XL BESS Projects in Germany — Article 1: KRITIS

With most developers right now focused on grid connection, Baugenehmigung and pushing their projects to Ready-to-Build (RtB) status, one critical workstream keeps slipping through the cracks in the conversations I have — KRITIS. Almost every project in the XL pipeline is, by definition, critical infrastructure, and has to comply with strict regulation from the BSI. The cleanest way to protect your COD date is to plan KRITIS inside the project from Stage 0, not alongside it.

A BESS is roughly 90% global citizen — a BESS in Egypt is not fundamentally different from a BESS in Germany — but the moment you build it in a country with construction codes, grid codes and cybersecurity codes, that global citizen needs a passport. Germany is one of those countries.

This becomes more pointed as the largest projects in Germany attract Chinese suppliers offering full EPC scope. The technical and efficiency capabilities of these suppliers are not the question. The question is that construction is a local industry that must comply with local standards — and KRITIS, NIS2 and the BNetzA IT-Sicherheitskatalog apply to the asset and its operator regardless of where the supplier sits. The supply-chain transparency obligations under NIS2 Article 21 are vendor-agnostic by design; they bind whoever signs the contract.

Personally, my first KRITIS project was three years ago. I double-checked the regulation again before writing this article and a lot has been announced since then. The picture is clearer now — and also harder.

What KRITIS Actually Is

KRITIS is the German regime for "kritische Infrastrukturen". For energy assets, the operator becomes a "besonders wichtige Einrichtung" — a particularly important entity — once the relevant threshold in the BSI-KritisV is crossed. For BESS this most often means crossing one of these doors:

The threshold for storage / generation / aggregation of electrical power
0 MW for any unit contracted as a black-start asset
36 MW for prequalified Primary Control Reserve (FCR / PRL)

Almost every utility-scale BESS being developed in Germany today crosses at least one of these thresholds. Aggregator portfolios and BESS providing grid-forming (e.g. Black Start) ancillary services often qualify even below the headline storage threshold. KRITIS is therefore not a corner case — it is the default for the XL pipeline.

A point that is often missed: even the BESS owner — typically the SPV holding the asset — becomes a KRITIS entity in its own, because German regulators interpret "Betreiber" as the legal entity that holds control authority over the asset's operation, not just the entity that performs day-to-day operations. So design your SPV to be KRITIS-compliant from the moment it signs its first contract.

What changes once you are inside the perimeter:

You must register with the BSI within three months of becoming KRITIS-affected
You inherit the NIS2 reporting regime: 24-hour early warning, 72-hour incident notification, one-month final report. Someone has to carry that obligation 24/7 — meaning a named team and a deputy
You must operate a System zur Angriffserkennung (an attack-detection system, abbreviated SzA). The SzA must be designed in basic engineering, reflected in procurement, delivered as part of commissioning, and operated from COD. The SzA also requires a Security Operations Center (SOC), and the developer must decide early whether to build one in-house or contract a Managed Security Service Provider (MSSP)
You must establish a Business Continuity and Disaster Recovery plan (BCP / DR) under NIS2. For a BESS this means documented failover behaviour for telecontrol, EMS, SAS and the SOC uplink, tested recovery procedures, and clear roles for crisis operation. The BCP is one of the artefacts that the §39 BSIG Nachweis review will ask to see
You must demonstrate compliance every three years under the renewed §39 BSIG
Since March 2026, the KRITIS-Dachgesetz adds a mandatory Resilienzplan covering physical resilience — fences, cabinets, GNSS, spare parts, personnel — all to be addressed in the design phase
The BNetzA IT-Sicherheitskatalog requires an ISO/IEC 27001-based ISMS for the operator. ISO/IEC 27001 is an expensive standard to implement and audit, and I have wrestled with it personally — budget the time and cost realistically

None of this is impossible. All of it is several times more expensive when retrofitted after commissioning instead of designed in from Stage 0.

Explain within the Harmony triangle

I refer here to my harmony triangle “Engineering, Project Management, Project Finance” link: https://www.linkedin.com/pulse/beyond-iron-triangle-harmony-bess-dr-ing-ahmed-elbaz-wjmke?utm_source=share&utm_medium=member_ios&utm_campaign=share_via .

Engineering. The Substation Automation System (SAS) and the Energy Management System (EMS) must be integrated as a single safety-relevant control loop, with permissive published by the SAS, setpoints clamped by the EMS, and a deterministic conduit between them. Grid-forming services raise the bar further, because a GFM asset sits closer to grid-stability functions and attracts proportionally more regulatory scrutiny, so a sophisticated Grid Impact Studies Package is to be expected. A secured connection to external stakeholders e.g. TSO and Vermarkter is to be expected e.g. MPLS. Also the BCP must be refelected in the sizing and the design of the equipment, I always recommend Block Reliability Diagram method to solve this. The integration between the EMS and the SAS / SCADA is one of the most critical workstreams for both compliance and efficient operation, and the one I most consistently see overlooked in design and procurement. I will publish a dedicated piece on this interface in this series.

Project management. The BSI registration window, the SzA bring-up, the FAT security gate, the WAN provisioning lead time, the supplier qualification regime, the BCP exercises and the three-year Nachweis cycle all sit on the critical path. They do not run "in parallel" — they consume slack from the COD plan if they are not sequenced from Stage 0.

Project finance. Lender due diligence on XL BESS in Germany now routinely includes NIS2 and KRITIS readiness. A missing SBOM regime, an undefined PKI architecture, a vague remote-access policy or an absent BCP can stall financial close. Insurance underwriters are pricing cyber exclusion clauses more aggressively. EPC contracts that do not bind suppliers to security obligations push the residual risk onto the sponsor.

