BSI KRITIS and the Cloud 2026: NIS2, the Umbrella Law and C

The NIS2 Implementation Act has been in force since December 6, 2025, and the Bundestag passed the KRITIS Umbrella Act on January 29, 2026. The BSI has released a revised criteria catalog for secure cloud computing with C5:2026. Cloud operators in Germany must now read these three regulations together, rather than processing each one individually. Those who don’t consider the triad as a unit will double compliance costs and build parallel structures that no one wants to maintain.

Key Takeaways

RelatedAI Inference Architecture for DACH 2026  /  Reshoring in SMEs

What’s New and When It Applies

What is KRITIS in a regulatory sense? KRITIS refers to critical infrastructures whose failure or impairment would trigger significant supply bottlenecks or threats to public safety. The sectors include energy, water, food, IT and telecommunications, healthcare, financial and insurance services, transport and traffic, as well as government and administration. The legislator defines threshold values per sector, above which a facility is considered KRITIS and assumes corresponding obligations.

The NIS2 implementation law has significantly expanded the circle of addressees. In addition to the classic KRITIS operators, particularly important and important facilities are now also subject to extended security obligations, which, according to analyses by the BSI and the specialist portal OpenKRITIS, applies to around 30,000 companies in Germany. This is relevant for cloud operators because they often operate their own IT infrastructure as critical and also provide services for other KRITIS facilities.

The KRITIS umbrella law, adopted by the Bundestag on January 29, 2026, complements the perspective with physical resilience. While NIS2 focuses on cybersecurity, the umbrella law aims to protect against natural hazards, sabotage, and hybrid threats. For data center operators, this is a key point: site security, access control, and emergency power supply are given additional regulatory framework.

Source: BSI Federal Office for Information Security, OpenKRITIS, as of April 2026.

What’s New in C5:2026

The BSI criteria catalog C5 has been the reference framework for secure cloud computing in Germany since 2016. The revised version C5:2026 restructures the test areas and adds three topics that were either missing or only marginally covered in the previous versions. Firstly, container management: the requirements for runtime security, image scanning, and network policies have been expanded and formulated more explicitly. Secondly, post-quantum cryptography: cloud operators must demonstrate a documented migration path for long-lived, protection-worthy data. Thirdly, confidential computing: for workloads with a high protection class, the use of hardware-based trust environments such as Trusted Execution Environments is included in the criteria catalog.

For cloud operators with KRITIS relevance, C5 is no longer a voluntary certification, but a de facto industry standard. Healthcare service providers have already had to provide a C5 certificate since July 2024 based on the Digital Act, and other regulated industries follow in practice. The audit is carried out by auditors who certify compliance with the criteria after a successful review.

In practice, this means for DACH cloud teams: those who use C5 certificates to meet customer requirements must incorporate the new 2026 topics into their own audit cycle. Those who review certificates from their suppliers should take a close look to see whether the 2026 version or an older version was used. The transition periods are defined in the catalog and vary depending on the topic.

What Multi-Cloud Means in this Context

The three hyperscalers AWS, Microsoft Azure, and Google Cloud all have C5 certifications for essential services, but not comprehensively. Each provider defines per service and region which certificates apply and which do not. For a KRITIS workload distributed across multiple hyperscalers, comparing the scope is not a trivial matter.

A concrete example. Anyone operating a patient management system in Germany needs a C5 certification for the entire chain. If the database and application run on AWS Frankfurt, the analysis layer on Azure Germany-West-Central, and certain backup volumes are stored on Google Cloud Europe-West3, the certifications must be available for each service. If one is missing, the entire workload falls out of C5 conformity until the supplier closes the gap or the subsystem is relocated.

In parallel, the KRITIS umbrella law applies at the location level. Anyone running their main productive environment in a Frankfurt data center with a known location classification and disaster recovery in Ireland must include the DR location in the resilience assessment, even if it is not primarily used. The combination of NIS2 obligations (cybersecurity), KRITIS umbrella law (physical resilience), and C5 criteria (cloud-specific audit) results in a matrix that must be worked out individually for each KRITIS workload.

