How can ManageEngine support operators of critical installations in meeting these requirements?
With ManageEngine Log360 (SIEM), organizations in the energy, water, food, health, transport, IT, telecommunications, finance, and public administration sectors can start aligning with the requirements of the KRITIS-Dachgesetz. The joint BBK–BSI registration platform has been open since July 17, 2026. Once an operator registers, the deadlines begin. Nine months to complete the risk analysis, and ten months to have resilience measures, incident reporting, and evidence obligations in place. In other words, the clock starts the moment you register—so the sooner that happens, the sooner the countdown begins. See the key obligations and how our solution helps in the table below:
§3§ 3 Central point of contact; competent authority; cooperation between authorities
| Clause | Functionality | Explanation |
|---|---|---|
| (7) The BBK and competent authorities transmit to each other the information required for the other side to perform its tasks, in particular information on risks and incidents and on measures taken under this Act, the BSI Act, the Energy Act, the Telecommunications Act, and Regulation (EU) 2022/2554; senders and recipients agree on processes for handover and for preserving the necessary confidentiality. | Log360 - Log collection from 750+ sources, correlation, dashboards, searchable archive. | Log360 centralizes risk- and incident-relevant event data from AD, endpoints, network devices, and cloud sources, and makes it available as searchable, exportable reports that support the inter-authority information exchange this clause requires on the operator's side. The clause also governs confidentiality agreements between authorities, which is a procedural arrangement outside Log360; the product supports it only by scoping report access through role-based access controls, and the customer must define the confidentiality processes themselves. |
§ 8§ 8 Registration of critical installations; point in time of applicability
| Clause | Functionality | Explanation |
|---|---|---|
| (6) Where the particulars to be transmitted under subsection (1) change, updated supply-grade values shall be transmitted once a year and all other particulars without undue delay, at the latest within two weeks of the operator becoming aware of the change. | Log360 - Audit trail, scheduled reporting. | Log360's audit trail records changes to the accounts and attributes that underlie the registered particulars, and scheduled reporting surfaces those changes so the operator knows when a two-week update to the BBK is due. The actual transmission of updated particulars to the BBK is a manual filing and is not performed by Log360. |
§ 11§ 11 National risk analyses and risk assessments
| Clause | Functionality | Explanation |
|---|---|---|
| (2) No. 6 The risk analyses and risk assessments shall take into account at least relevant information on incidents reported under § 18. | Log360 - Incident dashboards, correlation, log retention, searchable archive, compliance and audit reporting. | Log360 records, correlates, and retains incident data and produces the analytical reports and dashboards that let the operator supply incident information as an input to risk analysis. The national risk analysis is conducted by federal and state ministries, so this mapping covers only the operator-side data and evidence that feed it, not the ministries' assessment process. |
§ 12§ 12 Risk analysis and risk assessment of the operator of critical installations
| Clause | Functionality | Explanation |
|---|---|---|
| (1) The operator shall carry out, at least every four years, a risk analysis and risk assessment taking into account the risks in § 11(2) No. 1 and risks capable of impairing the availability of critical services arising from dependencies on other operators and sectors. | Log360 - UEBA risk scoring, correlation engine, threat intelligence, incident dashboards, log analytics. | Log360 supplies evidence for the risk analysis by baselining activity, scoring user and entity risk, correlating events, and enriching them with threat intelligence. These capabilities inform the operator's assessment but do not constitute the full methodology; the four-year risk analysis is an organizational process that also weighs physical, supply-chain, and cross-sector dependencies outside Log360, which the operator must integrate itself. |
§ 13 § 13 Resilience obligations of operators of critical installations; resilience plan
| Clause | Functionality | Explanation |
|---|---|---|
| (1) No. 1 The operator shall take measures to ensure its resilience so as to prevent the occurrence of incidents. | Log360 - Correlation engine, threat intelligence, UEBA, real-time alerts, 2000+ MITRE-mapped detections. | For incidents with a logical-access or IT dimension, Log360's detections, correlation, and behavioral analytics support prevention by surfacing precursors early. This clause is framed around all-hazards physical resilience, so prevention of natural, structural, and physical threats is out of scope for Log360 and must be addressed through the operator's physical protection measures. |
