Important vs Essential vs KRITIS: The Same Work, Different Consequences

§31 — Attack Detection Systems (Angriffserkennungssysteme)

You need a system watching your network around the clock that can spot attacks in progress or detect that someone has already broken in. In practice, this means deploying a SIEM (Security Information and Event Management) — software that collects logs from every server, firewall, and endpoint, correlates them, and alerts on anomalies. It must use pattern matching AND anomaly detection, not just signatures. Most companies outsource this to a managed SOC (Security Operations Center) provider, which typically costs 5,000-15,000 EUR per month. Normal NIS2 entities can get by with basic monitoring — KRITIS operators explicitly cannot.

§33(2) — Enhanced Registration with BSI

On top of the standard registration (name, sector, contact), KRITIS operators must tell BSI exactly what critical service they provide (e.g. 'drinking water supply for 200,000 people'), what critical components they use, the physical facility location, and a 24/7 contact person reachable at any hour. Supply metrics must be reported annually — BSI uses these to verify you still exceed the KRITIS threshold (defined in BSI-KritisV, e.g. 500,000 people served for water, 104 MW for power).

§39 — Mandatory Compliance Proof Every 3 Years (Nachweispflicht)

Every 3 years, you must proactively submit audit results, security reports, or certifications to BSI proving compliance with all §30 measures and §31 attack detection. BSI does not have to come find you — you come to them. If BSI finds deficiencies, they issue binding remediation orders with deadlines and demand proof that you fixed the issues. Think of it as a mandatory ISO certification cycle, except the auditor is the government. First deadline: December 2028 (5 years for hospitals: December 2030).

Can my company be both important and essential?

No. The categories are mutually exclusive under §28 BSIG. If you meet the essential threshold (250+ employees or >50M revenue in an Annex I sector), you are essential. If you meet the important threshold but not the essential one, you are important. KRITIS is a subset of essential — KRITIS operators are automatically classified as essential with additional obligations on top.

I am an important entity. Do I need to do less compliance work?

No. The 10 security measure categories in §30(2) BSIG apply identically to both important and essential entities. The only difference is enforcement: BSI supervises essential entities proactively (random audits) and important entities reactively (only after evidence of non-compliance). But the measures themselves, the incident reporting timelines, and management liability are all the same.

How do I know if I am KRITIS?

KRITIS classification is defined in the BSI-KritisV regulation, based on specific supply thresholds: 500,000 people served for water, 104 MW installed capacity for power, 30,000 inpatient cases per year for hospitals, etc. If your infrastructure failure would not directly disrupt public supply at these scales, you are not KRITIS. Most mid-market companies are not KRITIS — they are important or essential entities.

What happens if I get my entity classification wrong?

Classification determines supervision intensity and penalty caps, not what you need to implement. If you implement all 10 measure categories (which NISD2 guides you through), you are compliant regardless of classification. The risk of misclassification is underestimating your supervision exposure — thinking BSI will not audit you when they actually can.

Does the CIR 2024/2690 distinguish between important and essential entities?

No. The CIR applies to specific entity types (cloud providers, DNS providers, managed service providers, etc.) regardless of whether they are classified as important or essential. The technical requirements in the CIR are identical for both categories.