Review of minimum technical and organ­i­sa­tional security standards — KritisVO

The IT Security Act (ITSiG) and the BSI Act require operators of critical infra­struc­tures to comply with minimum technical and organ­i­sa­tional security standards, among other things. The under­lying idea of the decrees is that the security measures are based on the state of the art in the operator’s industry in order to avoid IT malfunc­tions or failures.

For operators of critical infra­struc­tures, this fuzzy formu­lation raises many a question:

• WWhat are the minimum technical or organ­i­sa­tional standards?
• Where do we, as operators of critical infra­structure, exceed this minimum standard and where do we deviate from it?
• GIs there a specific state of the art in my industry and if not, what can I orientate myself on, or how can I define such an industry-specific standard?
• Which audits and certi­fi­ca­tions already completed simplify the verifi­cation process towards the BSI?

This scope for inter­pre­tation has been delib­er­ately granted by law. The first step is to take an overview of the audit reports to be submitted in the first step with regard to the precau­tions taken by the operators and the security levels customary in the industry. In addition, the sectors are to be given the oppor­tunity to agree on industry-specific security standards (B3S).

If no specific security standards are developed for an industry, the BSI has the oppor­tunity to specify these security standards. A corre­sponding possi­bility is granted by KritisVO.

This is an oppor­tunity that critical infra­structure operators should seize. It is to be expected that the Federal Office for Infor­mation Security (BSI) will propose a more detailed formu­lation of the KritisVO on the basis of the findings gained in the first audit round.

We would be pleased to offer you the oppor­tunity to draw on the expertise of our experts when checking your technical and organ­i­sa­tional security standards. We would also be pleased to support you in formu­lating your industry-specific standards.