Compliance software
for the water sector
Complaica is the compliance software for water suppliers, wastewater utilities, municipal utilities (Stadtwerke) and water associations. You organise NIS2, your ISMS under ISO 27001 or IT-Grundschutz, the B3S Wasser/Abwasser and data protection in one place: installations, processes and service providers are recorded once and linked to requirements, risks, measures and evidence.
- 01Information security and NIS2NIS2 and the German BSIG, ISMS under ISO/IEC 27001, BSI Standards 200-1 to 200-4, IT-Grundschutz and B3S Wasser/Abwasser — for IT and control systems
- 02Data protectionGDPR and the German BDSG: records of processing, technical and organisational measures, processors, data subject rights and data breaches
- 03ISO standardsISO 14001 and ISO 9001, internal audits under ISO 19011 in one audit programme
- 04Water sector lawsKRITIS-Dachgesetz, Drinking Water Ordinance (TrinkwV), Catchment Area Ordinance (TrinkwEGV) and Energy Efficiency Act (EnEfG)
Manage the water sector’s compliance requirements in one place
Your ISMS, data protection and the other frameworks that apply to your organisation work on one shared data set in Complaica. What is recorded once is used wherever it applies: you do not maintain installations, service providers and measures again for each framework.
- 01Installations, processes, systems and service providers in one model — waterworks, pumping stations, treatment plants, process control and telecontrol with their dependencies
- 02Assess requirements per framework on the same objects — NIS2 and BSIG, ISO/IEC 27001, IT-Grundschutz, B3S WA, GDPR and more
- 03Assess and treat risks per object in a configurable risk matrix
- 04Measures with owners, deadlines and status — one measure can be assigned to the requirements of several frameworks; every status change is recorded with author and date
- 05Evidence stored on the object; reports and dashboards for management, auditors and supervisory authorities
- 06Security incidents, data breaches and internal audits with their deadlines and findings
NIS2 for water and wastewater utilities
Drinking water and wastewater are among the sectors of the NIS2 Directive; in Germany it is transposed by the BSIG (BSI Act). Whether, and as which kind of entity, your organisation is covered depends on its activity, size and legal form, among other things. Complaica does not check this automatically — it records the outcome of your assessment and organises the obligations that follow from it. More on the NIS2 software page.
NIS2, the BSIG and the B3S are not the same thing: the directive sets the European framework, the BSIG lays down the obligations in Germany — such as the risk management measures under § 30 and the reporting obligations under § 32. The B3S Wasser/Abwasser describes the state of the art for the sector; implementing it replaces neither the applicability assessment nor the obligations under the BSIG.
- Define and document the scope
Map the organisation, sites and services as a tree and record which parts fall under NIS2; responsibilities are assigned per unit and per object.
- Installations, IT, control systems and service providers
Record waterworks, pumping stations, process control systems, telecontrol, applications and service providers with their dependencies — or import them from a CMDB, asset management or Excel.
- Assess risks
Assess and treat risks per object in the configurable risk matrix; treatment option, measures and residual risk stay documented and traceable.
- Measures under § 30 BSIG
Assess the ten risk management measures as requirements and track the measures for them with owners, deadlines and status.
- Document security incidents
Each incident is a record with timestamps, owners and affected objects; the deadlines under § 32 BSIG run as dates. You file the report itself with the joint reporting office of BSI and BBK.
- Evidence for audits and management
Evidence is kept on the object; dashboards show the implementation status from the single requirement up to the organisation — as a basis for oversight by management under § 38 BSIG and for audits.
ISMS software for water and wastewater utilities
An ISMS in Complaica connects the requirements of ISO/IEC 27001, BSI IT-Grundschutz and the B3S Wasser/Abwasser with your installations — for office IT as well as for process control and telecontrol. Each catalogue can be evaluated on its own; they share installations, risks and measures. More on the ISMS software.
Example: from pumping station to evidence
- 01
Pumping station
Installation in scope
The pumping station is an object with its site, owners and the processes that depend on it.
- 02
Control systems
Process control · telecontrol
The telecontrol unit is linked to the pumping station, and so is the service provider that maintains it remotely.
- 03
Risk
Assess the threat
For example insufficiently secured remote access — assessed in the risk matrix of your concept.
- 04
Measure
Plan the treatment
For example remote access only via secured, logged connections; assigned to the matching requirements, for instance from ISO/IEC 27001 and B3S WA.
- 05
Owner
Responsible and deadline
Owner, deadline and status; every status change is recorded with author and date.
