The KRITIS Resilience Plan is the central document through which operators of critical facilities demonstrate, in accordance with the KRITIS-Dachgesetz (KRITISDachG), how they safeguard their critical services against disruptions. It is not an additional bureaucratic burden alongside Business Continuity Management, but rather consolidates what a well-functioning BCM organisation would develop anyway, in relation to the risk analysis as per § 12 KRITISDachG.
Table of Contents
Brief Explanation
The Resilience Plan in Four Points
Deadlines
What Applies from Registration
§ 13 KRITISDachG
An Overview of the Five Paragraphs
Structure
A Suggested Outline Until the Official Template
BCM as a Foundation
What Can Be Adopted from Business Continuity Management
Evidence and Obligations
What Applies After the Plan is Created
Typical Weaknesses
Why Resilience Plans Fail in Practice
Frequently Asked Questions
Templates, Emergency Manual, and Risk Analysis
Further Reading
Deepening and Support
Sources
References and Further Sources
Brief Explanation
The Resilience Plan in Four Points
- What: Presentation of the resilience measures of an operator of critical facilities, including the considerations behind them and the reference to the risk analysis (§ 13 para. 4 KRITISDachG).
- Purpose: The measures serve four objectives. They aim to prevent incidents, adequately protect premises physically, respond to incidents and limit their consequences, and swiftly restore the critical service (§ 13 para. 1).
- When: The obligation first applies ten months after registration (§ 8 para. 7). Operators must register only when the ordinance determining critical facilities comes into force; this is currently only available as a draft.
- How often: The plan must be applied and updated as needed and after each risk analysis (§ 13 para. 4); the risk analysis must be repeated at least every four years.
Overview of Deadlines
What Applies from Registration
The KRITIS-Dachgesetz has been in force since 17 March 2026. However, the deadlines for operators only commence with registration, and the registration obligation depends on an ordinance that defines which facilities are considered critical.
| Step | Deadline | Basis |
|---|---|---|
| Enactment of the KRITIS-Dachgesetz | 17 March 2026 | BGBl. 2026 I No. 66 |
| Regulation for determining critical facilities | still pending; a draft has been available since May 2026 | § 4 Para. 3, § 5 Para. 1 |
| Registration | three months after the facility is deemed critical (i.e., only after the regulation comes into force) | § 8 Para. 1 |
| Operator’s risk analysis | initially nine months after registration, then at least every four years | § 12, § 8 Para. 7 |
| Resilience measures and resilience plan | initially ten months after registration | § 13, § 8 Para. 7 |
| Incident reporting | from ten months after registration; initial report within 24 hours, detailed report after one month | § 18 |
| Templates and samples from BBK | at the latest eight months after the regulation comes into force | § 13 Para. 5 |
As of October 2026, according to the Federal Office of Civil Protection and Disaster Assistance (BBK), there is still no registration requirement because the regulation is still being developed and coordinated. The previously mentioned date of 17 July 2026 has been removed from the law. Nevertheless, the BBK recommends already addressing one’s own resilience. Three steps are particularly sensible: clarifying the impact, appointing a contact point, and preparing the risk analysis. Then, with the regulation, only the registration itself remains.
Does the KRITIS-Dachgesetz affect you?
Our free impact check gives you a preliminary assessment in just a few minutes, whether as an operator or a supplier. You will receive the evaluation with the points you should now check as a PDF.
What § 13 KRITISDachG Requires
An overview of the five paragraphs
- Objectives (Para. 1): Measures to prevent incidents, ensure adequate physical protection of premises, respond to incidents and limit their impact, and swiftly restore critical services.
- Proportionality (Para. 2): The measures must be proportionate and based on national risk analyses as well as the operator’s risk analysis. The state of the art should be maintained; economic aspects, including the operator’s capabilities, must be considered.
- Catalogue of Measures (Para. 3): for example, emergency preparedness, physical security (property protection, detection, access controls), risk and crisis management procedures, maintaining operations (such as emergency power supply), alternative supply chains, personnel security management, as well as training and awareness, unless specific legal regulations of the respective sector take precedence.
- Resilience Plan (Para. 4): The measures are to be presented and applied in a resilience plan. The plan should reveal the underlying considerations, refer to the risk analysis, and be updated as needed and after conducting a risk analysis.
- Templates (Para. 5): The BBK will provide templates and samples for resilience plans on its website no later than eight months after the regulation for determining critical facilities comes into force.
Structure of a KRITIS Resilience Plan
A proposed outline until the official template is available
The law does not prescribe a structure, and the templates from the BBK are, according to the BBK, still in preparation. The following outline is derived from the requirements of § 13 and can later be adapted to the official template.
| Section | Content | Reference |
|---|---|---|
| 1. Scope | Critical facility(ies), critical service, locations, interfaces with service providers | § 8 (Registration) |
| 2. Result of the Risk Analysis | Key risks and scenarios, assessment, status and date of the analysis | § 12, § 13 para. 4 |
| 3. Critical Processes and Resources | Time-critical processes from the Business Impact Analysis, maximum tolerable downtime, dependent resources and suppliers | § 13 para. 1 |
| 4. Measures per Objective | Prevention, physical protection, response and containment, recovery; each with purpose, responsible parties, status and deadline | § 13 para. 1 and 3 |
| 5. Justification of Proportionality | Why a measure was chosen, postponed or discarded; risk versus effort | § 13 para. 2 |
| 6. Organisation | Roles, crisis management team, alerting, communication, incident reporting path | § 13 para. 3, § 18 |
| 7. Personnel and Awareness | Security management for personnel, training, exercises | § 13 para. 3 |
| 8. Testing and Exercise | Exercise plan, results, derived improvements | § 13 para. 4 (Application) |
| 9. Maintenance | Occasions and frequency of updates, change history, approval by management | § 13 para. 4 |
BCM as a Foundation
What can be adopted from Business Continuity Management
Those who operate a Business Continuity Management system according to ISO 22301 or BSI Standard 200-4 already have a large part of the content. The Business Impact Analysis provides the time-critical processes and resources, the recovery planning covers the goal of rapid restoration, and the crisis management addresses the response to incidents. New is primarily the explicit reference to physical threats and the obligation to justify the proportionality of each measure transparently.
