KRITIS Training & Awareness Campaigns

The NIS 2 Implementation Act (NIS2UmsuCG), effective since December 2025, requires KRITIS operators to conduct regular cybersecurity training for all employees. Management must personally participate in risk management and IT security training — this obligation cannot be delegated. Additionally, Section 8a of the BSI Act requires proof of adequate organizational measures, which explicitly includes training programs. Violations can result in fines of up to

10 million euros or

2 percent of annual turnover.

A BSI-compliant KRITIS training covers: recognition of phishing and social engineering, secure handling of credentials and access rights, incident reporting procedures, sector-specific threat scenarios for your KRITIS sector, physical security in critical areas, and NIS 2 compliance fundamentals. Content is tailored to specific roles — executives receive different focus areas than operational staff or IT specialists.

KRITIS operators must demonstrate adequate security measures to the BSI every two years. In practice, this means: annual mandatory training for all employees at minimum, quarterly phishing simulations for effectiveness monitoring, and ad-hoc training for new threat situations or after security incidents. Continuous awareness campaigns with monthly micro-content complement the formal training sessions.

KRITIS training is a structured program with defined learning objectives, attendance verification, and knowledge testing — it fulfills regulatory requirements of the BSI Act and NIS 2 Directive. An awareness campaign is a complementary measure that maintains security consciousness in daily work: through posters, short videos, simulated phishing emails, or interactive quiz formats. Both elements work together and are jointly required for KRITIS operators.

Effectiveness is measured through multiple KPIs: phishing simulation rates (click rates before and after training), knowledge test results, number of security incidents reported by employees, average incident response time, and BSI audit outcomes. ADVISORI provides a reporting dashboard with these metrics so you can demonstrate training progress to auditors and management.

All eight KRITIS sectors (energy, water, food, IT and telecommunications, healthcare, finance and insurance, transport and traffic, municipal waste disposal) have fundamental training obligations. Particularly stringent requirements apply in healthcare (patient safety), energy (OT security for control systems), and finance (BaFin requirements in addition to BSI). Our training content is adapted to each sector.

Implementing a KRITIS training program typically takes

4 to

8 weeks: needs analysis and concept development (1–2 weeks), creation of role-specific content (2–3 weeks), pilot delivery and refinement (1–2 weeks), rollout and awareness campaign launch (

1 week). Costs depend on organization size, number of sectors, and preferred training formats — contact us for a customized proposal.