KRITIS laws: which obligations and which liability apply to operators of critical infrastructure?
With the German KRITIS umbrella act and NIS2, physical resilience and cybersecurity move into focus in equal measure. Operators of critical infrastructure must assess risks, implement protective measures and prove them. We show where the airspace is often overlooked as part of resilience.
.png)
Why the KRITIS obligations put many operators under pressure.
The requirements from the KRITIS umbrella act and NIS2 are growing, yet many critical infrastructure companies struggle to implement their obligations concretely. Three weak points keep showing up in practice.
Unclear obligations
What is critical infrastructure, who counts as an operator and which obligations follow concretely? Between the KRITIS umbrella act, NIS2 and sector-specific requirements it is hard to keep an overview and derive the right measures.
Airspace as a blind spot
Physical resilience is mostly thought of on the ground: fence, access, cameras. The airspace above the facility often remains unobserved. Yet unmanned aircraft can spy on, disrupt or endanger facilities without a ground-based solution noticing anything.
Personal liability risks
If risk management is not properly organized, organizational fault may exist. Management is then personally responsible. Gaps in the protection concept are therefore not only a security issue but also a liability issue.
Critical infrastructure, KRITIS laws and operator obligations at a glance.
What is critical infrastructure? Critical infrastructure comprises facilities and installations whose failure or impairment would have significant consequences for public supply and public safety. The definition of critical infrastructure is based on sectors in which a supply shortage quickly affects wide circles.
The sectors typically include energy, water, food, transport and traffic, health, finance and insurance, as well as information technology and telecommunications. Whether a company operates critical infrastructure and thus counts as an operator depends on sector, type of facility and thresholds. The exact classification should always be made on the basis of the current legal situation.
KRITIS umbrella act and NIS2 as the framework. While the NIS2 directive primarily addresses cybersecurity and IT risk management, the KRITIS umbrella act focuses on physical resilience. Both frameworks interlock: the aim is to secure critical infrastructure against a broad spectrum of threats, from cyberattacks to physical interference on site.
Which obligations apply to operators? At the core there are four building blocks. First, systematic risk management that records and assesses relevant hazards. Second, appropriate resilience measures that adapt the level of protection to the identified risks. Third, reporting obligations when significant disruptions or incidents occur. And fourth, evidence with which implementation is demonstrated to the competent authorities.
Protecting critical infrastructure is not a one-off project but an ongoing process. Threat situations change, new technologies emerge, and so protective measures must be regularly reviewed and adapted.
Personal liability of management.
Responsibility for ensuring that these obligations are met lies with company management. If necessary measures are not organized or only inadequately organized, organizational fault may arise. The managing director's liability can then apply personally. Scope and requirements follow from the applicable law and should be reviewed by legal counsel. This article does not replace legal advice.
Physical protection and airspace security.
In practice physical resilience means more than fence and access control. The airspace above a facility is a separate attack vector. Unmanned aircraft can carry out reconnaissance, disrupt areas or be used deliberately. Anyone protecting critical infrastructure must consider the airspace as part of resilience, and this is exactly where a surveillance drone combined with drone detection and counter-drone measures comes in.
Security Airline combines an autonomous surveillance drone, ground sensors and a VdS-certified control center into a multi-layer concept. This links the physical protection of facilities with surveillance of the airspace. A structured security concept forms the basis and assigns the measures to the identified risks.
For typical KRITIS properties, sector-specific priorities often emerge, for example in protecting high-voltage pylons and substations in energy supply or in monitoring railway lines in the transport sector. Alarm handling takes place either with trained staff or in a VdS-certified control center, which ensures traceable processes and verifiability.
Important: which specific obligations apply to your company and which measures are required can only be assessed case by case. We provide the security technology contribution to physical resilience and airspace security. The legal review should be carried out additionally by qualified advisors.
How does Security Airline support the protection of critical infrastructure?
