The new KRITIS module describes additional requirements which have to be taken into account in order to provide evidence in accordance with § 8a (3) BSI Act by the auditor who by auditing the risk management and the business organization simultaneously fulfills the review of the requirements of § 8a (1) BSI Act.

The new module clarifies that all information technology systems, components or processes of the critical infrastructure must be completely covered in the testing. The relevant proof documents must be submitted to the BSI in due time according to the current requirements of the BSI.

With regard to the new requirements, BaFin also explained in its publication that

• the KRITIS protection objective must also be ensured in the case of outsourcing of services – then to the contracted company – and
• that institutes have to take measures ensuring that the critical services can be maintained in an emergency as part of emergency preparedness

In addition to the audit within the framework of the annual financial statements, further possibilities for the provision of evidence are also permissible. The KRITIS operators should hence comply with the "guidance for proof according to § 8a para. 3 BSIG" in the current version.

The requirements of the KritisV for the financial and insurance sector came into effect on June 30, 2017 and must be implemented by the affected institutions by 30.06.2019. The Regulation establishes qualitative and quantitative criteria, such as the number of defined transactions or the number of persons served for a particular service. Companies meeting these criteria operate a Critical Infrastructure within the meaning of § 2 (10) BSI Act.

In the finance and insurance sector, critical services acc. § 7 BSI KritisV are

1. Cash supply;
2. Card-based payment transactions;
3. Conventional payment transactions;
4. Clearing and settlement of securities and derivatives business;
5. Insurance services.

You can reach the BaFin publication with the text of the updated BAIT at this link:

FMC supports institutes in the implementation and fulfillment of the requirements of the KritisV, the BAIT and the 5th MaRisk amendment. For this purpose we offer an initial workshop for a structured and tool-based determination of the institute-specific fields of action and challenges. More about our offer can be found here.

In the finance and insurance sector, critical services acc. § 7 BSI KritisV are

1. Cash supply;
2. Card-based payment transactions;
3. Conventional payment transactions;
4. Clearing and settlement of securities and derivatives business;
5. Insurance services.

The upcoming KRITIS module is intended intended to describe additional requirements which have to be taken into account in order to provide evidence in accordance with § 8a (3) BSI Act by the auditor who by auditing the risk management and the business organization simultaneously fulfills the review of the requirements of § 8a (1) BSI Act. In particular, this measure is intended to coordinate the existing "double supervision" by the BSI and the BaFin.

The requirements of the VritisV for the financial and insurance sector came into effect on June 30, 2017 and must be implemented by the affected institutions by 30.06.2019. The Regulation establishes qualitative and quantitative criteria, such as the number of persons served or the number of defined transactions for a particular service. Companies that meet these criteria operate a Critical Infrastructure within the meaning of § 2 (10) BSI Act.

As a first measure, the operators of critical infrastructures have to inform the BSI of a functional mailbox as a contact point within six months after the entry into force of the BSI KritisV within six months after the entry into force of the BSI KritisV, through which they can be reached at all times around the clock. In order to ensure trouble-free incident management in cooperation with the BSI, internal processes should be set up to ensure the alerting of suitable contact persons after receipt of the information, even outside normal business hours. This applies in particular if the operators have reported an IT fault to the BSI and are expected to receive further inquiries.

FMC supports institutes in the implementation and fulfillment of the requirements of the KritisV, the expected Kritis module of the BAIT and the 5th MaRisk amendment. For this purpose we offer an initial workshop for a structured and tool-based determination of the institute-specific fields of action and challenges. More about our offer can be found here.

In addition, BaFin has published the "Bank Supervisory Requirements for IT Risk Management" (BAIT), which essentially summarizes the requirements of MaRisk for IT and specifies them in more detail and which must be applied in a timely and binding manner.

FMC supports institutes in the short-term implementation and fulfillment of the requirements of the 5th MaRisk amendment and the BAIT. For this purpose we offer an initial workshop for a structured and tool-based determination of the institute-specific fields of action and challenges. More about our offer can be found here.