- 06
Evidence
On the object
Configuration, log or test report are kept on the measure and the installation — with author and date.
- 07
Audit
Internal audit · ISO 19011
The internal audit rates the requirement and checks the measure and its evidence; a nonconformity becomes a new measure.
- ISO/IEC 27001
The certifiable ISMS, also based on IT-Grundschutz: requirements and Annex A controls are prepared as a catalogue, together with report templates. More on the ISMS software for ISO 27001.
- BSI Standards 200-1 and 200-2
ISMS under the BSI approach and the IT-Grundschutz methodology: structure analysis, protection requirements and modelling with the Compendium’s modules, including those for industrial IT; the IT-Grundschutz check shows the status per requirement.
- BSI Standard 200-3
Risk analysis for installations and systems with high protection requirements based on the elementary threats — with risk treatment and the residual risk that management accepts.
- BSI Standard 200-4
Business continuity management: business impact analysis, emergency operation of the water supply, recovery plans and exercises on the same processes and installations.
- B3S Wasser/Abwasser
The sector standard of DVGW and DWA — guideline W 1060 or DWA-M 1060 with its IT security guide. The BSI confirmed its suitability under the former law, valid until August 2027; under § 30(9) BSIG operators can propose sector-specific standards.
- ISO/IEC 27019 in multi-utilities
Additional controls for process control in energy supply, 2024 edition — mandatory for electricity and gas grid operators through the IT security catalogue of the Federal Network Agency, not for water supply. For municipal multi-utilities it sits next to the B3S WA.
Data protection for the water sector
Water utilities and associations process data of customers, members and employees — from consumption billing to contribution notices. Complaica runs data protection management under the GDPR on the same processes, applications and service providers as the ISMS; the Data Protection Kit brings templates and catalogues for the start.
- Records of processing activities
Consumption billing, meter reading, fee and contribution notices, customer service, HR and video surveillance of installations — with purpose, legal basis and retention periods (Art. 30 GDPR).
- Smart water meters
Radio water meters deliver consumption data that can allow conclusions about a household. Legal basis, retention period and whether a data protection impact assessment is needed have to be checked (Art. 35 GDPR).
- Processors and service providers
Billing, IT and maintenance providers with their contracts under Art. 28 GDPR — the same providers the ISMS assesses in the supply chain.
- Technical and organisational measures
Suitable ISMS measures can also be documented as technical and organisational measures and assigned to the corresponding data protection requirements (Art. 32 GDPR).
- Data subject rights and data breaches
Access and erasure requests with their one-month deadline, data breaches with the 72-hour deadline under Art. 33 GDPR — each as a record with deadlines and history.
- GDPR, BDSG and state law
For utilities under private law the BDSG supplements the GDPR; for public-law associations and municipal enterprises it is the data protection act of their federal state.
Who it is for: water supply, wastewater and water associations
Whether it is the waterworks of a municipal utility, a wastewater association or a dyke association: information security and data protection concern all of them; which further frameworks apply depends on the line of business and size.
- 01
Drinking water
- Water suppliers
- Waterworks
- Water supply associations
ISMS and B3S WA for abstraction, treatment and control systems, data protection for customer and consumption data; NIS2 and KRITIS where the thresholds are reached; plus TrinkwV and TrinkwEGV.
- 02
Wastewater
- Wastewater associations
- Wastewater special-purpose associations
- Municipal drainage
Information security for treatment plants, pumping stations and control systems, data protection for fee notices; plus B3S WA and KRITIS above the thresholds, EnEfG and ISO 14001.
- 03
Multi-utility and municipality
- Water and wastewater associations
- Municipal utilities (Stadtwerke)
- Local utilities
One ISMS and one data protection management across all lines of business — water next to energy and transport —, with ISO/IEC 27019 for the energy business and quality management under ISO 9001.
- 04
Watercourses and hydraulic engineering
- Watercourse maintenance associations
- Water and soil associations
- Drainage associations
- Irrigation associations
- Dyke associations
- Sluice associations
- Dam associations
Secure pumping stations, sluices, dykes and dams with their telecontrol, keep member and contribution data under the GDPR; processes under ISO 9001 and ISO 14001.
- 05
Association level
- Water industry associations
- Umbrella associations
Their own obligations in data protection and information security — and shared catalogues, templates and evaluations for their members.
What Complaica brings in practice
Six reasons why utilities and associations run their compliance with Complaica.
Less duplicate entry
Installations, service providers, risks and measures are maintained once and used by every framework that draws on them.
