Die Anschläge in New York und Washington am 11

co-operation
between the state and 
infrastructure operators
is a prerequisite for clearly defining 
comprehensive protection measures. It is the operators who 
possess an adequate detailed knowledge of their 
infrastructures and are in a position to implement concrete 
protection measures in an effective manner. Agreement thus 
1
For example, Section 91 of the German Stock Corporation Act (establishment of risk 
management and monitoring systems), the Ordinance on Major Incidents, other general 
and specific obligations for operators and the new Basle II accord on capital standards. 

---

- 6 - 
first of all requires to be reached as to what level of 
protection 
is desired and acceptable. 
The starting point is a multi-stage analysis and planning 
process covering identification of the given risks and a 
subsequent review, together with the adaptation of protective 
measures, where necessary. This process can be structured 
as follows: 
Analysis/ planning 
process 
The establishment of danger categories, differentiated 
according to the areas of natural disasters, accident, 
terrorism/crime, 
based on the above, definition of the respective protection 
levels, 
the development of damage and threat scenarios, 
the analysis of weak points, 
the formulation of protection objectives as a basis for the 
definition of protection measures and counter-measures, 
definition of the required scope of action (coordination 
between public- and private-sector measures), 
implementation of the defined required scope of action and
regular reviews of this analysis and planning process for the 
purposes of quality management. 
Potential dangers for critical infrastructures are outlined as 
initial points of reference. These essentially cover dangers 
resulting from natural events, technical failure or human error 
and terrorism/criminal acts. On the basis of these defined 
dangers, particularly endangered areas at companies can be 
identified and generalised baseline protection 
recommendations can be drawn up. 
Where this process is considered to be too cost-intensive or 
difficult to implement, such as at small and medium-sized