Regulation
KRITIS and NIS2, without the certificates
Two regimes govern the security of a German data centre: the national critical-infrastructure rules, KRITIS, and the European directive NIS2 as implemented in German law. They are usually spoken about as certificates. They are not certificates, and this page says what they actually are.
What German critical-infrastructure law and the European directive actually oblige an operator to do, and why nobody here is certified.
KRITIS is a threshold, not a badge
German critical-infrastructure regulation applies to operators above defined thresholds in defined sectors, information technology and telecommunications among them. Being covered is a matter of measured supply, not of applying. Once covered, an operator owes the federal office evidence of appropriate organisational and technical measures, on a cycle, and owes notification when something happens.
NIS2 widens the net
The European directive on network and information security raises the obligations and widens the population sharply, catching operators who sat below every previous threshold. The German implementation carries it into national law. Its centre of gravity is risk management, supply-chain security, incident reporting on a short clock, and – the part that changes behaviour – management liability.
Why we never write 'compliant'
Neither regime issues a certificate a building can hold up. There is an audit path, there are attestations against standards such as ISO 27001, and there is a supervisory relationship. A data centre under construction is on a pathway toward obligations that begin when it operates. Claiming that badge on a site not yet in operation describes a status that cannot exist yet, and any reviewer who knows the regime reads it as a tell.
What it does to the drawing
Security regulation is cheapest to satisfy when it is designed in and most expensive when it is retrofitted. Zones from the public edge to the machine hall, physical boundaries before electronic ones, access logged per zone, and a combined security and network operations centre. Those are lines on a site plan, and they cost least on the day the site plan is first drawn.
