Designate contact point as critical infrastructure operator

You can name the contact point via the BSI's reporting and information portal:

• Go to the BSI's reporting and information portal.
  • If your organization is already registered, you can log in via "Login".
  • If not, you can start the registration process by clicking on "Register". You will then receive the access data by post.
• Complete the form for naming a contact point in full.
• Then complete an "Annex 2" for each of your infrastructures.
• You can then check your data again and send it off.
• After submitting, you can save your form as a PDF file. Print out the form, sign it and send it to the BSI's KRITIS office.
• The BSI will check your registration.
• You will receive confirmation of your registration by e-mail and further information and documents by post once registration is complete
• If you have any questions about the registration process, you can contact the BSI's KRITIS office. If you have technical questions about the registration portal, please contact the registration office at the National IT Situation Center.

Note: If you do not name a contact point, the BSI can carry out the registration itself and inform the responsible federal supervisory authority.

You must appoint a contact point if your organization operates critical infrastructure, i.e:

• You belong to one of the following sectors:
  • Energy
  • water
  • Food and beverages
  • Information technology and telecommunications
  • Healthcare
  • Finance and insurance
  • Transportation and traffic
• They provide services to the general public in these sectors, the failure or impairment of which would lead to significant supply bottlenecks or threats to public safety (critical services).
• You reach or exceed certain thresholds that apply per sector and for the respective facilities. For example, if your facilities can generate a certain amount of energy or produce a certain amount of water.

As a rule, you do not need to submit any additional documents.

The BSI does not charge any costs for designating the contact point.

As soon as you are considered to be the operator of a critical infrastructure for the first time or again, you must designate a contact point by the next working day at the latest.

It usually takes 1 to 2 weeks to process your notification.

• § Section 8b (3) of the Act on the Federal Office for Information Security (BSIG)
• Ordinance on the Determination of Critical Infrastructures under the BSI Act (BSI-KritisV)

• Objection
• If you do not agree with an administrative act of the Federal Office, you can usually lodge an objection with the Federal Office. This is also indicated in the information on legal remedies at the end of the decision.
• In the appeal procedure, the Federal Office will review the decision it has made, taking into account the arguments you have put forward to remedy the situation before legal proceedings.
• Legal action before the administrative court: In principle, you can only bring an action before the court once you have received a notice of objection in response to your objection.
  

Forms: yes

Online procedure possible: partially

Written form required: no

Personal appearance required: no

If you complete "Annex 2", you are not declaring that you are an operator of critical infrastructure. Use "Annex 2" even if you believe that you do not fall under the regulations. The BSI will make the appropriate classification.

20.07.2021