Information on the 2nd Amendment to the BSI KRITIS Ordinance

From 1 January 2022, the 2nd amendment to the BSI KRITIS Ordinance will come into force. Due to the inclusion of further system categories (e.g. gas trading system and cross-border transfer point) in the energy sector, additional operators are likely to be obliged to implement IT security standards and submit incident reports in accordance with the IT Security Act.

The threshold values defined in the ordinance enable operators of critical infrastructures to check whether they fall under the scope of the BSI Act. 

When the second amendment Ordinance comes into force, the operators of critical infrastructures affected for the first time are obliged to register the critical infrastructures they operate with the Federal Office for Information Security (BSI) by 2 April 2022, to designate a point of contact and also to report significant IT security incidents to the BSI. In addition, compliance with a minimum IT security standard must be demonstrated to the BSI within two years.

Background

The BSI KRITIS Ordinance serves to finally define the critical infrastructures in the seven sectors (energy, information technology and telecommunications, water, food, transport and traffic, health, as well as finance and insurance) whose operators were obligated to implement IT security standards and submit incident reports with the enactment of the first IT Security Act from 2015.

In the evaluation of the BSI KRITIS Ordinance, it was determined that some categories of installations should be additionally included due to their importance for the provision of the critical service. Therefore, the asset categories gas trading system and gas cross-border transfer point were newly introduced for the energy sector and the gas industry. 

As a result of the amendments, additional operators are subject to the rights and obligations introduced by the IT Security Act in July 2015. 

Defined threshold values sector energy/gas: 

2.2

Gas transport and storage

2.2.1

Gas Transmission System

Annual exit consumption for DSO’s and end consumers in GWh per year

5190

2.2.2

Cross-border transfer point

Transport in GWh per year

5190

 

Gas storage

Withdrawal capacity in GWh per year

5190

2.3

Gas distribution

 

 

 

Gas distribution system

Withdrawal capacity in GWh per year

5190

2.4

Gas network users

 

 

 

Gas trading system

Traded gas volumes or capacities in GWh per year

 5190

 

 

Terms in the ordinance

Gas trading system - a facility or an electronic trading system for trading gas quantities or capacities. 

Cross-border transfer points (interconnection points) which are not operated by one of the German transmission system operators are not, like other interconnection points, to be regarded as part of a transmission system. Without interconnection points, however, the gas cannot be transported further. However, the BSI KRITIS Ordinance has not yet included an installation category for them.

What does GASCADE do?

With the first KRITIS Ordinance, we are already classified as an operator of a critical infrastructure and thus obliged to meet the requirements of the IT Security Act.

Since the end of 2017, our information security management ISMS has been certified in accordance with the IT Security Catalogue and ISO 27001, and as one of the largest gas network operators in Germany and Europe, we play a pioneering role in information security across the industry.

Since 2016, we have provided the leadership in the UP KRITIS industry working group Gas, follow and comment on upcoming changes in the law, advise and discuss all topics with industry representatives, associations and authorities and are also happy to be available to you as a contact.