What is…
KRITIS (Critical Infrastructure)
The German term KRITIS (Kritische Infrastrukturen) refers to organizations and facilities from sectors indispensable for the functioning of society. The BSI Act (BSIG) identifies nine sectors: energy, water, food, information technology and telecommunications, transport, healthcare, financial and insurance services, municipal waste disposal, and government and public institutions.
Within these sectors, thresholds determine when an operator qualifies as a KRITIS operator. In healthcare, for example, hospitals with more than 30,000 inpatient treatment cases per year qualify. KRITIS operators must implement adequate technical and organizational measures under §8a BSI Act, demonstrate these every two years (e.g., through audits) and report significant IT security incidents to the BSI.
The KRITIS Framework Act extends the concept of resilience to physical security: IT resilience and physical resilience (protection against power outages, flooding, physical access) must be considered together. For KRITIS operators, this means: backup infrastructure must be secured against both cyber attacks and physical threats.
In the context of data protection, physically isolated backup systems (air gap) and hardware for archiving are particularly relevant for KRITIS operators: a non-addressable storage medium meets the BSI requirement for a network-independent, storage in the most direct way possible.
Immutable Storage
Immutable storage refers to storage technologies that protect stored data from subsequent alteration or deletion — where the decisive difference lies in whether this protection is enforced at the hardware level (cannot be circumvented) or at the software level (can be circumvented by administrators with sufficient rights).
WORM
WORM (Write Once, Read Many) refers to a storage principle in which data is written once and can technically no longer be altered or deleted — in hardware WORM, this immutability is a physical property of the storage controller, independent of software, operating system or user privileges.