The blackout in Berlin at the beginning of January 2026 revealed how vulnerable our critical infrastructure is. Tens of thousands of Berliners were left for days without electricity, light, internet, and in some cases without heating, in freezing temperatures. Around 45,000 households and more than 2,200 businesses were offline, train services were limited, and hospitals and care homes had to rely on emergency power. The cause was an arson attack on a cable bridge over the Teltow Canal, which severely disrupted the power supply.
German KRITIS Act: Approach and goals
The KRITIS umbrella law aims to address this issue by establishing nationwide minimum standards for the protection of critical infrastructures. Its goal is to strengthen the resilience of supply systems – whether electricity, water, telecommunications, or healthcare. Risks from technical failures, sabotage, or cyberattacks are to be minimized. A uniform federal definition of critical infrastructures and clear requirements for operators are intended to ensure that both private and public facilities implement protective measures.
Challenges and criticisms
Despite the fundamentally sound approach, there are still open questions:
1. Imbalance between private and state facilities: Large parts of the federal administration are largely excluded from the protection framework under the draft law, while private operators must meet extensive requirements. This raises the question of whether state-operated supply systems, which are particularly critical to society, are adequately protected.
2. Federal special regulations: The law allows federal states to establish their own rules below the thresholds. This can lead to inconsistent security levels. Uniform nationwide standards are crucial so that authorities, operators, and emergency services can cooperate quickly and efficiently in a crisis.
3. Data security: Central information about pipelines, network structures, or supply points must be protected. Publicly accessible data increases the risk of attacks. Clear access concepts, encryption, and defined permissions are necessary to effectively secure critical infrastructures.
4. Technical implementation: Minimum standards on paper are only helpful if operators have the necessary technical resources, processes, and know-how. Concepts such as Zero Trust, multi-factor authentication, and continuous risk assessments are today’s basic prerequisites for real resilience of critical systems.
KOBIL solutions for KRITIS security
KOBIL offers practical solutions that support the protection of critical infrastructures both technologically and organizationally:
- KOBIL Security: Comprehensive security solutions for physical and digital infrastructures – from identity and access management to secure data processing.
- KOBIL Identity: Ensures that only authorized personnel can access critical systems and sensitive data, based on modern security principles such as Zero Trust and multi-factor authentication.
- KOBIL SuperApp: An integrated platform for companies across industries that combines security, compliance, and operational processes – ideal for managing digital processes reliably, efficiently, and securely.
Companies must be empowered to continuously detect risks, automatically secure systems, and demonstrably ensure compliance with key security principles. Germany’s critical infrastructure must have no vulnerabilities – and our society must not pay the price for security gaps.
Key Facts at a Glance
- Berlin blackout January 2026: Around 45,000 households and 2,200 businesses without power and heating.
- Cause: Arson attack on cable infrastructure.
- German KRITIS Act: Intended to define nationwide minimum standards for critical infrastructures.
- Challenges: Imbalance between private and state facilities, federal special regulations, protection of sensitive data.
- Technological requirements: Zero Trust, multi-factor authentication, continuous risk assessment.
- KOBIL solutions: Security, Identity, and SuperApp support companies in the practical implementation of resilience and compliance.