For the risk analysis itself, the fundamentals of risk management provide the methodological framework. How resource risks can be consolidated into a corporate risk through processes and locations is described in the article on risk aggregation.
Evidence and Obligations
What applies after the plan is created
With the completed KRITIS Resilience Plan, the obligations are not fulfilled. The KRITIS-Dachgesetz also regulates how operators must provide evidence of their measures, how they report incidents, and who is responsible within the company.
| Obligation | What applies | Basis |
|---|---|---|
| Evidence | The competent authority can request risk-based selected operators to provide information and evidence, particularly the resilience plan. Evidence can also be provided through audits; their results, including identified deficiencies, must be submitted upon request. | § 16 para. 2 and 3 |
| Inspection and Deficiencies | The authority can inspect compliance on-site, also with a qualified independent third party. In case of deficiencies, it can order a deficiency remediation plan and measures with a deadline. | § 16 para. 4 and 5 |
| Incident Reporting | Initial report immediately, at the latest 24 hours after awareness, to the joint reporting centre of BBK and BSI; detailed report at the latest one month after awareness. | § 18 |
| Management | They must implement the resilience measures and ensure their implementation through appropriate organisational measures. In the event of culpable breach of duty, they are liable to the institution according to corporate law rules. | § 20 |
| Minimum Requirements | The Federal Ministry of the Interior can establish cross-sector minimum requirements by regulation. Operators and industry associations can propose sector-specific resilience standards, whose suitability is determined by the BBK. | § 14 |
| Fines | Up to €1 million for violations of registration orders, up to €500,000 for not or incorrectly transmitted audit results, up to €200,000 for violations of orders under § 16, otherwise up to €100,000. | § 24 |
The BBK is currently coordinating how the evidence should be provided in detail; according to the BBK, the minimum requirements are also under coordination. In practice, this means: have the resilience plan approved by management, establish the reporting path for incidents, and store the evidence in such a way that it can be presented upon request. For certain operators in the energy sector, the rules of § 5f EnWG apply instead of § 16.
Typical Weaknesses
Why resilience plans fail in practice
- Measures without a discernible connection to a risk from the risk analysis.
- No justification for why a measure is not implemented, even though this is precisely what the principle of proportionality requires.
- Dependencies on suppliers and service providers are not considered, even though alternative supply chains are expressly part of the action plan.
- The plan is created but not practised and not updated after the next risk analysis.
Frequently Asked Questions
Templates, emergency manual and risk analysis
Do I need to take action now?
There is currently no legal deadline as long as the ordinance is not in force and no registration has occurred. However, the BBK recommends already addressing resilience. Those who prepare for impact, contact points, and risk analysis gain time for the actual measures, as only ten months remain for the resilience plan after registration.
Is there an official template or model for the resilience plan?
Not yet. According to § 13 para. 5, the BBK will provide templates and models no later than eight months after the ordinance comes into force; according to the BBK, they are in preparation. Until then, a structure based on paragraphs 1 to 4 is recommended.
Does an existing emergency manual replace the resilience plan?
Not entirely. An emergency manual primarily covers response and recovery. The resilience plan additionally includes prevention and physical protection, the connection to the risk analysis, and the justification of proportionality.
How are risk analysis and resilience plan related?
The risk analysis according to § 12 is the foundation. It must be conducted for the first time nine months after registration and repeated at least every four years. After each risk analysis, the resilience plan must be updated.
Further Information
In-depth and support
- KRITIS Impact Check
- Overview of the KRITIS-Dachgesetz
- Business Continuity Management
- Resilience as a Complete System
- NIS2 in Germany
- KRITIS-Dachgesetz Training
- Resilience Radar with Current Situation and Dependencies
- Request Consultation for Resilience Plan
Sources
- § 13 KRITISDachG, Resilience obligations of operators of critical facilities; Resilience plan: gesetze-im-internet.de
- §§ 14, 16, 18, 20 and 24 KRITISDachG, Minimum requirements, evidence, reporting, management and fines: gesetze-im-internet.de
- Act to Implement Directive (EU) 2022/2557 and to Strengthen the Resilience of Critical Facilities, BGBl. 2026 I No. 66: recht.bund.de
- Federal Office of Civil Protection and Disaster Assistance, FAQ on the KRITIS-Dachgesetz: bbk.bund.de
- Noerr, The new KRITIS Regulation (09.06.2026): noerr.com
- IHK Köln, KRITIS-Dachgesetz: What companies need to know and do now: ihk.de
Resilienz-Lagebericht – monatlich, kostenfrei
Aktuelle Ausgabe: Monatsbericht September 2026. Gesamtlage, die wichtigsten Lagen mit Angabe der Belastbarkeit, Sektor-Exposition und was jetzt zu prüfen ist – als PDF.
