CONSULTING · CRITICAL INFRASTRUCTURE
Critical infrastructure consulting.
Protect essential services. Strengthen resilience
High Knowledge connects risk analysis, technical infrastructure and operational organisation. We help identify critical dependencies and develop effective measures for resilient sites.
Essential services need resilient infrastructure.
Energy, healthcare, water and digital services depend on functioning systems and reliable processes. Disruptions can spread across organisational and sector boundaries. Our consulting therefore assesses the site alongside utility routes, service providers and operational interfaces.
We identify which functions must continue, what threatens them and which technical or organisational measures improve their resilience. Our focus is on practical protection concepts for buildings, data centres and their utilities.
KRITIS-Dachgesetz: a focus on physical resilience.
Germany's KRITIS-Dachgesetz has been in force since 17 March 2026. It establishes a framework for the physical protection of critical facilities. Depending on its scope, requirements include risk assessments, resilience measures and related documentation. An operator's obligations depend on its specific classification and statutory exemptions.
Sector-specific scope is particularly important for data centres: Section 4(2) exempts operators of critical facilities in the information technology and telecommunications sector from several provisions, including sections 12 to 16. We therefore do not apply requirements indiscriminately to every data centre. Cybersecurity requirements are assessed in relation to NIS2 and the German BSIG requirements.
Sources: BBK guidance on the KRITIS-Dachgesetz and Section 4 KRITISDachG.
Assess risks from the site to the supply chain.
We consider power failure, heat rejection, fire, water, unauthorised access and common-cause failures, among other scenarios. The impact on critical functions and the available response time are central.
A second system provides its intended protection only when its dependencies are understood. Shared routes, controls, maintenance processes or suppliers can link seemingly independent systems. We document these relationships and prioritise measures by risk and effectiveness.
Technical protection
Security of supply, physical separation, monitoring, access control and maintainability are assessed together. Measures are coordinated with existing equipment and planned expansions.
Organisational readiness
Alerting, escalation, responsibilities and recovery must fit operations. We support coordination between building services, IT, security teams and service providers.
A protection concept that works in everyday operation.
The initial assessment and risk evaluation produce a prioritised action plan. We describe technical requirements, responsibilities and suitable evidence. Where necessary, we support the technical development of resilience measures and their coordination with existing contingency and security concepts.
We also consider implementation: what can be improved in existing facilities? Which interventions need a maintenance window? Which functions require regular testing? Our retrofit consulting and Data centre design carry these measures into detailed technical design.
How we start your critical infrastructure assessment.
- Clarify the scope: identify operators, essential services, sites and existing classifications.
- Record assets and dependencies: bring together drawings, equipment, utilities and operational processes.
- Assess risks: document scenarios, impacts and existing safeguards.
- Plan measures: agree priorities, responsibilities and implementation order.
- Verify effectiveness: define suitable tests, exercises and regular updates.
Technical and organisational consulting is coordinated with your responsible legal and compliance teams. Where necessary, a binding legal assessment is obtained separately.
Frequently asked questions
Are KRITIS and NIS2 the same?
No. KRITIS refers to critical infrastructure; the German KRITIS-Dachgesetz addresses physical resilience within its scope. NIS2 is an EU cybersecurity directive. Their requirements may interact, but they have different points of application.
Is an assessment worthwhile without statutory KRITIS classification?
Yes. An outage can seriously affect your business even without a statutory KRITIS classification. Protection needs and suitable measures should therefore be derived from actual business processes.
How resilient is your critical infrastructure?
We discuss your sites, dependencies and specific needs. Together, we establish a coordinated path from analysis to implementation.