NIS2 and KRITIS compliance for utilities

Whether your utility qualifies as a KRITIS operator depends on BSI-KritisV thresholds. For the energy sector, the threshold is 500 MW installed capacity; for water, it's 500,000 persons served. Even below these thresholds, you may fall under NIS2 as an 'important entity'. In Kopexa, you verify both during the initial assessment.

KRITIS (IT-SiG 2.0, BSIG §8a) is the German regulation for critical infrastructure operators with specific thresholds. NIS2 is the EU directive that has been transposed into German law since December 6, 2025 via the NIS2UmsuCG, significantly expanding the scope of affected organizations. Many KRITIS operators must meet both requirements. Kopexa automatically maps the overlaps.

BSI IT-Grundschutz is a recognized implementation framework for NIS2. Building your ISMS on IT-Grundschutz automatically satisfies many NIS2 requirements. In Kopexa, cross-mapping shows you which IT-Grundschutz modules cover which NIS2 articles.

KRITIS operators must report security incidents to the BSI immediately (within 24 hours). NIS2 further tightens reporting: early warning within 24 hours, qualified notification within 72 hours and final report after one month. In Kopexa, you document incidents in a structured way and generate reports in BSI format.

Costs depend on company size and your ISMS maturity level. Internal effort, BSI audits and potentially external consulting are the main cost drivers. With Kopexa (from EUR 249/month), you reduce internal effort by 40-60% because controls, evidence management and reporting processes are automated.

Yes, that's exactly what Kopexa is designed for. NIS2, BSI IT-Grundschutz, KRITIS requirements and ISO 27001 have strong overlaps. With cross-mapping, you implement one control and it satisfies multiple frameworks simultaneously. This saves up to 40% of implementation time compared to sequential implementation.