Planning KRITIS staff: Ensuring responsibility and coverage
7
Morten Laufer
Founder
KRITIS personnel planning begins with the BSIG, not with team size: protective tasks such as attack detection, incident response, and business continuity each require responsibility, representation, and proof. Nova Search translates these gaps into prioritised security search profiles.
§ 31 BSIG obliges operators of critical installations to use attack detection systems with continuous, automatic evaluation; § 30 BSIG requires incident management and business continuity.
The law does not prescribe a minimum number of employees, but requires effective, documented measures with clear responsibilities.
An in-house 24/7 SOC requires a multi-person team working in shifts; for many operators, separating detection operations from internal assessment is the more realistic structure.
90 per cent of organisations in Germany have difficulty recruiting cyber security specialists, with the shortage concentrated in risk management and incident response.
Nova Search translates identified coverage gaps into prioritised KRITIS security search profiles: first qualified shortlist within 5 working days, with a 90-day guarantee.
AI This article was created with the help of AI.
Which protective tasks require clear responsibility?
The staffing requirements of a CRITIS operator do not start with a team size, but with a list of tasks. The BSIG (Federal Office for Information Security Act) provides this: Section 30 requires appropriate, proportionate and effective technical and organizational measures, the compliance with which must be documented. Specifically, the law mentions, among other things, the management of security incidents, the maintenance of operations with backup management and recovery after an emergency, supply chain security, as well as concepts for staff security and access control. For operators of critical installations, Section 31 adds a stricter requirement: They must use intrusion detection systems that continuously and automatically record and evaluate parameters and characteristics from ongoing operations.
It is best to read these obligations as a role profile, not as a legal commentary. Every protective task is given three connections: a named responsible person, reliable proof and a defined deputy. This is precisely where the staffing requirements arise, because responsibility for full coverage lies with the operator, regardless of who carries out the technical work.
Incident management: Who evaluates security incidents, who initiates measures, who reports to authorities and internal departments?
Maintaining operations: Who is responsible for backup management and recovery after an emergency, and who ensures crisis communication?
Supply chain security: Who checks providers and service providers for security-related aspects before they go into operation?
Personnel security and access control: Who maintains concepts and processes, and who updates them when personnel changes occur?
Intrusion detection: Who operates the systems, who keeps signatures and analysis parameters up to date, who responds to alerts?
Important for classification: The law does not prescribe a minimum number of employees, nor does it require flat-rate full internal staffing. It demands effectiveness and documentation. This is precisely why the task list is the right starting point: It shows which competencies must be available somewhere, whether internally, through service providers or in a mixed form, and makes it visible where a single person is silently carrying five obligations.
How is continuous intrusion detection managed organizationally?
Intrusion detection systems run continuously and automatically, but the operation around them is an organizational task. You must clearly separate technical detection operations and human evaluation: Every alert needs someone to evaluate it, escalate it if necessary and report it to the BSI. The BSI guidance on intrusion detection systems translates this into concrete requirements: named individuals responsible for detection, documented guidelines with regulated reporting and alerting channels, as well as a logging and detection infrastructure that is adequately sized and budgeted with personnel, technical and financial resources.
At this point, an honest cost-effectiveness analysis is worthwhile. An in-house 24/7 SOC requires a multi-person team of full-time analysts in several shifts, plus shift management, Engineering and threat hunting, and correspondingly high personnel costs per year. For many operators, this is not cost-effective for analysis alone. This is not an argument against the obligation, but rather one in favor of a deliberate operating model: internal, external or hybrid, with clearly regulated monitoring.
Check your own coverage based on ongoing operations, not on the organizational chart:
Who evaluates alerts at night, on weekends and on public holidays, and within what timeframe does this person respond?
Who reports to the BSI within the statutory reporting deadlines, and who covers for this person during vacations?
Who keeps signatures, analysis parameters and attack patterns up to date, and how is this documented?
Which roles must be filled internally as a result, because you would otherwise lack responsibility, contextual knowledge or speed of response?
The staffing requirements follow directly from these answers: Roles that can only secure proof and decision-making rights for you belong internally to permanent employees. Pure evaluation capacity, on the other hand, can often be covered by service providers, as long as you bear the monitoring obligation yourself.
Where are deputies and operational knowledge lacking?
Responsibility without a deputy is no responsibility at all in an emergency. Vacation, illness, staff turnover and handovers are not exceptional cases, but the normal operation of any security team. If the person who evaluates alerts or reports incidents to the BSI is unavailable for two weeks, you need a second qualified person who can do the same and knows the same processes. Otherwise, continuous intrusion detection exists on paper, but not in practice.
