage is thin, giving effectiveness reviews measured input instead of opinion. |
| Abs. 2 Nr. 9: Concepts for personnel security, access control and the management of ICT systems, products and processes. | Log360 - Privileged user auditing, real-time logon tracking. | Access-control concepts are only as good as the use made of them, so the record of what privileged accounts did belongs alongside the rights that were granted. Log360 audits privileged user activity and tracks logons in real time, showing which accounts were used, from where and when, which makes the management of ICT systems evidenced by observed activity rather than by configuration alone. |
§ 31 BSIG§ 31 BSIG — Special requirements for operators of critical installations
| Clause | Functionality | Explanation |
|---|---|---|
| Abs. 1: For the IT systems, components and processes decisive for the functioning of the critical installation, measures going beyond the protection level of other especially important entities are proportionate where the effort is not disproportionate to the consequences of a failure or impairment of that installation. | Log360 - File integrity monitoring for Windows and Linux servers, database activity monitoring, object-level detection scoping. | Log360 can be scoped tightly onto the systems decisive for the functioning of the installation and run at higher intensity there than across the wider estate: file integrity monitoring on control-adjacent servers and database activity monitoring on process databases. Detection rules filter at user, group, OU or device level so the heightened posture applies exactly where the clause expects it. |
| Abs. 2: Deploy systems for attack detection that continuously and automatically record and evaluate suitable parameters and characteristics from ongoing operation, are able to continuously identify and avoid threats, provide suitable remediation measures for disruptions, and observe the state of the art. | Log360 - Agentless and agent-based log collection from 750+ sources, custom log parser, built-in syslog server, real-time event correlation engine, 2000+ MITRE ATT&CK-mapped detection rules, ML-based UEBA with risk scoring and dynamic peer grouping, threat intelligence with IoC and reputation data, STIX/TAXII feed processor, SOAR playbooks. | This is the clause Log360 answers most directly. It records parameters from ongoing operation continuously and automatically across servers, network devices, databases, endpoints and cloud platforms, and evaluates them in real time against correlation rules, machine-learned behavioural baselines and threat intelligence. Identification is continuous rather than periodic, the remediation element is met by playbooks that execute automatically on detection, and centrally updated MITRE-mapped content keeps detection aligned with the state of the art. |
§ 32 BSIG§ 32 BSIG — Reporting obligations
| Clause | Functionality | Explanation |
|---|---|---|
| Abs. 1 Nr. 1: Submit an early warning within 24 hours of becoming aware of a significant security incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effects. | Log360 - Real-time alert profiles with on-call notification, incident management console, MITRE ATT&CK rule context, threat intelligence attribution. | The 24-hour clock starts at knowledge, so detection speed decides whether the deadline is workable. Log360 raises alerts the moment a detection fires and routes them to responders on duty, and the MITRE mapping and threat-intelligence context attached to the alert are what let an operator state whether malicious activity is suspected. |
| Abs. 1 Nr. 2: Submit a report within 72 hours confirming or updating the early warning, with an initial assessment of severity and impact and, where available, indicators of compromise. | Log360 - Incident Workbench with contextual investigation, process lineage visuals, AI-generated incident and user timelines, threat intelligence IoC enrichment, high-speed log search with advanced query builder. | The Incident Workbench consolidates telemetry from Active Directory, threat feeds and other security tools into a single investigation view, and its generated timelines assemble the sequence an initial assessment has to describe. Indicators of compromise come from enrichment already attached to the events, so observed indicators are reported rather than reconstructed from raw logs. |
| Abs. 1 Nr. 3: Provide an interim report with relevant status updates at the request of the Bundesamt. | Log360 - Incident management console with status tracking, case updates through ITSM integration, on-demand incident reports. | Log360 tracks each incident's state from detection through containment to closure. A status update requested mid-investigation is produced from the current case record, including the actions already taken and those still running, rather than assembled by hand under time pressure. |
| Abs. 1 Nr. 4: Submit a final report no later than one month after the 72-hour report, describing the incident, its severity and impact, the probable root cause, and the mitigation measures applied and ongoing. | Log360 - Log archiving with configurable retention, high-speed forensic log search, Incident Workbench with process hunting trees, MITRE ATT&CK technique mapping, AI-generated incident timelines, report export. | The final report needs the full sequence rather than the first signal, which depends on retained log data still being searchable a month later. Log360 archives collected events for configurable retention periods, and forensic search with process hunting trees reconstructs how the attack progressed. Technique mapping supplies the threat characterisation, and the incident record documents which mitigations were applied and which remain in progress. |
§ 38 BSIG§ 38 BSIG — Management responsibility
| Clause | Functionality | Explanation |
|---|---|---|
| Abs. 1: Management bodies must implement the risk-management measures the entity is required to take under § 30 and monitor their implementation. | Log360 - Interactive security dashboards with 1000+ analytical widgets, scheduled report delivery to named recipients, audit-ready compliance templates. | Monitoring implementation means management has to see the state of the measures rather than be told about it. Log360 dashboards and scheduled reports put detection coverage, incident volumes and posture findings in front of the management body on a fixed cadence. The delivery record itself evidences that the oversight took place. |
§ 39 BSIG§ 39 BSIG — Evidence obligations for operators of critical installations
| Clause | Functionality | Explanation |
|---|---|---|
| Abs. 1 Satz 1 und 2: Demonstrate implementation of the measures under § 30 Abs. 1 Satz 1 in conjunction with § 31 Abs. 1 and Abs. 2 Satz 1 through security audits, checks or certifications at a date set by the Bundesamt and every three years thereafter, transmitting the results including the security deficiencies identified. | Log360 - Log archiving with configurable retention, high-speed search over archived data, audit-ready compliance templates and custom report builder, file integrity monitoring records. | An audit tests whether the measures operated, not whether they exist, so the evidence has to span the period under review. Log360 archives collected events for configurable retention and keeps them searchable, and its compliance templates produce the artefacts auditors ask for on detection, monitoring and privileged activity. |
| Abs. 1 Satz 3 und 4: The Bundesamt may require submission of the documentation on which the review was based and, where security deficiencies exist, a suitable remediation plan. | Log360 - Exportable log search results, saved incident reports, archived event data, scheduled compliance report history. | Where the BSI asks for the documentation behind a finding, the retained and searchable archive lets the operator produce the specific records the audit relied on rather than a summary of them. Where a remediation plan is required, the same retained data evidences progress against the deficiency over time. |
Conclusion
Now that you have seen how the BSI-Kritisverordnung and the BSIG define what operators of critical installations must do, and how Log360 supports those duties, the next step is to see it against your own environment.
Whether the priority is continuous attack detection under § 31, meeting the 24-hour reporting clock, tightening privileged access, or building the evidence base for your three-yearly submission, we can help you work through it. Start a 30-day free trial to run the solution in your own environment, or contact us to arrange a one-to-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended as professional, legal, or regulatory advice. Compliance with the BSI-Kritisverordnung and the BSIG depends on your organisation's specific installations, systems, and processes.
To assess your compliance posture accurately, we recommend engaging a qualified consultant or auditing body, or referring directly to the official BSIG and BSI-KritisV texts and BSI guidance.