We deliver the security technology part of physical resilience and turn the airspace into an actively monitored part of your protection concept. Three approaches are at the center.
Actively monitor the airspace
From the aerial perspective, large areas of critical infrastructure can be scanned quickly with AI support. Detection and defense against foreign drones close the often forgotten airspace as part of resilience.
Multi-layer security concept
Risk assessment, ground sensors, drone and control center interlock. The multi-layer concept assigns resilience measures to the risks and thus supports providing evidence to authorities.
Documented processes
A VdS-certified control center and defined alarm plans ensure traceable procedures. This helps meet reporting obligations and makes the implementation of resilience measures verifiable.
One solution, three components.
For the protection of critical infrastructure we combine hardware, control center and software into a multi-layer concept. Many automated flights and smart AI raise the chance of detecting anomalies on the ground and in the airspace early.
Arrow-401 LR drone and docking station
Purpose-built drone system with redundant communication electronics and a large UPS. You rely on the drone to replace other solutions dependably. Off-the-shelf drones lack this technology.
VdS-certified emergency and service control center
Alarms are handled by trained pilots on the customer side, such as the plant fire brigade, or in a VdS-certified control center. Essential for a high quality level and reliable processes, even during a power outage.
Flight Automation Center with AI
Our own secure flight automation software with intrusion AI. Controls the drone automatically, plans irregular patrols and integrates with existing sensors such as motion detectors.
What Security Airline takes over for KRITIS operators.
You should focus on your supply mandate and not have to run an airline yourself. We take over the many pieces of the puzzle needed for reliable drone operations as part of your physical resilience.
150,000+ surveillance flights
Extensive experience in drone operations across all sites.
Initial consultation with security analysis
Free and without obligation, on site or remote.
Security concept (optional)
Multi-layer concept to raise the security level, including potential insurance savings.
Project planning & EU approval
Flight planning, alarm plan and approval across the entire EU, including Switzerland and Norway.
Redundant communication & UPS
So the drone reliably replaces other solutions, even during a power outage.
Installation of drone system & sensors
Integration with motion detectors, cameras and existing infrastructure.
Regular maintenance
We keep spare parts in stock and secure the availability of your drone surveillance permanently.
Proprietary software "Flight Automation Center"
Secure in-house development with intrusion AI for maximum detection quality.
Autonomous. Weatherproof.
Ready around the clock.
The Arrow-401 LR drone system launches on its own, when an alarm is triggered or at predefined patrol intervals. The system is fully operational at night, in wind or in sub-zero temperatures.
The rugged, VdS-certified drone is charged, protected and monitored in the integrated docking station. It handles climate control, telemetry and maintenance monitoring and thus ensures uninterrupted operation.
The result: less personnel effort, higher deployment frequency and significantly lower operating costs, especially for large, hard-to-see areas without permanent guard staffing.
Why our customers rely on drone monitoring
%201.avif)
Olaf Besser
Management
Heating network system technology from manufacturers YADOS. District heating stations and heating systems for efficient energy applications from Saxony.
Nowadays, it is increasingly important to work efficiently and cost-effectively. This also applies to entire facility management — this includes monitoring. The Security Airline system impressed us both in terms of price and technology.
Kathi Gerstner
(press spokesperson)
The LEAG Group not only provides electricity and heat. We offer companies, cities and municipalities a wide range of other products and services.
For several months now, the Lusatian energy supplier Leag has been using several Security Airline surveillance drones in combination with artificial intelligence to monitor its industrial plants more effectively and protect them from theft and unauthorised access.
Sebastian Hanne
Business Development Manager
We offer burglary protection, convenience and automation, fire protection and security, and video surveillance. Everything integrated in one system.
Our sensors harmonize perfectly with Security Airline's drone system. After an alarm has been triggered via the infrared motion detectors, the surveillance drone flies fully automatically to the marked location and illuminates the area.
.svg){kind=icon}
.svg)