Germany’s Critical-Infrastructure Protection Architecture

About this report

Germany has moved decisively to strengthen the legal protection of critical infrastructure, yet the emerging system reveals a structural imbalance between ambition and operational coherence.

A federal umbrella law for physical resilience is now in force, cyber governance is advancing under the NIS2 framework but has followed a discontinuous legislative path, and foreign-investment screening continues to operate through a pre-existing regime that has been expanded but not fundamentally restructured. The resulting configuration is not characterised by absence of regulation but by uneven layering across legal domains that were not originally designed to function as a single system.

Key questions this report answers

• What does Germany's federal umbrella law for physical resilience mandate, and how does it fit alongside the NIS2 cyber-governance framework?
• Why has Germany's cyber-governance legislation followed a discontinuous path, and what gaps does that create?
• How does the expanded but unrestructured foreign-investment screening regime interact with the new critical-infrastructure protection layers?
• What signals and open questions should be monitored to judge whether these layered legal domains function as a coherent single system?

Inside this report

• Opening paradox
• Documented baseline
• Analytical reading
• Implications by audience
• Signals to monitor
• Open questions and limitations

Who it's for

Strategy, corporate-development and investment teams that need an ecosystem-level view — budgets, industrial capacity and technology landscapes — before committing capital or capacity.

Related reports

• TKMS Wismar Shipyard Expansion and the Future of European Naval Industrial Capacity — Germany
• Germany’s €108.2 Billion Defence Budget for 2026 — Germany
• Germany’s €108.2 Billion Defence Spending Framework in 2026 — Germany
• Germany’s April 2026 Defence-Industrial Pipeline — Germany
• Germany’s €1.7bn Pivot: Inside the Rheinmetall-ICEYE Deal and the Financialisation of NATO’s ‘Space-as-a-Service’ — Germany
• The European Air Shield Initiative: Centralised Air Defence Procurement and Industrial Realignment — Germany

Methodology, format & delivery

DFM reports are built from primary and official sources — TED procurement notices, CORDIS and the EU Funding & Tenders Portal, EIB operations, the NATO Innovation Fund portfolio, SIPRI data, official budget documents and company disclosures — read together with the underlying legal texts. Sources are cited in the document; it reflects them as of its publication date (27 April 2026). You receive a 19-page PDF, watermarked to you on every page, delivered on the confirmation page and by e-mail immediately after checkout (personal link valid 72 hours, up to 5 downloads). Guest checkout, single-user licence — Terms of Sale.

Related on DFM

More Strategic reports · Free summary of this report · All reports

Prefer unlimited access?

Prefer unlimited access? Every report like this is included in the DFM Analysis subscription. See plans →

Get the full report — €299 →