Logo Bayernportal
Home > Procedures

It security; submission of evidence of compliance with the state of the art

If you operate critical infrastructures, you must prove that the security of your information technology corresponds to the state of the art. You must submit proof to the Federal Office for Information Security (BSI) every two years.

Online services & Forms

Online services

  • Nachweisdokument KI gemäß § 8a Absatz 3 BSIG

    Sie müssen in dem Formular Angaben zum betreibenden Unternehmen, den Ansprechpersonen und zur Anlage der geprüften Kritischen Infrastruktur machen.

Responsible for you

Bundesamt für Sicherheit in der Informationstechnik - KRITIS-Büro

Street address

Godesberger Allee 87
53175 Bonn

Postal address

Postfach 200363

53133 Bonn

Mehr zur Behörde

Procedure details

Critical infrastructures (KRITIS) are organizations and facilities that are important for the state community. If these facilities fail or are impaired, this can lead to supply bottlenecks, significant disruptions to public safety or other dramatic consequences. Regular proof of compliance with the state of the art is therefore required by law. KRITIS includes the following sectors, for example:

  • Energy,
  • health,
  • information technology and telecommunications,
  • transportation and traffic,
  • water,
  • finance and insurance,
  • nutrition,
  • municipal waste disposal.

As an operator of critical infrastructures, you must ensure that the security of your information technology systems, components and processes, which are fundamental to their operation, corresponds to the state of the art. You must prove this to the Federal Office for Information Security (BSI) at least every two years.

To protect your information technology against failure and external attacks, you must take organizational and technical measures and precautions. This also includes the use of attack detection systems.
You can have this documented by security audits, tests or certifications from auditing bodies. In the next step, you submit the results of these audits to the BSI using a verification document, including any security deficiencies discovered.

The BSI then checks whether your precautions and measures meet the legal requirements. The BSI can request the submission of further test documents and, in the event of security deficiencies, the rectification of the security deficiencies.

  • You operate critical infrastructure
  • You are registered with the BSI
  • You have a corresponding operator ID/institution ID

  • Required Documents
    • Verification document KI: Information on the operator, the tested critical infrastructure and contact person
    • Verification document P: Information on the inspection.
      • must be signed by an employee of the verifying body who is authorized to sign.
      • must contain the following information:
        • Section PD: Information on the performance of the test
          • Appendix PD.A: Description and graphic representation of the scope of the inspection
          • Annex PD.B: Information on the test procedure
          • Appendix PD.C: Description of the test basis
        • Section PE: Information on the test result and the safety deficiencies detected
          • Appendix PE.A: List of safety deficiencies including implementation plan
        • Section PS: Information on the suitability of the inspecting body and the inspection team
          • Annex PS.A: Proof or evidence of qualification ″additional test procedure competence for § 8a BSIG″ or equivalent proof of competence

You can submit your evidence via the online service, by encrypted e-mail or by post.

If you submit evidence via the online service:

  • To use the online service, you need an ELSTER organization certificate and ELSTER company account.
  • Go to the federal portal verwaltung.bund.de and complete the online application.
  • You can upload your documents directly.
  • The KRITIS office of the Federal Office for Information Security (BSI) will check your details.
  • If the KRITIS office has any questions for you during the review or requests additional documents, it will contact you by email.
  • After the formal check, the KRITIS office will send you a confirmation by e-mail and inform you of the new deadline for your next proof.

If you submit evidence by encrypted e-mail:

  • Download the proof document KI from the BSI website.
  • Fill out the form.
    • You can either complete the form digitally
    • or print it out first and then fill it in.
  • Sign the form.
  • Send the form and your verification documents by email to the BSI's KRITIS office.
    • The KRITIS Office will accept your verification documents by encrypted e-mail.
    • For encryption, use the S/MIME certificate of the KRITIS office on the BSI website.
  • The next steps are the same as for the online service.

If you are submitting evidence by post:

  • Download the KI verification document from the website of the Federal Office for Information Security.
    • You can either fill out the form digitally and print it out,
    • or print it out first and then fill it in.
  • Sign the form and add the necessary verification documents.
  • Send your proof to the BSI's KRITIS office.
  • All further steps correspond to the procedure of the online service.

There are no costs for you for submitting the certificates to the BSI.

You must provide proof of compliance with the state of the art to the Federal Office for Information Security (BSI) at least every 2 years. You can also submit your verification documents at any time before the verification deadline. The calculation of the deadlines depends on the time of the previous submission of the documents. If a proof proves to be incomplete in the course of the inspection, so that subsequent deliveries have to be made, this does not affect the deadline for the subsequent proof once it has been calculated. For critical infrastructures that fall under the regulations of the BSI Act for the first time, proof must be provided within 2 years. If you register new systems in addition to already registered systems through the annual inspection, you can combine all systems in one verification, provided that the respective verification deadlines are not exceeded.

The processing time is usually around 10 days from receipt of the supporting documents until confirmation is issued - provided that all the necessary documents have been submitted and the information is complete. (1 bis 2 Wochen)

There are no indications or special features.

There are no legal remedies.

Status: 21.01.2024
Editorially responsible for prodecure description: Bundesministerium des Innern
Source: Federal Portal