Clear responsibility
Objects, risks and measures have owners and deadlines; access rights follow the structure of your organisation.
Traceable down to the evidence
Status changes with author and date, evidence on the object — for internal audits, auditors and management.
IT and control systems in one model
Process control systems, telecontrol and office IT sit in the same model with their dependencies — showing which installation carries the supply.
For small and large organisations
From local utility to large supplier: you start with the frameworks that apply today and add more as they come.
Software plus expert consulting
Our consultants support set-up, risk analyses and audit preparation — as far as you need.
The water sector’s frameworks at a glance
What each framework asks for, whom it typically concerns and what Complaica keeps for it — ordered by information security, data protection, ISO standards and the laws of the sector.
01 Information security BSI Standard 200-1 · BSI Standard 200-2 · BSI Standard 200-3 · BSI Standard 200-4 · ISO/IEC 27001 · ISO/IEC 27019 · B3S Wasser/Abwasser · BSIG 8
| Framework | What it asks for | Typically concerns | In Complaica |
|---|---|---|---|
| BSI Standard 200-1Information security management systems (ISMS) | Requirements for an ISMS: policy, security organisation, security process and the responsibility of management. | all organisations building their information security on the BSI approach | ISMS with policy, roles, objectives, document control and management review |
| BSI Standard 200-2IT-Grundschutz methodology, with the IT-Grundschutz Compendium | Basic, standard or core protection: structure analysis, protection requirements, modelling with the Compendium’s modules, IT-Grundschutz check. | organisations working with IT-Grundschutz or aiming for ISO 27001 based on IT-Grundschutz | IT-Grundschutz with Compendium, modelling and IT-Grundschutz check; Grundschutz++ as its successor |
| BSI Standard 200-3Risk analysis based on IT-Grundschutz | Risk analysis for target objects with high or very high protection requirements, based on the elementary threats. | everyone whose installations and systems have increased protection requirements | threats, configurable risk matrix and risk treatment per object |
| BSI Standard 200-4Business continuity management | Business impact analysis, emergency preparedness, emergency and recovery plans, tests and exercises. | utilities whose failure affects the supply of the population | BIA, recovery times and emergency plans on the same processes and installations |
| ISO/IEC 27001Information security, 2022 edition | A certifiable ISMS with risk treatment and the controls of Annex A. | utilities aiming for a certificate — also based on IT-Grundschutz | the ISMS for ISO 27001 from scope to audit |
| ISO/IEC 27019Controls for the energy utility industry, 2024 edition | Adds controls for process control and telecontrol in energy supply to ISO/IEC 27002. | municipal and multi-utilities with an energy business; also a reference for control systems in water supply | ISO/IEC 27019 controls next to ISO/IEC 27001 and B3S WA on the same installations |
| B3S Wasser/AbwasserDVGW W 1060 · DWA-M 1060 | The sector-specific security standard for IT security in water supply and wastewater disposal, with an IT security guide and handbook. | operators of critical installations in the water sector — and everyone who follows the sector standard | B3S requirements on installations and control systems, measures and evidence for the audit |
| BSIGGerman NIS2 implementation | Risk management measures (§ 30), reporting, registration; for critical installations evidence every three years (§ 39). | important and essential entities in the drinking water and wastewater sectors, operators of critical installations | the ten measures under § 30, security incidents with the deadlines under § 32; more on the NIS2 software |
02 Data protection GDPR · BDSG 2
| Framework | What it asks for | Typically concerns | In Complaica |
|---|---|---|---|
| GDPRGeneral Data Protection Regulation | Records of processing activities, legal bases, technical and organisational measures, data subject rights, breach notification, data protection impact assessment. | everyone — customer, consumption and member data, fee and contribution notices, employees | the GDPR data protection management with ten data protection activities |
| BDSGand the federal states’ data protection acts | Supplementary rules, for example on employee data, video surveillance and the data protection officer. | utilities organised under private law; public-law associations under the act of their federal state | own catalogues for the BDSG and state law next to the GDPR |
03 ISO standards ISO 14001 · ISO 9001 · ISO 19011 3
| Framework | What it asks for | Typically concerns | In Complaica |
|---|---|---|---|
