NIS2 + KRITIS · Drinking Water and Wastewater
Cybersecurity for Water and Wastewater Utilities
Since the NIS-2 Implementation Act (NIS2UmsuCG), water suppliers, wastewater management companies, and special-purpose associations are subject to the German Federal Office for Information Security Act (BSI-Gesetz)—often with a small team and without a dedicated security department. We provide the building blocks you need: phishing simulations, awareness training, vulnerability management, and incident response—for administrative IT, employees, and emergencies.
Regulatory context
Water and wastewater are included in the BSI Act – including municipal operators.
Drinking water supply and wastewater disposal are among the sectors with high criticality. Whether municipal enterprise, special-purpose association, public law institution (AöR), or municipal utility company (Stadtwerke-GmbH): anyone who reaches the thresholds is affected. We clarify the specific scope for your individual case in a free risk assessment.
01 · NIS2 / BSIG
Essential or particularly important facility
Entities with 50 or more employees or an annual turnover and balance sheet total exceeding €10 million are classified as "important entities." Those with 250 or more employees or over €50 million in turnover and a €43 million balance sheet total are classified as "particularly important entities." Obligations include: registration with the BSI (Federal Office for Information Security), risk management pursuant to Section 30 of the BSIG, reporting requirements pursuant to Section 32 of the BSIG, and implementation and supervision by management (Section 38 of the BSIG).
02 · Municipal Operators
Municipal enterprise, Special-purpose association, Institution under public law (AöR), Limited liability company (GmbH)
Legally dependent municipal entities, such as public utility companies and directly managed municipal enterprises, are also subject to the BSI Act if they provide their services for a fee. The only exception applies to entities for which water supply or wastewater disposal is not an essential part of their overall activities.
Legal sources: BSI Act (Sections 28, 30, 32, 38, 65 and Annex 1 BSIG) · BSI Critical Infrastructure Ordinance · KRITIS Umbrella Act.
TYPICAL ATTACK SCENARIOS
The attacks targeting water utilities today.
Small teams, numerous branch offices, remote access for service providers: The entry points are well known and keep recurring. Those who know them set the right priorities.
OUR SOLUTIONS
Four services that together make up your security program.
We take care of your office and administrative IT, your employees, and emergencies. Process control systems and plant automation are not part of our services—we collaborate with your existing partners in those areas.
Continuous training
Phishing Simulation
Regular campaigns with decoys based on everyday utility business—invoices, inquiries about official notices, emails from service providers. Measurable click and report rates that can be used directly as proof of required training.
Employee Resilience
Awareness Training
Core course taking around 20 minutes per year, plus short spotlights—for administration, customer service, IT/engineering, and on-call teams. Includes executive management training as required by Section 38 of the German Federal Office for Information Security Act (BSIG).
Know the attack surface
Vulnerability Management
Continuous detection and assessment of vulnerabilities in your office and administrative IT, prioritized by risk rather than CVSS noise, featuring remediation tracking and audit-ready reports.
IMMEDIATE HELP IN AN EMERGENCY
Incident Response
If it does happen: Initial assessment via the incident hotline, containment, analysis, recovery, and drafts for reports to the BSI. Mon–Fri 9 am–5 pm, initial consultation is free of charge.
WHY ENTROPY CS
Security for small teams with big responsibilities.
Many water utilities operate with just a handful of IT staff or rely entirely on service providers. They don't need a hundred-point action plan, but clear priorities, reliable proof, and support in an emergency.
Priorities instead of catalogues
We start where the risk is greatest—usually with phishing, unpatched access points, and the lack of an incident response plan. Step by step, alongside your existing team.
Documentation for Supervisory Authorities and Boards
Every one of our services generates evidence that you can use for NIS2 and ISO 27001—clearly prepared for plant management, association assemblies, or supervisory boards.
Care comes first
Every measure—scanning windows, training schedules, containment in an emergency—is coordinated to keep your business running smoothly. Cybersecurity is a means, not an end in itself.
The questions plant managers, executives, and IT leaders ask us. We can answer any further questions during your free Risk Assessment.