BSI Critical Infrastructure (KRITIS)

The German BSI Act (also known as IT Security Act) requires critical infrastructure operators (e.g., data centers) exceeding the BSI-KRITIS Ordinance thresholds to register with BSI and adhere to the legal obligations. These obligations include demonstrating compliance with security requirements and focusing on the implementation of appropriate technical and organizational measures. Audit evidence and documentation is required to be shared with BSI every two years.

The Google German subsidiary, RedTec Computing GmbH, which operates Google data centers in Germany for Google Cloud services, has been registered with BSI as an operator of critical infrastructure. Google’s data centers for Cloud in Germany regularly undergo an audit by an independent third-party auditor to demonstrate compliance with the KRITIS Ordinance and the IT Security Act.