Comparison of the Three Regulations

The Pragmatic Implementation Plan

For cloud operators with KRITIS relevance, a five-step plan has proven effective in practice, treating the three sets of regulations as related work packages. First, inventory. Which workloads run where, what classification do they have, and which suppliers are involved. Without this inventory, every subsequent step is a shot in the dark.

Second, classification of the organization. Does the organization fall under KRITIS, as an important or particularly important entity under NIS2, and where does the KRITIS umbrella law apply additionally? The classification determines the depth of obligations, reporting rhythm, and registration modalities.

Third, the supplier matrix. Which cloud service has which C5 certification, in which version, and with what scope. In practice, most projects end up with an Excel table that needs to be updated with each new service launch. Specialized GRC tools take over this step, but are not free.

Fourth, policy harmonization. The organization’s internal guidelines for access protection, incident response, data classification, and backup must be aligned with the requirements from the three frameworks. Many organizations have historically grown guidelines that regulate multiple topics in parallel and are inconsistent at the edges. A harmonization sprint clarifies this and saves significant discussion time in later audits.

Fifth, the audit rhythm. Those who use C5 certifications plan the audit cycle with the auditor. Those who perform NIS2 reporting clarify the rhythm with the BSI. Those who fulfill KRITIS umbrella law obligations plan resilience exercises. Managing three cycles in parallel in a yearly plan is logistically challenging but manageable if a GRC team has control over the scheduling.

What regularly goes wrong in practice

Two mistakes are repeated in consulting practice. The first is the parallel organization. One team handles NIS2, another C5, and a third the KRITIS umbrella law. Nobody sees the overlaps. The result is triply maintained asset lists, conflicting incident processes, and an unnecessarily high compliance bill. Those who plan the three topics together from the start save between 20 and 40 percent of the effort, according to internal analyses by large data center operators.

The second mistake concerns supplier dependency. A cloud provider that bases its certification on a hyperscaler’s service, which uses a preliminary certification, stands without current confirmation in the event of a serious incident if the hyperscaler changes the service scope. Such changes occur more frequently than companies expect because cloud catalogs grow dynamically. A contractual right to change notifications from the supplier has become standard, but has not been implemented everywhere.

A third question is often underestimated: Which internal KPIs indicate compliance. Process compliance without metrics is an audit topic in the next cycle. Those who have the reaction time for incidents, the time between patch availability and deployment, the certification coverage per workload, and the number of open findings in a common dashboard structure can speak to the supervisory board and the BSI. Without these numbers, compliance remains narrative.

A fourth gap appears in the documentation of reporting chains. NIS2 demands an early warning within 24 hours, an export notification within 72 hours, and a final report within a month. The KRITIS umbrella law adds reporting paths for physical events. Those who have not practiced escalation paths lose hours in the event of a serious incident with coordination, which they need for analysis and containment. A bi-annual tabletop exercise with the legal and communications departments is therefore a fixed part of a mature compliance organization, not just an optional add-on.

A fifth aspect concerns the interface to the insurer. Cyber insurance policy conditions have tightened noticeably over the last 18 months. Insurers now ask in the policy negotiation during the audit interview about the C5 certification version, NIS2 classification, and documented incident response times. Those who do not have these documents readily available risk premium surcharges or benefit reductions in the event of a claim.

Conclusion

The NIS2 implementation law, KRITIS umbrella law, and BSI C5:2026 are not a three-part checklist, but an integrated set of rules for cloud providers with KRITIS relevance. Those who treat the three frameworks as a unit reduce effort and risk simultaneously. Those who handle them separately build parallel structures that fail in the audit. The implementation roadmap until autumn is tight, but feasible if inventory, supplier matrix, and policy harmonization start now. The difference between a well-prepared and a poorly prepared cloud provider will become visible in Q4 2026 when the first full audit cycles run.

Frequently Asked Questions

Title image source: Pexels / Brett Sayles (px:5480781)

Translated from the German original using artificial intelligence. The German version is authoritative.