| ISO 14001Environmental management, 2026 edition | Environmental aspects, compliance obligations, environmental objectives, emergency preparedness and evaluation of environmental performance. | utilities and associations with certified or planned environmental management | environmental aspects and legal obligations per site, objectives, indicators and internal audits |
| ISO 9001Quality management, 2026 edition | Process-based quality management with risks and opportunities, objectives, control of documented information and improvement. | operators with a quality management system, often together with technical safety management | the quality management for ISO 9001 from scope to recertification |
| ISO 19011Guidelines for auditing, 2026 edition | Guidance on audit programmes, conducting audits and the competence of auditors; not certifiable. | everyone who carries out internal or supplier audits | audit programmes, sessions, findings, actions, audit reports and management review |
04 Water sector laws KRITIS-Dachgesetz · TrinkwV · TrinkwEGV · EnEfG 4
| Framework | What it asks for | Typically concerns | In Complaica |
|---|---|---|---|
| KRITIS-DachgesetzGerman Critical Infrastructure Umbrella Act, physical resilience | Registration, risk analysis and assessment, resilience measures and resilience plan, reporting incidents to the BBK. | operators of critical installations in the water sector | risk analysis per installation, resilience plan from the measures, incidents with a 24-hour deadline |
| TrinkwVDrinking Water Ordinance 2023 | Risk management for the water supply system from catchment to point of use, following DIN EN 15975-2, with an application to the public health office. | operators of central water supply systems from 10 m³ a day or 50 people supplied | hazards per part of the system, risk assessment, measures and the documentation for the application |
| TrinkwEGVDrinking Water Catchment Area Ordinance | Defining and describing the catchment area, hazard analysis, risk assessment and monitoring; documentation submitted to the authority. | operators of water abstraction plants | catchment areas as objects, hazards and assessments, update deadlines |
| EnEfGEnergy Efficiency Act | Energy or environmental management system above 7.5 GWh, implementation plans for economic measures above 2.5 GWh of final energy a year. | energy-intensive operations — pumping, treatment, aeration in wastewater plants | energy consumers as objects, savings measures with their economics, implementation plans |
Water sector laws: KRITIS, drinking water and energy
On the same installations Complaica keeps the obligations that apply only to utilities — from physical resilience to the risk management of drinking water.
- KRITIS-Dachgesetz
Registration, the first risk analysis and assessment nine months later, then at least every four years (§ 12); resilience measures such as emergency power, physical protection and access control in the resilience plan (§ 13); incidents reported to the joint reporting office of BSI and BBK no later than 24 hours after becoming aware (§ 18, legal text).
- Drinking Water Ordinance (TrinkwV)
Risk management for the water supply system following DIN EN 15975-2 — first by 12 January 2029 above 100 m³ a day or 500 people supplied, by 12 January 2033 for smaller systems, with an application to the public health office; reviewed at least every six years (§ 34 TrinkwV).
- Catchment Area Ordinance (TrinkwEGV)
Define and describe catchment areas, analyse hazards, assess risks and document the monitoring. The first documentation was due on 12 November 2025, the first update is due on 12 July 2030 (§ 12 TrinkwEGV).
- Energy Efficiency Act (EnEfG)
Above 7.5 GWh of final energy a year an energy management system under ISO 50001 or an environmental management system under EMAS, above 2.5 GWh published implementation plans (EnEfG, §§ 8, 9). An amendment that would raise the thresholds to 23.6 and 2.77 GWh has been before the Bundestag since September 2026.
ISO standards: ISO 14001 and ISO 9001
In Complaica, environmental and quality management share processes, objectives, risks and audits with the ISMS and data protection.
- ISO 14001:2026
The new edition of the standard for environmental management systems was published in April 2026, with a 36-month transition. Environmental aspects, compliance obligations and objectives are assigned to sites and processes.
- ISO 9001:2026
The sixth edition of the standard for quality management systems has applied since September 2026. More on the ISO 9001 software.
- One audit programme for all standards
Internal audits under ISO 27001, ISO 14001, ISO 9001 and B3S WA run in one audit programme — as the next section describes.
Internal audits under ISO 19011
ISO 27001, ISO 14001 and ISO 9001 require internal audits; the ISMS and the B3S WA are reviewed regularly, and the evidence under § 39 BSIG rests on audits, checks or certifications. Complaica runs them along the ISO 19011:2026 guidelines — from audit programme to management review. How an audit runs in the audit module is shown on the internal audit software page.
