Background
What does physical security mean for water management facilities in the context of the European Directive 2022/2557 (commonly referred to as the CER Directive)?
Physical security refers to the protection of buildings, facilities, personnel, and supply chains against risks arising from:
- Sabotage
- Terrorist attacks
- Natural disasters
- Human error
- Impacts due to geopolitical conflicts
Germany’s KRITIS Framework Act implements the European CER Directive at the national level and is expected to come into force in early 2026. Its objective is to strengthen the resilience and physical protection of critical infrastructure (KRITIS) across all sectors and uniformly throughout the country.
Affected Sectors
The water and wastewater sector is explicitly listed among the eleven defined KRITIS sectors. Large facilities within these sectors will generally fall under the scope of the legislation. Specific legal provisions are still being developed.
Key Requirements for the Sector
- Identification & Registration: Operators must register if they meet the applicability criteria of the law.
- Risk Assessments & Resilience Plans: National risk analyses serve as the basis for company-specific assessments. These lead to mandatory resilience measures and the development of a resilience plan.
- Minimum Requirements: A comprehensive “all-hazards” approach requires consideration of all conceivable risks—from natural disasters and cyberattacks to human error. Measures such as facility protection, emergency response teams, and operational continuity are expected.
- Reporting Obligations & Monitoring: Operators must report security-relevant incidents without delay. A centralized incident monitoring system will be established.
- Deadlines & Implementation: Following registration, operators will likely have only a 10-month implementation period to fulfill the resilience obligations.
Sector Assessment
The water and wastewater sector acknowledges the importance of the KRITIS Framework Act for enhancing the resilience of critical infrastructure and welcomes the cross-sectoral regulatory approach. Particularly positive is the opportunity to develop sector-specific resilience standards, potentially building on established structures of technical self-regulation—such as the Technical Safety Management (TSM) and existing guidelines like DWA-M 1060 “IT Security – Sector Standard for Water/Wastewater.”
At the same time, it is emphasized that resilience measures must not be limited to large operators. Small and medium-sized enterprises also require practical and financially viable solutions to strengthen their resilience against natural hazards, technical failures, or human threats. The financing and legally sound integration of such measures into fees and charges must also be clarified.
It is essential to avoid unnecessary bureaucracy and to ensure that implementation is efficient and proportionate.
DWA Session at IFAT 2026
In this session on enhancing resilience and physical security—particularly through the KRITIS Framework Act—we will provide an overview of the current status and highlight the opportunities and added value of sector-specific resilience standards.
We will also present proven approaches that enable both large and small wastewater utilities to implement the directive’s requirements efficiently and practically.
We look forward to a constructive exchange with you!
