Cybersecurity for critical infrastructure
Water, transport, healthcare operations and other essential services running OT and IT together, often with remote access for service providers.
Essential services that cannot stop.
Water, transport, healthcare operations and public services run IT and OT side by side, often with remote access for service providers. When they fail, citizens notice within hours.
NIS2 and the German KRITIS rules make management responsible for risk management and reporting. Suppliers of critical operators now face the same expectations through contracts and audits.
Who it is for
- Operators of water, wastewater and district heating
- Transport operators and infrastructure managers
- Public administrations and municipal IT providers
- Suppliers and service providers of critical operators
Where critical infrastructure is exposed today
The attack paths we see most often at operators of essential services and their suppliers.
Remote access
Service provider access
Many vendors maintain systems remotely. Each access is a door that has to be controlled and logged.
Supply chain
Critical suppliers
Operators depend on software and service providers. An attack on a supplier can stop the service itself.
Identity
Accounts without multi-factor authentication
One stolen password for VPN or email is still the most common way in.
Legacy
Ageing control systems
SCADA and process control run for decades, often on systems that can no longer be patched.
IT and OT
Shared infrastructure
When billing, scheduling and control share infrastructure, operators shut down operations as a precaution after an IT attack.
Recovery
Backups within reach
Backups reachable from the same network get encrypted too. Recovery then takes months instead of days.
Sites
Remote sites
Pumping stations, substations and signalling sites are spread out and hard to protect physically.
People
Phishing and social engineering
Operations staff are targeted directly. Training and clear processes reduce the risk.
When it went wrong
Three documented cases from essential services. They show how one stolen password or one compromised supplier can stop a service that millions rely on.
May 2021, ransomware
Colonial Pipeline: fuel supply to the US East Coast stops
Attackers used the password of an old VPN account without multi-factor authentication to enter Colonial Pipeline's IT network and deployed ransomware on 7 May 2021. As a precaution, the company shut down its 5,500-mile pipeline.
Impact
The pipeline, which carries about 45 percent of the fuel used on the US East Coast, stood still for five days. Panic buying caused shortages at filling stations, and the company paid a ransom of USD 4.4 million.
Sources: Colonial Pipeline testimony to the US Senate, June 2021; US Department of Justice
July 2021, ransomware
Anhalt-Bitterfeld: Germany's first cyber disaster
Ransomware encrypted the IT systems of the district administration of Anhalt-Bitterfeld on 6 July 2021. Three days later the district declared a state of disaster, the first in Germany caused by a cyberattack.
Impact
Social benefits could not be paid for at least a week, and services such as vehicle registration stopped. The disaster status lasted more than six months, and the costs were estimated at around EUR 2 million.
Sources: dpa; MDR; Volksstimme
October 2022, supplier attack
Danish railways: every train stops
Attackers compromised a test environment of Supeo, a supplier of operational software to Danish rail. Supeo shut down its servers, and train drivers lost the app that gives them safety-critical information.
Impact
All DSB trains in Denmark stopped on the morning of 29 October 2022. Local services resumed in the afternoon, long-distance traffic only the next day.
Sources: DSB; Reuters; International Railway Journal
What a working security approach for essential services looks like
Six building blocks that meet NIS2 and the KRITIS rules and keep services running.
1
Risk management led by management
Management approves and oversees the cyber risk measures, as NIS2 requires.
2
Supplier security
Security requirements in contracts, assessments of critical suppliers and exit plans.
3
Secure remote access
Individual, approved and logged access for every service provider.
4
Separated IT and OT
Segmented networks, so an IT incident does not force a shutdown of operations.
5
Incident response and reporting
Roles, playbooks and reporting within the NIS2 deadlines of 24 hours, 72 hours and one month.
6
Tested recovery
Offline backups and exercises that prove you can restore essential services.
How we help
From the NIS2 classification to an audited security management system and tested recovery.
Regulatory readiness
Clarity on NIS2, the KRITIS rules and your sector requirements.
What we do
- NIS2 applicability and entity classification
- Gap analysis against NIS2 and BSI requirements
- Roadmap and support with the BSI registration
You receive
Classification, gap list, roadmap
Security management and audits
An ISMS that passes the audit and works in daily operation.
What we do
- ISO 27001, also on the basis of IT-Grundschutz
- Preparation for KRITIS evidence audits
- Supplier security programme
You receive
ISMS documentation, audit plan
OT and plant security
Control systems that keep running when IT is attacked.
What we do
- Assessment against IEC 62443 and the BSI ICS guidance
- Zoning and remote access concept
- Recovery planning
You receive
Zone model, measure plan, recovery plan
Testing and incident readiness
Find weaknesses before attackers do, and know what to do when it happens.
What we do
- Penetration tests of IT, OT and remote access
- Incident response playbooks and exercises
- NIS2 reporting process
You receive
Test report, playbooks, reporting process
How we work
Step 1
Scope
We agree on the services, sites and rules in scope.
Step 2
Assess
Interviews, site visits and a document review show where you stand.
Step 3
Build
We implement the measures and documentation with your team.
Step 4
Prove
Exercises, tests and audit preparation close the gaps that matter.
Standards and regulations
NIS2 Directive (EU) 2022/2555
Risk management measures, management accountability and incident reporting within 24 hours, 72 hours and one month. In Germany implemented by the NIS2 implementation act, in force since December 2025.
BSI Act and KRITIS regulation
Operators of critical facilities must implement security at the state of the art and provide evidence to the BSI at regular intervals.
CER Directive (EU) 2022/2557
Resilience of critical entities, including physical security and business continuity, complementing NIS2.
ISO/IEC 27001
The basis for an information security management system, also as ISO 27001 on the basis of IT-Grundschutz.
IEC 62443
Security for the industrial control systems used in water, energy and transport.
Related services and modules
The consulting services and AITIGRITY modules operators and their suppliers use most often.
Not sure where to start?
A short scoping call shows whether NIS2 applies to you and which steps come first.
Talk to an expertFrequently asked questions
Are we covered by NIS2?
It depends on your sector and size. Many operators, and often their suppliers, are now essential or important entities. We check your classification and the duties that follow.
What does management have to do under NIS2?
Approve the risk management measures, oversee their implementation and take part in training. In Germany, management can be held liable for violations.
How fast do we have to report an incident?
An early warning within 24 hours, a notification within 72 hours and a final report within one month. In Germany, reports go to the BSI.
We supply critical operators. What does this mean for us?
Your customers must manage supply chain risk, so they will ask for evidence of your security. We help you prepare it.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.