Agenda:

• Critical Installations and Legal Requirements 

  • Importance of critical installations and critical services

  • Security of supply, threat landscape and resilience

  • Overview of KRITIS regulation and legal requirements for operators of critical installations

  • BSIG and the KRITIS Umbrella Act

  • European context, including the NIS-2 and CER Directives

  • Requirements for information security and auditing

  • State of the art and attack detection systems

  • Sector-specific security standards (B3S)

  • Obligations to provide evidence pursuant to Section 39 BSIG

  • Information and reporting processes and the scope of the BSIG

• Statutory Ordinance and Identification 

  • Applicability assessment

  • Fundamentals of KRITIS regulation

  • Identification as an operator of critical installations

  • Conducting a threshold analysis

  • Challenges in identification

  • Example threshold evaluation

  • Sources of information for operators and auditors

  • BSI™ publications and guidance

• Audit Preparation

  • Roles and responsibilities within a KRITIS audit

  • Requirements for auditors and audit teams

  • Audit bases with and without B3S

  • Accepting and preparing an audit engagement

  • Introduction to the phase model

  • Structured process for a KRITIS audit

  • Risks of improper application of the phase model Practical exercises and discussions

• Review of the Audit Foundations

  • Validation of the audit basis

  • Validation of the scope

  • Extent, description and presentation of the scope

  • Reference process for validation

  • KRITIS risk management

  • Assessment and validation of risk analyses

  • Asset-based risk analysis

  • Deriving the audit scope

  • Preparing an audit plan

  • Practical exercises in validation and audit planning

• Adequacy and Effectiveness Audit 

  • In-depth study of the phase model

  • Adequacy audit and effectiveness audit

  • Multi-year planning and multi-year audit concept

  • Selection and validation of populations

  • Sample selection and sample size

  • Deriving relevant subject areas

  • Distinguishing between measures and controls

  • Deriving audit procedures from threats

  • Assessment of the state of the art

  • Documentation of audit procedures

  • Possible areas of technical focus: security organisation, asset management, maintaining operations, information security incident management, attack detection and logging, service provider management, training and OT security

• Results and Evidence

  • Fundamentals of evidence submission

  • Requirements for evidence documents

  • Assessment and documentation of security deficiencies

  • Preparing lists of deficiencies

  • Requirements for implementation plans

  • Structure and content of the audit report

  • Taking existing attestations and certifications into account

  • ISO/IEC 27001 and SOC reports as part of a KRITIS audit

  • Traceability of audit results

  • Follow-up requests from the BSI™

  • Practical exercises on lists of deficiencies and audit reports

Objectives:

After completing the training SC590 KRITIS Auditor under Section 39(2) BSIG, you will be able to:

• explain the importance of critical installations and the key legal requirements,

• put KRITIS regulation and its significance for audits into context,

• understand the applicability of the regulations and the identification of critical installations, and assess threshold analyses,

• put roles and responsibilities within a KRITIS audit into context,

• assess suitable audit bases and apply the BSI™ phase model for KRITIS audits,

• validate audit bases and scopes,

• assess KRITIS risk management and risk analyses,

• prepare a structured audit plan,

• audit the adequacy and effectiveness of security measures,

• select populations and samples appropriately,

• perform audit procedures and document them in a traceable manner,

• assess audit results and security deficiencies,

• assess existing certifications and attestations in terms of their usability, and

• properly prepare audit reports, lists of deficiencies and evidence documents.

Target audience:

• Auditors and employees of auditing bodies,

• prospective KRITIS auditors,

• KRITIS operators and those responsible for KRITIS,

• those responsible for information security and ISMS,

• KRITIS consultants,

• members of audit teams,

• subject matter managers involved in KRITIS audits,

• specialist supervisors, and

• newcomers to KRITIS who wish to study KRITIS audits and the evidence submission process pursuant to Section 39 BSIG in depth.

Prerequisites:

Under the BSI™ training SC590 KRITIS Auditor under Section 39(2) BSIG concept, there are no formal admission requirements for participation in the training.

However, basic knowledge in the following areas is beneficial:

• Auditing and audit procedures

• Information security

• Regulation of critical installations

Additional education and professional experience requirements apply to participants who subsequently seek personnel certification as a KRITIS Auditor by the BSI™. These requirements are set out in the separate BSI™ personnel certification programme.

Description:

Operators of critical installations must regularly demonstrate the implementation of the statutory information security requirements through security audits, assessments or certifications. In addition to a sound knowledge of the legal and regulatory framework, auditors need, in particular, a structured audit methodology and a comprehensive understanding of the requirements for the audit basis, scope, risk management, audit procedures and provision of evidence to conduct such KRITIS audits properly.

In the training course SC590 KRITIS Auditor under Section 39(2) BSIG, you acquire the audit competence required to systematically prepare, conduct and document KRITIS audits in accordance with the training concept of the Federal Office for Information Security (BSI™).

You first address the legal framework, KRITIS regulation and the identification of critical installations. You then learn about roles and responsibilities within a KRITIS audit and the phase model used by the BSI™.

Building on this, you validate audit bases, scopes and KRITIS risk management and prepare audit plans. You learn to assess the adequacy and effectiveness of security measures, select populations and samples, and perform and document audit procedures in a traceable manner.

Finally, you address the requirements for audit reports, lists of deficiencies, implementation plans and evidence documents, as well as the submission of evidence to the BSI™. Practical exercises, group work and discussions support the application of the audit methodology taught to specific audit situations.

Other Info:

BSI™ Personnel Certification

The training course SC590: KRITIS Auditor under Section 39(2) BSIG serves as a prerequisite for and preparation for subsequent personnel certification as a KRITIS Auditor by the BSI™. After attending the entire course, you will receive a certificate of attendance, which is an admission requirement for BSI™ personnel certification.

In addition, evidence must be provided that the BSI™’s requirements regarding education and professional experience have been met. Once the admission requirements have been reviewed, the BSI™’s KRITIS Auditor examination may be taken.

Personnel certification is particularly relevant to auditors who assume the role of team leader within the audit team in connection with evidence provided by operators of critical installations pursuant to Section 39(1) BSIG.