The single biggest source of avoidable cost on XL BESS projects is the moment the project realises that "security" is not a workstream that can be added in parallel to engineering. It is a property of engineering, contractual, scheduling and continuity decisions that have already been made.

A Roadmap for Developers — Stage 0 to Stage 6

The work fits inside the normal project stages — it does not require a parallel programme. What changes is what each stage has to deliver.

Stage 0 — Pre-feasibility. Run the KRITIS applicability check against the BSI-KritisV thresholds. Identify whether storage, black-start, FCR or aggregation puts you above the threshold — for the XL pipeline you almost always are. Scope the ISMS. Map the grid-side obligations under VDE-AR-N 4120 / 4130. Reflect the KRITIS scope in the project's risk register so it shows up in the first lender conversation, not the last.

Stage 1 — Basic Design. Produce the zone-and-conduit map. Specify the EMS — Plant Controller (PMS / PPC) — SAS interface contract. Decide the PKI architecture — a dedicated OT-PKI is my preferred default for XL BESS. Decide the time architecture: redundant grandmasters with independent GNSS antennas. Decide the WAN architecture early — primary MPLS, secondary MPLS or IPsec-over-LTE, separate SOC uplink, carrier separation, and provisioning lead times. Document the resilience plan envelope and the BCP framework so they feed the bankability case.

Stage 2 — Detailed Engineering. Define SCL governance. Build IED hardening templates. Build the RBAC matrix. Write the FAT security catalogue. Most importantly: write the supplier security clauses — Software-BOM, Hardware-BOM, PSIRT process, signed artefacts, escrow, audit rights — and place them inside the EPC and OEM contracts, not as a side annex. This applies to every supplier in the chain, regardless of country of origin: the obligation is on the asset and its operator, and only contractual flow-down protects the project.

Stage 3 — Procurement and Contract Close. Where you buy matters as much as what you buy. KRITIS readiness is not just about preferring one OEM over another — it is about the contract envelope you build around the OEM. For each major package (PCS, BMS, EMS, SAS, transformers, SCADA, telecontrol gateway, WAN carrier), the procurement decision should be evaluated on three axes: technical capability, supply-chain transparency (SBOM, HBOM, PSIRT, signed firmware, audit rights, escrow), and the supplier's willingness to operate under your remote-access discipline. Embed the security clauses in the body of the EPC and the OEM POs, tie them to milestone payments and FAT acceptance, and make remote-access discipline contractual: no shared OEM accounts, no permanent tunnels, brokered sessions through your jump host. Lender DD will land directly on these clauses, so they are also a financial instrument.

Stage 4 — FAT. Attend, and pay attention. My favoured approach is to insist on a system-level integrity test rather than a series of isolated product tests — at minimum bringing the critical and security-sensitive components together and testing them as one. KRITIS is a system-level certification, not a product-level one, and the FAT is the cheapest opportunity to discover gaps before cabinets leave the factory. Attempt unauthorised MMS writes, simulate GOOSE replay, force certificate revocation, test RBAC enforcement, force time-source failover. Vendors who cannot pass remediate at their cost, not yours.

Stage 5 — SAT and Commissioning. Verify on-site security. Validate the EMS — SAS handshake. Run the black-start ready test. Run the WAN failover test — drop the primary MPLS, confirm the secondary path carries telecontrol within the contracted recovery time, and confirm the SOC uplink stays alive. Run a first BCP exercise covering loss of telecontrol, loss of EMS and loss of site connectivity. Register with the BSI as "besonders wichtige Einrichtung". Bring the SzA into operation. These are now COD prerequisites, not paperwork.

Stage 6 — Operations Handover. Hand over incident playbooks, the BCP / DR runbooks with documented failover behaviour for telecontrol, EMS, SAS and the SOC uplink , the three-year Nachweis cycle calendar, the supplier audit calendar, the BCP exercise schedule, the KRITIS-Dachgesetz resilience plan, and the BBK liaison contact. The operator inherits a working programme — not a folder.

What Changes When You Do This Right

Three things, in my experience.

First, the entire communication architecture — and especially the SAS — EMS integration — becomes the safety-relevant control loop it should always have been, with the EMS clamping its dispatch decisions against the operating envelope the SAS publishes, and with telecontrol surviving the loss of any single WAN path. This single design choice prevents an entire category of cell-degradation, reactive-regime, black-start and availability failures.

Second, the EPC contract becomes the security control it should always have been. By the time a vendor is on-site, security obligations have already been priced and bound. Change-order exposure on cybersecurity, redundancy and BCP drops to near zero.

Third, the project enters commercial operation with a KRITIS posture that supports rather than constrains its commercial performance. The three-year Nachweis cycle becomes a documentation exercise. Lender DD on the next project closes faster. Insurance pricing improves. The asset behaves as the bankable, dispatchable, grid-supporting BESS the original investment thesis assumed.

Despite the renewed political emphasis on gas-fired capacity, I expect the German XL BESS market to mature rapidly between 2026 and 2030. The projects that institutionalise this framework during their development phase — engineering, contracting, financing and operating it as one envelope — will operate calmly. The projects that postpone it will discover, the hard way, that the regulatory clock starts at registration, the lender clock starts at DD, the carrier provisioning clock starts months before COD, and none of them wait for commissioning.

If you are developing an XL BESS in Germany right now, the four documents I most often pressure-test for clients are: (1) the KRITIS applicability matrix, (2) the EMS — SAS interface contract, (3) the supplier security clauses in the EPC, and (4) the WAN and BCP architecture. If you would like a second pair of eyes on any of them, send me a DM.

#BESS #EnergyStorage #KRITIS #NIS2 #Germany #IEC61850 #IEC62443 #GridForming #ProjectFinance #Bankability #MPLS #BCP #PowerEngineering #GridScale

Originally published on LinkedIn Pulse. Open the original →