Information technology and telecommunications

What changes in the event of collective defence

1) IT becomes a primary target

Hybrid threats often strike digitally first: DDoS attacks, ransomware, supply chain attacks, data manipulation, radio and GPS jamming, and disinformation. The aim is rarely “destruction for its own sake”, but rather to weaken the ability to steer, trust and the functioning of everyday life.

2) Cascade effects increase

A failure of mobile networks, the internet or central IT services leads not only to communication problems but to real supply risks: control centres become unreachable, logistics systems fail, payment systems become unstable, water and energy processes come under pressure, hospitals lose IT-supported workflows.

3) Prioritisation and emergency operation become the norm

In the event of collective defence, not every system can continue at full quality. What matters is which services are defined as “must run”, how emergency operation is organised and how communication works without digital convenience functions.

Where the vulnerability lies

Network dependency and single points of failure

Many critical functions depend on a few hubs: backbone connections, central data centres, DNS services, authentication and identity infrastructure, remote maintenance and cloud dependencies.

Control systems and operational technology (OT)

Industrial and critical infrastructureoperations depend on OT systems (SCADA, telecontrol). If this layer is disrupted, there are direct physical consequences, for example in energy, water, transport or production.

Supply chain and third parties

Security risks often arise not in one’s own network but via service providers, software updates, libraries, external maintenance or compromised identities. This makes security an ecosystem task.

Disinformation and loss of trust

Information operations aim to create uncertainty, weaken trust in institutions and push the public towards contradictory interpretations. Combined with technical disruptions, the risk of panic, paralysis or aggressive rumour-mongering increases.

What resilient IT and telecoms need in practice

1) Redundancy and fallback capability

• several communication channels (mobile, landline, radio, satellite, emergency channels)
• core processes and fallback procedures in administration, health and logistics that work offline
• robust backup and restart plans (including “clean” backups)

2) Hardening and segmentation

• consistent patch and vulnerability management
• segmentation between IT and OT, the “least privilege” principle, strong identity protection
• emergency mechanisms against DDoS and fast lock/reset processes for compromised accounts

3) Exercises and crisis routine

Resilience comes from practised procedures: incident response, communication chains, decision-making rights, escalation levels, cooperation with authorities and other operators.

4) Communication under disruption

Crisis communication must also work without the internet: warning systems, sirens, radio, loudspeaker announcements, local points of contact, notices. At the same time, a prepared narrative against disinformation is needed: clear, recognisable sources, consistent messages, rapid corrections.

What this means for businesses, local authorities and households

Businesses and critical infrastructure operators

need clearly defined “must run” services, access to emergency operation, redundant communication channels and practised cooperation with service providers and authorities. Cyber is not a compliance issue but a question of operational capability.

Local authorities and administration

must define core processes for offline operation: reachability of control centres, crisis teams, public information, payment and reporting channels. This concerns not only IT but also organisation and staff.

Households

stabilise the system through basic preparedness: a battery-powered radio, a power bank, emergency contacts on paper, knowledge of warning systems. Anyone who can make sense of warnings and does not depend on rumours remains able to act.

Preparedness and emergency supply laws

Postal Act (PostG) and Telecommunications Act (TKG)
Postal and telecommunications networks are among the basic functions that modern societies rely on: they enable warnings, crisis communication, payments, supply chains and the state’s ability to act. The Postal Act (PostG) and the Telecommunications Act (TKG) form the central legal framework for this in normal operation – and are relevant in a crisis or conflict because they set the conditions for the availability, performance and organisational obligations of postal and telecoms providers.

Energy: Energy Security Act (EnSiG)
Without energy, data centres, mobile networks, control centres and warning systems work only to a limited extent. The EnSiG provides the framework for managing energy supply during disruptions so that communication and control capabilities are preserved as far as possible.

Water: Water Supply Security Act (WasSiG)
Water supply depends on IT/OT control systems, communications and measurement and control systems; disruptions can delay operation and restart. The WasSiG is relevant because securing supply only works if control capability and crisis communication are maintained even under digital disruption.

Food: Food Security and Preparedness Act (ESVG)
Food supply depends on IT: inventory management, ordering, cold-chain monitoring, payment processes and crisis communication are digital. The ESVG is relevant because a supply crisis is hard to manage without functioning information and communication channels, so the resilience of these systems helps determine implementation.

Transport and logistics: Transport Security Act (VerkSiG)
Telecoms and IT infrastructure rely on maintenance, repairs and physical logistics (spare parts, batteries, backup power). The VerkSiG is relevant because traffic management in crisis mode determines whether this support reaches critical sites in time.

Resilience regulation for critical infrastructure (physical & cyber)

• NIS2 is the core here: binding minimum requirements for cyber risk management, incident reporting and supply chain security are intended to keep basic digital functions stable.
• The KRITIS Umbrella Act remains relevant as a physical framework insofar as critical facilities and sites (e.g. central hubs, operating sites) are classified as critical infrastructure.