Industries

For critical infrastructure: dual oversight, one inventory.

Critical infrastructure is under dual oversight: NIS2 as the EU-wide harmonized directive, the KRITIS Regulation as the national framework with sector-specific requirements. Both require critical infrastructure operators to maintain a complete, current asset overview. The prerequisite for every vulnerability analysis, every incident report, every audit submission.

Start your trial license → Discovery call (15 min)

All industry solutions at a glance →

last_check: 09:47:12

Asset type	Count	In scope	Status
Administrative servers	47	IT	discovered
Clinical workstations	312	IT	discovered
Network switches	24	IT	discovered
Imaging (medical device)	18	MED	external
Patient monitoring (MED)	142	MED	external

Shared duties: NIS2 + critical infrastructure

What both regulatory frameworks require in parallel.

Asset inventory

With documented updates.

NIS2 Art. 21(2)(a) and the KRITIS Regulation together with §8a BSIG require the same thing: complete discovery with demonstrable currency.

Vulnerability tracking

Risk management & remediation.

Via the Cyber Insight integration (separate contract, German data centers). Handling status, owners, audit trail per CVE.

Vulnerability module →

Audit-ready evidence

At the push of a button, automated.

Ready-made reports. Asset inventory, license inventory, permissions audit, emergency manual. Saved to a storage location on schedule or sent by email.

Hospitals: KHZG funding & patch evidence

Hospital Future Act funding requirement 10. IT security documented.

Asset management and patch evidence as a funding condition.

The KHZG (Hospital Future Act) funds the digitalization of German hospitals through defined funding requirements. Funding requirement 10 (IT security) requires documented measures to improve IT security. Including asset management and vulnerability tracking. LOGINventory provides the evidence: complete asset documentation, patch management evidence, permissions auditing, automatic reports for verifying the use of funds.

The Cyber Insight integration supplements this with continuous, asset-level vulnerability tracking. Server processing takes place in German data centers. Permissions reports cover access rights to patient data servers and shares, with AD groups resolved recursively.

Important distinction: LOGINventory inventories IT infrastructure. Medical devices with their own software (imaging, patient monitoring, ventilators) fall outside the safe scope of application. These are subject to medical device regulation and are managed separately.

Critical infrastructure sectors

Nine sectors of particular significance. Where we deliver technically.

Energy

Electricity, gas, petroleum, district heating. IT side fully covered; OT partially (SNMP-capable).

Water

Water supply, wastewater disposal. IT inventory incl. control PCs.

Health

Hospitals, lab diagnostics, pharmaceutical supply. IT fully covered, medical devices separate.

Finance

Credit institutions, insurers, payment service providers. See also DORA.

Transport

Rail, road, water, air. IT administrative systems covered; OT specifics separate.

IT & telecom

Telecom providers, data center operations. Core business, fully covered.

Food

Food supply. IT administrative systems incl. ERP and control systems.

Media & culture

Broadcast operations and culturally relevant IT structures. Standard IT scope.

Waste management

Municipal waste. Administrative IT and control PCs.

IT vs. OT. Where the line is

LOGINventory covers the IT side fully: office devices, administrative servers, ERP, control PCs. OT inventory (PLCs, RTUs, SCADA, specialized industrial hardware) is partially coverable (SNMP-capable devices). But that’s not the focus. For pure OT discovery, specialized OT asset management tools are better suited; LOGINventory can be combined with them via REST API.

Clear boundaries

What LOGINventory does not cover in critical infrastructure environments.

○No specialized OT tool. Modbus, Profinet, OPC-UA are out of scope
○No SIEM/SOC. Security event correlation, 24/7 monitoring
○No incident response workflow. Separate IRM tools required

○No medical device management. Separate regulation
○No critical infrastructure audit concept. Formal auditing under §8a BSIG by accredited auditors

Ways to start

Build your critical infrastructure asset documentation before an audit or incident hits.

Choose whatever fits your compliance situation. Every path is no-obligation.

Trial license

30 days. Pilot in one area.

Suited for pilot discovery in one hospital department, one facility, or one site.

Request trial license →

Discovery call

Guided walkthrough in a test environment.

Before you install it yourself. A guided walkthrough of the relevant reports and workflows.

Schedule a time →

Critical infrastructure consulting

Clarify specific requirements.

For §8a BSIG, KHZG funding, or sector-specific audit templates. Direct contact.

Direct contact →