Name a second qualified person for each protective task, not just a single responsible person.
Plan handovers explicitly: Documentation, processes and access rights must be structured in such a way that a deputy can take over without weeks of onboarding.
Test deputies realistically, for example as part of exercises, instead of just listing them on the organizational chart.
You should evaluate operational knowledge in OT systems separately. NIST SP 800-82 Rev. 3 requires operational technology to be secured while maintaining the specific performance, reliability and safety requirements of system operations. A classic IT security profile does not cover this alone: Anyone who knows a production plant, a control system or an energy system also understands which measure compromises operation. Added to this is IT/OT convergence as an attack vector: Monitoring that only covers classic IT leaves precisely those network gateways unmonitored through which attacks migrate into the plant level. For this interface, you need profiles with real OT context, and these are the scarcest on the market.
Which competencies must remain available internally?
Before prioritizing, you separate your own capabilities from external services, based on two criteria: manageability and availability. Legal responsibility remains with the operator; outsourcing does not release you from the obligation to monitor. Roles with decision-making rights, reporting obligations and plant context belong firmly anchored internally, while narrowly defined evaluation services can also be staffed externally.
Which staffing mandates have priority first?
In the end, you translate the coverage gaps into prioritized search profiles. The market does not make this easy: 90 percent of the surveyed organizations in Germany have difficulties attracting qualified cyber security professionals. According to the Strategy& Study 2025, the greatest shortage of personnel is in Risk Management at 57 percent, Incident Response at 46 percent and Cloud Security at 39 percent. So you compete hardest right where the gaps are greatest.
Priority | Search Profile | Deployment Model | Decision Rights |
|---|---|---|---|
1 | Incident Response / incident management with reporting competence | Internal permanent employee | Yes: Escalation, BSI reporting, crisis measures |
2 | OT Security with plant context (IT/OT convergence) | Internal permanent employee, externally supplemented | Yes: Measures during ongoing operation |
3 | Risk management and documentation of proof | Internal permanent employee | Yes: Evaluation and approval of measures |
4 | Continuous alert evaluation and analysis | External or hybrid, monitored | Limited: Escalation remains internal |
The following applies to prioritized mandates: They are rare, difficult to find and too important to be filled via generic volume sourcing. This is precisely what Permanent Recruitment from Nova Search is designed for: through a two-stage screening process consisting of a technical deep-dive and a culture interview, you receive an initial qualified shortlist within 5 business days, and with the 90-day guarantee, Nova Search shares the risk. If you want to prioritize your CRITIS security hires, start with the briefing on your prioritized profiles and bring your search profile to the table in 5 days instead of 5 months.
Sources
FAQ
What is the minimum number of security staff a CRITIS operator must employ?
The BSIG does not prescribe a minimum number. What is required are suitable, proportionate and effective measures that must be documented. The staffing level is derived from the protection tasks: Who operates attack detection, who assesses incidents, who restores operations. Having your own 24/7 SOC requires a multi-person team working in shifts, but is not mandatory for any company.
Which obligations under the BSIG directly affect personnel?
Section 30 BSIG mentions, among other categories of measures, the handling of security incidents, business continuity, basic training and awareness, as well as concepts for personnel security and access control. Section 31 BSIG additionally requires operators of critical facilities to have attack detection systems that continuously and automatically evaluate ongoing operations.
Is it sufficient to outsource attack detection to a service provider?
Operationally yes, legally no. Legal responsibility for the effectiveness of the measures remains with the operator; outsourcing does not relieve them of the obligation to monitor and provide evidence to the BSI. A division is sensible: external detection operations, internal assessment, escalation and verification.
Why does OT security need its own staff instead of standard IT profiles?
NIST SP 800-82 Rev. 3 calls for OT security while maintaining the specific performance, reliability and safety requirements of plant operations. Anyone managing industrial control systems with classic IT security profiles risks interfering with the plant process. Operational knowledge of one's own OT landscape is therefore a separate criterion in every search profile.
Which security roles are currently the hardest to fill?
According to the Strategy& study 2025, the greatest staff shortage is in security-critical roles: risk management (57 percent of surveyed organisations) and incident response (46 percent). A total of 90 percent of organisations report difficulties in recruiting qualified cyber professionals.
How do I prioritise multiple open security positions as a CRITIS operator?
Sort the gaps by risk: Which protection task is currently without a named person responsible or a deputy? Which reporting and verification obligation is at risk in the event of a failure? The search profiles with roles, deployment models (internal or external) and decision-making rights are created from the largest gaps. Nova Search implements these prioritised profiles with an initial qualified shortlist in 5 working days.
