Private sector

How businesses are affected in the event of collective defence

1) Host Nation Support and prioritisation of resources

In the event of collective defence, Germany supports allied forces during their stay and transit. This concerns supplies, transport, accommodation, fuel, food, repairs and medical support. For businesses, this means that logistics and supply chains come under pressure because transport capacity, infrastructure and certain goods are prioritised. What is a question of efficiency in peacetime becomes a question of staying power and control capability in the event of collective defence. The central question is: which services remain available, which are redirected, and how can businesses safeguard their core functions under new priorities?

2) Sabotage and hybrid attacks as a realistic scenario

Collective defence does not only begin with open hostilities. Sabotage, cyberattacks, disinformation, outages in energy or IT, disruptions on rail and road, attacks on hubs or staff – all of this can already occur during the implementation phase of military measures. In such situations, businesses are affected twice over: as targets and as co-bearers of critical functions. Anyone who provides electricity, data, transport, water, health, production or supplies becomes a target and, at the same time, a prerequisite for the state’s ability to act.

3) Resilience as an operational duty, not an add-on

Resilience means not only protection but, above all, continuity: the ability to remain operational under disruption, to set priorities, to simplify processes and to respond in coordination with authorities and partners. In the event of collective defence, resilience is decided not at the margins but at the core. It comes from redundancy, clear responsibilities, practised procedures and reliable communication, internally and externally.

4) Staff shortages as key personnel are called away

In the event of collective defence, it is not only the situation regarding goods and infrastructure that changes, but also the availability of staff. Parts of the workforce may be drawn into state functions, for example through civil protection deployments or reservist status. Key staff in engineering, IT, logistics, maintenance, medicine or management in particular may be unavailable at short notice or tied up elsewhere. For businesses, this means that resilience planning must also be workforce planning – with deputising rules, prioritised core processes, skills backups and the question of which functions must be secured under all circumstances.

What businesses can prepare now

Understand the scenario and dependencies

Businesses should examine their own role in the event of collective defence not in the abstract, but function by function. Which services are system-critical? What dependencies exist on electricity, IT, staff, suppliers, transport, water and fuel? Which hubs are vulnerable? Where are the single points of failure?

Strengthen crisis organisation and decision-making

A crisis team alone is not enough. What matters are clear decision-making channels, deputising arrangements, prioritised core processes and a communication logic that works even during outages. Who informs whom, through which channels, at which thresholds?

Think of cyber and information security as operational capability

Cyber defence is not an IT task but a management task. Collective defence increases the likelihood of targeted attacks on supply chains, identities, industrial control systems and communication networks. Businesses need robust standards, offline capability for critical processes and practised restart plans.

Cooperation instead of parallel planning

In the event of collective defence, resilience does not work in isolation. What matters is connectivity with authorities and operators, exchange formats, shared situation pictures where possible, and clarified interfaces with local and state government. The better cooperation is prepared, the less friction there is under pressure.

Whole-of-society defence does not affect businesses as spectators. It affects them as providers of supplies, mobility and functioning systems. Those who are prepared protect not only their own business. They stabilise the system we all live in.

Preparedness and emergency supply laws

Cyber & physical resilience: EU NIS2 Directive and CER Directive

NIS2 and CER are two complementary EU directives that together create a harmonised European framework for the resilience of critical infrastructure. The NIS2 Directive governs cyber resilience, the CER Directive physical resilience. Both have uniform objectives across the EU, but are shaped and transposed into national law at national level. In Germany, the NIS2 Directive is being implemented through the amendment of the BSIAct (BSIG-neu) , and the CER Directive through the KRITIS Umbrella Act (KritisDG).

For businesses, this means that anyone classified as critical infrastructure must take a holistic view of resilience and is obliged to protect themselves appropriately against both digital and physical threats. This includes supply chain security measures, handling and reporting incidents, and ensuring business continuity even under threat or active attack. The legislator explicitly requires an all-hazards approach, i.e. taking into account a broad range of risks and suitable measures to address them.

As both directives are harmonised across the EU, this applies not only to the German market but, in essence, to all sites and supply relationships within the EU. Businesses with sites in several countries face the additional challenge of taking all the relevant national specifics into account.

NIS2 places particular emphasis on early reporting of cyberattacks to central bodies. As it is comparatively easy to attack several targets at once in cyberspace, reports to and warnings from the competent authorities are also meant to help critical infrastructure businesses learn of such waves of attacks early – possibly before they are affected themselves.

Energy: Energy Security Act (EnSiG)
The EnSiG is relevant to the private sector because energy shortages immediately hit production, logistics, IT and supply chains. The act provides the basis for managing energy flows and priorities in a crisis so that particularly critical sectors of the economy can keep running – businesses should therefore plan for emergency operation, redundancy and prioritisation logic.

Water: Water Supply Security Act (WasSiG)
For businesses, water is a production and hygiene factor; outages affect processes, cooling, cleaning and the ability to deliver. The WasSiG is relevant because it sets the crisis framework within which water availability is prioritised and operational adjustments become plannable.

Food: Food Security and Preparedness Act (ESVG)
The ESVG sets the crisis framework for securing supply when normal market and supply chain logic no longer holds. It thus creates predictability about roles, prioritisation and the state’s options for intervention, without replacing businesses’ operational responsibility.

Postal Act (PostG) and Telecommunications Act (TKG)

• PostG: Businesses use postal and parcel services for supply chains, spare parts, contracts and documents, and often depend on them more in crisis mode. The PostG is the sectoral framework in which these services are organised.
• TKG: almost every value chain (IT, logistics, production, payments) depends on telecommunications. The TKG forms the regulatory basis for the networks and services that enable business continuity.

Transport and logistics: Transport Security Act (VerkSiG)
Supply chains and business continuity depend on predictable transport services, which may be prioritised or restricted in a crisis. The VerkSiG is relevant because it creates the legal basis for organising transport services in an orderly way during a crisis, instead of leaving shortages entirely to the market.