| (1) No. 2 The operator shall ensure adequate physical protection of premises and critical installations. | Log360 - Access and logon monitoring, real-time alerts. | This clause addresses physical protection of premises, delivered through building security, perimeter hardening, and physical access control that are outside the scope of Log360. The suite contributes only to the logical-access layer of installation protection: Log360 monitors and alerts in real time on machine, VPN, and application access events at those installations. Physical barriers, surveillance hardware, and detection devices must be supplied separately. |
| (1) No. 3 The operator shall take measures to respond to incidents, repel them, and limit their adverse effects. | Log360 - SOAR playbooks, automated incident response workflows, Incident Workbench, alert profiles, ITSM integration. | Log360 supports incident response for IT-related events through automated playbooks, correlation-triggered workflows, the Incident Workbench for guided investigation, and ITSM ticket creation that assigns and tracks response. For physical incidents these capabilities help only where the event is visible in logs or identity activity; containment of physical events relies on the operator's crisis-management and physical-response procedures, which Log360 does not perform. |
| (3) No. 5 The operator shall ensure adequate security management with respect to personnel, including the personnel of external service providers. | Log360 - Privileged user monitoring, UEBA. | Log360 addresses the monitoring dimension of personnel security: privileged user monitoring and behavioral analytics surface anomalous or high-risk activity by employees and by external service-provider staff working in the environment. Personnel reliability screening and vetting under the applicable German security-screening laws are a procedural function outside Log360, which the operator must run separately. |
| (4) The operator shall present the measures under subsection (1) in a resilience plan and apply it; the plan must show the underlying considerations and refer to the operator's risk analysis and risk assessment, and shall be updated as needed. | Log360 - Compliance report templates, dashboards, searchable archive. | Log360 generates the documented audit and monitoring evidence that populates the IT sections of the resilience plan and links measures back to identified risks. The resilience plan itself is an operator-authored document covering physical, organizational, and personnel measures as well. Log360 supplies supporting evidence for its portion but does not author or maintain the plan. |
§ 16§ 16 Evidence and administrative orders concerning resilience obligations
| Clause | Functionality | Explanation |
|---|---|---|
| (1) To verify compliance with § 13(1), the competent authority may, via the BBK, request from the BSI the evidence submitted under § 39 of the BSI Act. | Log360 - Compliance report templates, audit trail, searchable archive, scheduled reports. | Where the physical-resilience evidence overlaps with the risk-management evidence submitted under the BSI Act, Log360 produces the underlying compliance reports, audit trails, and monitoring logs that make up that evidence. The transfer of evidence between the BSI, the BBK, and the competent authority is an inter-authority process; Log360's role is to generate and retain the operator-side records that are exchanged. |
| (2) The competent authority may require individual operators to submit further information and suitable evidence, in particular the resilience plan, selecting operators on a risk-based approach. | Log360 - Compliance and audit reports, log retention, searchable archive, export. | Log360 holds and exports the audit trails and monitoring evidence that an operator submits to demonstrate compliance with § 13(1), and its retention and search functions make historical evidence retrievable on request. Assembling the full resilience plan, which includes physical and organizational measures, remains an operator task; Log360 supplies the IT evidence within it. |
| (3) Evidence of compliance with § 13(1) may be provided through audits; the operator shall transmit the audit results to the competent authority on request, including any deficiencies identified. | Log360 - Audit-ready reports, log retention, searchable archive. | Log360 provides the audit-ready reports, retained logs, and searchable historical records that auditors examine and that substantiate audit findings for the IT controls within § 13(1). Conducting the audit and transmitting its results to the authority are actions performed by the operator and the auditor; Log360 supplies the evidence base rather than the audit process itself. |
| (4) The competent authority may verify compliance with § 13(1) at selected operators, including on-site inspection, and the operator shall grant access to information, systems, and installations and present relevant records on request. | Log360 - Searchable archive, audit reports, log retention, export. | For inspection of IT controls, Log360 makes the relevant records, audit reports, and logs available and exportable so the operator can present them during a verification. Granting physical access to premises and installations, and inspection of physical controls, falls outside Log360; the mapping covers only the documentation and system-record portion of the inspection. |
