BSI requirements catalogue for CRITIS operators and auditors

This article looks at the BSI document “Konkretisierung der Anforderungen an die gemäß § 8a Absatz 1 und Absatz 1a BSIG umzusetzenden Maßnahmen“ with its requirements and checklist for CRITIS operators and auditors.

The BSI document „Konkretisierung der Anforderungen an die gemäß § 8a Absatz 1 und Absatz 1a BSIG umzusetzenden Maßnahmen“, last updated on 10 September 2024, provides detailed requirements and a checklist for critical infrastructure operators (CRITIS) and audit bodies in Germany. It specifies the legal requirements according to § 8a Abs. 1 and 1a BSIG and defines a quasi-standard for cybersecurity in CRITIS with 135 controls. The catalogue also contains test criteria for evaluating security precautions and requirements for physical protection, as described in Section 2.7 on physical security.

Important note:
The current BSIG, and therefore the Requirements Catalogue, is valid until the NIS2UmsuCG (German) comes into force and a new BSIG is in place. Depending on political developments, this is expected in the course of 2025. An update of the catalogue of requirements is planned, taking into account the requirements of the NIS-2 Implementation and Cyber Security Strengthening Act (NIS2UmsuCG).

The most important facts at a glance:

BSI Requirements Catalogue for CRITIS Operators and Auditors

• The catalogue of requirements provides CRITIS operators and audit bodies with a specification of the requirements of § 8a Absatz 1 und Absatz 1a BSIG (German).
• In addition, the catalogue of requirements provides auditing bodies with suitable criteria for an appropriate audit of the security measures applied, in order to be able to provide the required evidence in accordance with § 8a Absatz 3 BSIG .
• The BSI document “Konkretisierung der Anforderungen (KdA)“ with 135 controls defines basic cybersecurity requirements as a quasi-standard for CRITIS operators.
• However, the catalogue of requirements also includes requirements for physical protection:
  • See 2.7 Physical Security (page 21)
    a.o:
    72.perimeter protection (PS-01)
    73.physical access protection (PS-02)
    74.protection against external threats (PS-03)

Especially for: 72.perimeter protection (PS-01)

• An appropriate framework for the structural and physical security required for the secure operation of a critical service shall be established.
• The perimeters of premises or buildings housing sensitive or critical information, information systems or other network infrastructure shall be physically sound and protected by appropriate state-of-the-art security measures.
• The security policy shall include the establishment of different security zones, separated by security perimeters, with monitored and secured transitions between the zones where necessary to protect the critical service.