Contact

RKEG / CER

The CER Directive (Critical Entities Resilience) and its national implementation by the Resilience Act of Critical Entities (RKEG) focus on the resilience of critical services to physical, technical and organizational threats. The focus is not only on cyber risks, but on all threats that can impair the operation of essential services. Critical facilities must systematically assess risks, establish suitable protective and precautionary measures, and regularly review their resilience. The aim is to maintain essential social and economic functions even during serious disruptions, crises or disasters.

The RKEG obliges affected institutions to demonstrably provide:

  • Ensure the resilience of their critical services to severe disruptions and crises
  • Systematically assess risks, threats and vulnerabilities according to an all-hazard approach
  • Analyze and control critical dependencies on personnel, locations, suppliers, energy, IT and infrastructure
  • Implement appropriate technical, organisational and human resilience measures
  • Maintain effective crisis management and command structures
  • to be able to prove and document significant incidents and disruptions to the responsible authorities

5 typical challenges at RKEG / CER

Very few organizations start from scratch. In many cases, initial risk management, BCM or crisis management activities are already in place. Nevertheless, gaps regularly arise in the implementation of the RKEG requirements in terms of transparency, verifiability, resilience assessment and crisis capability, as well as in the consolidation into a resilience plan.

1

Critical services are not sufficiently transparent

There is often a lack of a reliable overview of which services are actually critical and on which processes, locations, service providers or infrastructures they depend. As a result, material risks remain hidden.

2

The scope of application is unclear

Many organizations are unsure which services, locations, resources, and organizational units actually fall under the regulatory requirements and how to delineate the essential service.

3

Critical dependencies are not sufficiently documented

External dependencies, for example on service providers, are often underestimated or not systematically evaluated and documented.

4

Crisis capability has never been realistically tested

Many organizations have concepts and documents, but have never checked whether managers and organizations are actually capable of acting under realistic crisis conditions.

5

Regulatory evidence is difficult to prove

Existing measures are often not sufficiently documented, audit trails are lacking and responsibilities are unclear. This makes it much more difficult to provide evidence to authorities.

To the RKEG Quick-Check

Our services

From the initial assessment of the current situation to the official verification, we support organisations in the systematic implementation of the requirements of RKEG.

RKEG-Maturitycheck

Bewertung des aktuellen Reifegrads der Organisation hinsichtlich der Anforderungen des RKEG.

Bewertung natürlicher, technischer, organisatorischer und vorsätzlicher Bedrohungen in einem integrierten Ansatz.

Ermittlung der Leistungen und Ressourcen, deren Ausfall erhebliche Auswirkungen auf Gesellschaft oder Wirtschaft hätte.

Bestimmung von Ausfallfolgen, Wiederanlaufanforderungen und Prioritäten für wesentliche Leistungen.

Analyse bestehender Schutz-, Vorsorge- und Bewältigungsmaßnahmen hinsichtlich ihrer Wirksamkeit.

Ableitung geeigneter organisatorischer und technischer Maßnahmen zur Aufrechterhaltung kritischer Dienstleistungen.

Konzeption und Befähigung von Krisenstäben, Entscheidungswegen und Eskalationsmechanismen.

Durchführung praxisnaher Krisensimulationen für Führungskräfte und Krisenorganisationen.

Begleitung bei Audits, Prüfungen und sonstigen Compliance-Nachweisen.