How do you protect buildings and technology from the outside in?
Protected infrastructure.
Buildings, data centres and facilities are not protected by one measure, but by coordinated layers from the outside in.
In 60 seconds
- Protection is built in zones from the outside in.
- The KRITIS Umbrella Act has applied to physical resilience since 17 March 2026.
- Access, video, intrusion detection, power and climate control work together.
4 areas, one concept.#
Outer shell
Site, fence, lighting and access roads are the first layer.
Building
Access, video and intrusion detection keep unauthorised people out and make incidents visible.
Technology
Power, climate control, fire protection and network connection must keep running during disruptions.
People and processes
Visitor rules, emergency plans and training keep the system alive.
Protection zones from the outside in.#
The more critical the area, the stricter the rules.
KRITIS Umbrella Act.#
In force since 17 March 2026: protecting physical resilience.
For the first time, the KRITIS Umbrella Act requires operators of critical facilities nationwide and across sectors to take measures for their physical resilience. It complements NIS2, which mainly regulates cyber security.
- 10 sectors, such as energy, transport, finance, health and drinking water.
- Risk analysis for critical services and facilities.
- Resilience measures and resilience plan, for example for emergency preparedness, physical protection and staff.
- Registration and reporting of relevant incidents.
- Management responsibility for implementation and supervision.
4 goals of the measures
Prevent incidents, ensure physical protection, respond appropriately and limit consequences, restore operations.
For data centres, standards such as EN 50600 or ISO/IEC 22237 are often used. As of November 2026, for guidance only, not legal advice. More on NIS2 on the NIS2 page.
How the building blocks work together.#
| Area | Building blocks | Link |
|---|---|---|
| Access | Separation, multi-factor access, visitor escort, logs | Access control |
| Video | Perimeter and entrances, analytics, secure storage | Video surveillance |
| Intrusion detection | Door contacts, motion detectors, alarm forwarding | Event triggers camera image |
| Fire protection | Early detection, extinguishing technology, fire compartments | Emergency release of doors |
| Power and climate | UPS, backup power, redundant cooling | Alert to monitoring |
| Network connection | Two independent paths, separate routes | High-security networks |
| Environmental sensors | Temperature, humidity, water, smoke | Monitoring |
Resistance classes for doors and windows.#
How long does an element withstand a break-in attempt?
| Class | Type of burglar and tools | Resistance time | Suitable for |
|---|---|---|---|
| RC 1 N | Opportunistic burglar using physical force (kicking, shoulder charge) | not specified | Side rooms without burglary risk |
| RC 2 N / RC 2 | Opportunistic burglar with simple tools such as screwdriver, pliers, wedge | 3 minutes | Flat and house, recommended by the police as a minimum standard |
| RC 3 | Additionally a second screwdriver and crowbar | 5 minutes | Commercial premises, offices, technical rooms |
| RC 4 | Experienced burglar, additionally saw, hammer, axe, cordless drill | 10 minutes | Server rooms, storage with valuables |
| RC 5 | Additionally power tools such as drill, jigsaw, angle grinder | 15 minutes | High-value technology, data centres |
| RC 6 | Additionally high-performance power tools | 20 minutes | Very high risks, special areas |
Resistance classes according to DIN EN 1627 for doors, windows and closures. Important: the class only applies if element, installation and fixing match. The time is the pure working time on the element.
UPS calculator.#
How much power and battery does your equipment need during a power cut?
Rough guidance, no planning and no legal advice. Everything runs only in your browser.
Check: infrastructure.#
6 questions about your site.
Rough guidance, no audit and no legal advice. Your selection stays in your browser.
Frequently asked questions.#
Who counts as an operator of critical facilities?
Law and regulation define this by sector and thresholds. Operators are registered. Have your classification checked by experts, ideally with your trade association or specialist advice.
Does a small business need perimeter protection?
Not to the depth of a data centre. But server room, access, fire protection and backup power make sense for small businesses too and can be implemented with manageable effort.
What does "state of the art" mean?
It means current, proven procedures and standards available on the market. The level keeps evolving, so regular review is part of it.
How are access and video connected?
An access event can display or store a camera image. This helps with alarms and investigations, but needs a data protection and permissions concept.
Thinking through your site?
Tell me which area you want to secure, and we will add to the content.