The backbone of whole-of-government defence

In a state of tension or state of defence , Germany is only as resilient as its critical infrastructure (KRITIS). It is the functional foundation for state action, military operational capability and the survival of the civilian population. Without electricity, water, transport routes, communication networks and healthcare, neither deployment nor supply nor coordination is possible – military or civilian.

In a crisis or conflict, protecting critical infrastructure is not originally the responsibility of the Bundeswehr, but of civilian operators and public authorities.

OPLAN DEU therefore does not treat critical infrastructure as a background condition, but as an operational resource. Its protection, its availability and its resilience are strategic prerequisites for credible deterrence and defence capability.

According to the definition of the Federal Office of Civil Protection and Disaster Assistance (BBK), critical infrastructure comprises nine sectors:

OPLAN DEU focuses in particular on the interfaces between critical infrastructure and military operations – e.g. power grids for command capability, rail infrastructure for troop movements, telecommunications networks for situation pictures and decision-making.

Protection, management and recovery

OPLAN DEU pursues three objectives:

1. Prevention and protection: ensuring that critical infrastructure keeps functioning even under hybrid or kinetic attack – through physical security, cyber resilience and redundancy.
2. Availability management: coordinating civilian operators for prioritised use in a state of defence – for example for troop deployment, materiel logistics or command support.
3. Restart and continuity: emergency plans for rapid recovery after an outage, including Host Nation Support for allies on German territory.

Legal and organisational requirements

Protecting critical infrastructure is not a purely military task. On the contrary: competence, responsibility and operational management lie mainly with civilian operators – companies, state authorities and municipal utilities. OPLAN DEU describes how these actors are involved: through contracts, administrative agreements, exercise scenarios and clear communication structures.

A key instrument is involving the critical infrastructure sectors in regular stress tests and total defence exercises. This is the only way to test whether supply, protection and management work in an emergency – and whether civil-military interfaces are robust.

Critical infrastructure does not run by itself

New threats emerge particularly in a state of tension: sabotage, cyberattacks, power cuts, disinformation, targeted destabilisation. At the same time, the demands on reliability and coordination rise dramatically.

Critical infrastructure is then not just the victim of potential attacks – it is target, weapon, lifeline and weak point all at once.

It follows that:

• Resilience means not only protection, but also the ability to self-repair and to change course at short notice.
• Securing critical infrastructure is a whole-of-government task – military, civilian and economic.

No defence capability without functioning infrastructure

OPLAN DEU makes it clear:
Successful collective and national defence requires Germany to function internally – even under pressure. Critical infrastructure is not a technical side issue, but a central lever for keeping the country resilient, governable and ready to defend itself.

Without resilient infrastructure, every strategy remains a concept without impact.

Preparedness and emergency supply laws

Resilience regulation for critical infrastructure (physical & cyber)

• KRITIS Umbrella Act (KRITIS-Dachgesetz): obliges operators to manage physical resilience systematically (risk analysis, protection, emergency operation, restart) and creates a uniform nationwide supervisory approach.
• The EU NIS2 Directive adds cyber resilience: risk management, incident reporting and supply chain security become mandatory so that digital attacks do not escalate into physical outages.

Energy: Energy Security Act (EnSiG)

• The EnSiG sets the state framework for intervention in the event of acute energy shortages or disruptions, but does not replace operators’ responsibility for emergency operation, redundancy and restart. Operators of critical infrastructure should design their crisis plans so that they remain operational even under priorities set by the state.

Water: Water Supply Security Act (WasSiG)
Water supply is itself critical infrastructure and at the same time supports many other sectors (energy, health, food, IT, industry). In a supply crisis, the act provides the framework for prioritising water services and thereby preventing cascading failures.

Food: Food Security and Preparedness Act (ESVG)
Food depends heavily on critical infrastructure: energy, IT, logistics, water and refrigeration determine production, storage and distribution. In a supply crisis, the act can set the framework for prioritising food-related functions and stabilising security of supply across the system.

Postal Act (PostG) and Telecommunications Act (TKG)

• PostG: Postal and parcel services are part of basic services and, in practice, run through many critical infrastructure processes (deliveries, spare parts, medicines, documents). The PostG sets the framework within which these services are organised.
• TKG: Telecommunications networks are part of critical infrastructure and, as a cross-cutting service, connect all sectors. The TKG sets the regulatory framework for networks and services that are crucial for warning, coordination and recovery in a crisis.

Transport and logistics: Transport Security Act (VerkSiG)
Transport is also critical infrastructure and at the same time underpins the functioning of other sectors (energy, water, health, food, IT). In bottlenecks or crises, the act provides the framework for prioritising transport services so that system-critical supplies and state functions remain accessible.