| (5) In the event of deficiencies, the competent authority may order the submission of a suitable remediation plan and remediation measures within a reasonable period, and may require evidence of remediation. | Log360 - Deficiency tracking via incident workflows, ITSM integration, remediation reporting. | Log360's incident workflows and ITSM integration can track identified IT-control deficiencies through to closure, and its remediation reporting evidences that the corrective actions were carried out, supporting the evidence-of-remediation requirement. Producing the remediation plan and completing physical or organizational fixes are operator responsibilities; Log360 documents and evidences the IT-side remediation. |
§ 18§ 18 Incident reporting
| Clause | Functionality | Explanation |
|---|---|---|
| (1) The operator shall report incidents to the BBK without undue delay, at the latest within 24 hours of becoming aware, via the joint reporting point; a continuing incident's initial report shall be updated, and a detailed report shall be transmitted within one month. | Log360 - Real-time alerts, incident dashboards, correlation, Incident Workbench, audit trail, searchable archive. | Log360 detects and time-stamps IT-observable incidents in real time and provides the dashboards, correlation, and Incident Workbench evidence the operator needs to compile the initial 24-hour report and the detailed one-month follow-up. Reports concerning purely physical incidents draw on the operator's own detection, and the submission to the BBK's reporting point is a manual filing; Log360 supplies the detection and evidential record for events visible in logs and identity activity. |
| (2) The reports shall contain the information available at the time needed to determine the nature, cause, and possible cross-border effects of the incident, in particular the number and proportion of those affected, the duration, and the geographic area concerned. | Log360 - Incident timelines, correlation, Zia Insights summaries, dashboards, reports. | For IT-observable incidents, Log360 reconstructs the nature and probable cause through correlated event timelines and AI-generated incident summaries, and its dashboards quantify scope such as affected systems and duration. Figures such as the proportion of the population affected and the physical geographic area are operational data the operator derives from service impact; Log360 supports the technical portion of the report content, not the service-level impact assessment. |
§ 20§ 20 Implementation and oversight duty for management
| Clause | Functionality | Explanation |
|---|---|---|
| (1) The management of operators of critical installations shall implement the resilience measures to be taken under § 13(1) and ensure their implementation through appropriate organizational measures. | Log360 - Dashboards, compliance reports, audit trail. | Log360's dashboards, compliance reports, and audit trail give management the visibility and accountability record it needs to oversee the IT measures within § 13(1) and to evidence that those measures are in force. Management's duty extends to physical and organizational measures Log360 does not cover; the mapping applies only to the IT controls management oversees. |
§ 23§ 23 Processing of personal data
| Clause | Functionality | Explanation |
|---|---|---|
| (1) Processing of personal data by the competent bodies is permissible where necessary to perform their tasks and where anonymized or synthetic data would not be equally suitable. | Log360 - Role-based access to reports, audit trail of data access, log retention controls. | Log360 supports lawful, need-to-know processing by restricting access to personal data in reports and records through role-based access controls and by auditing who accessed that data, with retention controls governing how long it is held. The lawfulness assessment and the data-minimization judgment this clause requires are governance decisions made by the operator or authority; Log360 enforces and evidences access restrictions but does not make the necessity determination. |
Conclusion
Now that you've explored how the KRITIS-Dachgesetz reshapes resilience obligations for operators of critical installations across Germany and how Log360 helps you address them, it's time to take the next step.
Whether it's access governance, audit logging, incident detection, meeting the 24-hour reporting window, or building a compliance-ready evidence trail for your resilience plan, we're here to guide you through it. Start a 30-day free trial to experience our solutions in your own environment, or contact us to schedule a one-on-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended to serve as professional, legal, or regulatory advice. Compliance with the KRITIS-Dachgesetz depends on your organization's specific environment, processes, and risk profile — including whether your installations meet the applicable thresholds, which are based on a benchmark of at least 500,000 people affected by an outage alongside qualitative criteria such as interdependencies, market share, and geographic reach, and noting that the federal states may set lower thresholds.
To accurately assess your compliance posture, we strongly recommend engaging a qualified consultant, compliance agency, or referring directly to the official legislative text and guidance published by the Bundesministerium des Innern (BMI) and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe (BBK) on bbk.bund.de and in the Bundesgesetzblatt (KRITIS-Dachgesetz vom 11. März 2026, BGBl. 2026 I Nr. 66).