- 01Plan audit programmes for a period — with objectives, scope, audit criteria and schedule; internal, supplier and combined audits in the same tree
- 02Conduct audits in sessions — per installation, process, site or interview, on site or remote
- 03Rate each requirement as conforming, partial, nonconforming or not applicable
- 04Findings directly on the requirement — nonconformity or observation, with status, severity and evidence
- 05Corrective actions with owners, deadlines and status; in the follow-up audit the earlier rating stays visible on the requirement
- 06Audit reports with status up to issue, and the management review from the same data
- 07External auditors and service providers work in the same system, with access per object and by link
- ISO 19011:2026
The international guidelines for auditing management systems, fourth edition of May 2026: principles, managing an audit programme, conducting audits and auditor competence — guidance, not a certifiable standard.
- Risk-based planning
ISO 19011 recommends directing resources where risks are high and performance is low. In Complaica, compliance level and risk assessment per installation show where that is.
- On site and remote
Sessions take place on site, remotely or mixed — useful for distributed installations such as wells, pumping stations and treatment plants. The 2026 edition extends the guidance on remote audit methods and virtual locations.
The water sector’s deadlines at a glance
The fixed dates and recurring cycles of the frameworks on this page. In Complaica every deadline sits on the installations and measures it applies to.
Recurring
- 24 hours
KRITIS-Dachgesetz: initial report of an incident; detailed report after one month.
- 72 hours
GDPR: notification of a data breach to the supervisory authority.
- 3 years
BSIG: evidence for critical installations under § 39.
- 4 years
KRITIS-Dachgesetz: risk analysis and risk assessment, at least.
- 6 years
TrinkwV: review of risk management; TrinkwEGV: update.
- 12 November 2025
TrinkwEGV: first documentation of the catchment areas’ risk assessment to the authority.
- 11 March 2026
KRITIS-Dachgesetz promulgated; operators’ obligations run from their registration as a critical installation.
- April 2026
ISO 14001:2026 published; existing certificates transition within 36 months.
- September 2026
ISO 9001:2026 published.
- August 2027
End of the confirmed suitability of the B3S Wasser/Abwasser under the former law.
- 12 January 2029
TrinkwV: risk management for systems above 100 m³ a day or 500 people supplied.
- 12 July 2030
TrinkwEGV: first update of the documentation.
- 12 January 2033
TrinkwV: risk management for systems from 10 m³ a day or 50 people supplied.
Water sector compliance with AI assistance
With the optional AI integration (MCP), Complaica answers questions about the frameworks, explains requirements, suggests measures and finds answers in your own policies and documents. Through MCP Apps, Complaica answers in the chat with interactive views of your data — such as the risk matrix of an installation. Assessment and decision stay with you.
- 01Risk matrix, object lists and other views right in the chat — with MCP Apps, in AI assistants such as Claude
- 02Answer questions on the BSI Standards, B3S WA, GDPR and the sector’s laws
- 03Explain requirements and suggest suitable documentation
- 04Draft and assign measures and tasks
- 05Evaluate your operating instructions, policies and emergency plans
Introduction and operation: SaaS or on-premises
What you get, how your data gets in, and where Complaica runs.
- What is included
The Complaica modules — organisation, assets, requirements, risks, measures, security incidents, audits and reports — and the requirement catalogues of the frameworks you use. Report templates are prepared for ISO/IEC 27001, IT-Grundschutz and NIS2; you can add your own catalogues.
- Taking over existing data
Installation lists, risk analyses and measures can be imported from Excel and through the REST API, assets also from a CMDB and asset management.
- SaaS or on-premises
The SaaS edition is operated in Germany; alternatively you run Complaica in your own infrastructure. The licence costs the same either way.
- Guided introduction
Our consultants support set-up, data migration and the first risk analyses to the extent you need.
- Catalogues and legal status
The requirement catalogues ship with Complaica, and we keep them current: when a framework changes, we update the catalogue. Catalogues in OSCAL format, such as the Grundschutz++ user catalogue, can also be re-imported directly from approved sources. Whether a framework applies to you and how to interpret it is your decision — with our consultants if you wish.
Customer voices on Complaica
“We can do everything we need in one tool”
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool. For us, Complaica is better than the alternatives on the market and cheaper at the same time.
More …Less
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool.
For us, Complaica is better than the alternatives on the market and cheaper at the same time.
“The optimised compliance process”
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort. In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality. On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
More …Less
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort.
In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality.
On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
“The guided approach played a decisive role for us”
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process. Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before. So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
More …Less
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process.
Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before.
So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
Frequently asked questions on compliance in the water sector
How does Complaica support NIS2 in the water sector?
