Critical infrastructure evidence now available for online submission

Source: Energy & Management Powernews, September 16, 2022

The biennial proof of the security of all elementary IT systems, components and processes can now be submitted digitally.

At least every two years, operators of critical infrastructures (kritis) must prove to the German Federal Office for Information Security (BSI) that their IT systems, components and processes that are elementary to their operations are secured according to the state of the art. As part of the implementation of the Online Access Act (OZG), the BSI has now digitized this verification process. Evidence on around 2,000 critical infrastructures can now be submitted to the BSI via the Administration Portal Bund , according to the BSI.

To make use of the service, Kritis operators authenticated themselves with the nationwide standardized Elster company account and could thus securely transmit sensitive data to the BSI.

In doing so, the operators transmitted the results of the checks carried out to the BSI with the help of verification documents, including any security deficiencies discovered. The BSI then checks whether their precautions and measures meet the legal requirements. The BSI can demand the subsequent submission of further audit documents and, in the case of security deficiencies, the elimination of the security deficiencies.

The digital provision of evidence is the second administrative service that the BSI is digitizing as part of the OZG in cooperation with the Federal Ministry of the Interior and for the Home Affairs (BMI). The BSI is thus fulfilling its obligation to implement the OZG, which stipulates that in a first digitization step a total of 575 administrative services at federal, state and municipal level will be digitized and made accessible in an IT infrastructure to every user simply with a few clicks.

Since critical infrastructures are elementary for the state polity, their failure or impairment can result in supply bottlenecks, significant disruptions to public safety or other dramatic consequences. Therefore, regular proof of compliance with the state of the art is required by law.

Author: Katia Meyer-Tien