Glossary · Automation fundamentals, platforms and components
Critical infrastructure
Also known as: Critical infrastructures, CRITIS
German: Kritische Infrastrukturen (KRITIS)
In security policy, critical infrastructure refers to organizations and facilities, such as energy, water, health, transport and food supply, whose failure or disruption would cause serious supply shortages or threats to public safety. In the EU, NIS2 and the Critical Entities Resilience Directive set obligations for such entities.
- Automation components
- OT security
In one sentence
Critical infrastructure means sectors such as energy, water and health whose disruption would seriously harm supply or public safety.
Example
A municipal water utility, classed as critical infrastructure, must implement security measures and report significant incidents to the national authority.
How it applies
- Engineering: Suppliers to critical infrastructure operators face stricter security requirements in tenders, often referencing IEC 62443.
- Operation: Operators must manage risks, handle incidents and report them within defined deadlines under national law implementing NIS2.
- Documentation: Product and system documentation should support the operator's obligations: security features, hardening guidance, update procedures and support periods. Avoid claims that a product "makes" an operator compliant; obligations apply to the operator's overall measures.
- Maintenance: Remote maintenance access for critical infrastructure operators is usually subject to strict approval, logging and time limits agreed in contracts.
Critical infrastructure vs. KRITIS
"KRITIS" is the German abbreviation for Kritische Infrastrukturen. Which facilities fall under the legal definition depends on national rules and thresholds, which change over time; check the current national legislation.