Complaica records which parts of your organisation fall under NIS2, captures installations, IT, control systems and service providers, assesses risks and the measures under § 30 BSIG, tracks measures with owners and deadlines and documents security incidents with the deadlines under § 32 BSIG. The software does not check automatically whether your organisation is covered, and you file reports with the reporting office yourself. More on the NIS2 software page.
Is every water supplier covered by NIS2?
No, not automatically. Drinking water and wastewater are among the sectors of the BSIG; whether an organisation counts as an important or essential entity or as an operator of a critical installation depends on its activity, size, thresholds and legal form and has to be checked case by case.
How can the B3S Wasser/Abwasser and ISO 27001 be managed together?
Both are separate requirement catalogues in Complaica on the same installations, systems and service providers. Risks and measures are kept once and assigned to the matching requirements of both catalogues; the status can still be evaluated separately per catalogue. There is no second ISMS beside the first. More on the ISMS software for ISO 27001.
How are the ISMS and data protection connected in Complaica?
Both work on the same processes, applications and service providers. Suitable ISMS measures can also be documented as technical and organisational measures and assigned to the corresponding data protection requirements. A data breach is a security incident with its own 72-hour deadline under Art. 33 GDPR. More on the GDPR software.
Is Complaica suitable for small water suppliers and special-purpose associations?
Yes. You start with the frameworks that apply to you today — often data protection and information security — and add more as they come; the data set grows with you. Responsibilities can be assigned clearly even when a few people carry many tasks, and our consultants take on tasks for which there is no dedicated position if you wish, such as that of an external information security officer.
What is the B3S Wasser/Abwasser?
The sector-specific security standard of DVGW and DWA for IT security in water supply and wastewater disposal: the guideline DVGW W 1060 or DWA-M 1060 and the IT security guide with its handbook. The BSI has confirmed its suitability; according to its overview this is valid until August 2027.
Do water utilities need ISO/IEC 27019?
ISO/IEC 27019 adds controls for process control in energy supply to ISO/IEC 27002. It is mandatory for electricity and gas grid operators through the IT security catalogue of the Federal Network Agency, not for pure water suppliers. Municipal multi-utilities keep it next to the B3S WA; for control systems in water supply it is a useful reference.
Can we model process control and telecontrol?
Yes. Process control systems, controllers, telecontrol units and control rooms are objects like servers and applications — with their dependencies on the installations they control and the service providers that maintain them.
How do the BSIG and the KRITIS-Dachgesetz relate?
The BSIG governs cybersecurity, the KRITIS-Dachgesetz the physical resilience of critical installations — with its own risk analysis, resilience plan and reports to the BBK. In Complaica both sit on the same installations; a measure such as emergency power can be assigned to the requirements of both.
Does Complaica support risk management under the Drinking Water Ordinance?
Hazards, risk assessments and measures can be kept per part of the system — from abstraction to distribution — and compiled as documentation for the application to the public health office. Catchment areas under the TrinkwEGV are objects of their own with their own assessment.
How do internal audits under ISO 19011 work in Complaica?
You create the audit in the audit programme with scope and criteria, split it into sessions, rate each requirement, raise findings on the requirement and create actions for nonconformities. The audit report goes through its status up to issue; the results feed into the management review. ISO 19011 is a guideline and not certifiable — the software supports the processes it describes. More on the audit management page.
Where is our data stored?
In the SaaS edition, in Germany. Alternatively you run Complaica on-premises in your own infrastructure — the licence costs the same either way.
Can we take over existing data?
Yes. Installation lists, risk analyses and measures can be imported from Excel and through the REST API; our specialists support the migration.
Who keeps the requirement catalogues current?
We do. The frameworks’ catalogues ship with Complaica and are maintained by us; when a framework changes, we update the catalogue. Whether and how a framework applies to your organisation is your decision — with our consultants if you wish.
Does Complaica replace the review by an authority or auditor?
No. Complaica keeps requirements, assessments, measures and evidence so that auditors, supervisory authorities and the public health office can follow them. The review and approval itself stay with them; there is no “NIS2 certification” of the software.
Sources References and legal sources
15 sources · BSI-Standards 200-1 bis 200-4, ISO/IEC 27001, B3S WA, GDPR, … Show Hide
Legislation
Norms & standards
Only the version published in the respective official journal is legally binding. Standards are available from the publishers named.
Discuss a Complaica offer for your organisation
Let us know briefly which installations and frameworks you look after. We will gladly show you Complaica on your case.
Thank you.
We will get back to you within one business day.
Not sent.
That did not work. Please check the fields or email us directly.