Build physical resilience in a structured way.
DIN SPEC 14027 gives organisations a coherent structure for physical resilience. We help you use this structure sensibly, complement it where it counts and set realistic expectations of your own.
What DIN SPEC 14027 does for your organisation.
In many organisations, physical resilience has so far been spread across several areas: plant security, facility, BCM, HR, crisis team. DIN SPEC 14027 describes these topics for the first time in a coherent structure and in a language that everyone involved can use.
That is where its practical value lies. It creates a shared reference point for internal clarification: which fields of action exist, who is responsible, where the organisation stands today. For companies approaching the topic systematically for the first time, this is a useful starting point.
It is equally helpful to know its scope of application and its limits. We address both before a project, not afterwards.
"Physical resilience is not an additional security topic. It is the precondition for organisations to stay capable of acting when sites, people, supply chains or critical processes come under pressure."
What is it about?
About a framework that describes the physical resilience of organisations in a structured way, from site protection through the situation picture to crisis management.
Why is this relevant?
Because it creates a shared reference point: for internal clarification, well-founded decisions and the expectations of customers, partners and supervisory bodies.
What changes in the logic of leadership?
Resilience becomes a management task: with clear roles, assessment criteria and decision paths that link individual measures into a system.
Why does it concern more than corporate security?
Because site reality, BCM, HR, operations and management have to work together so that resilience holds when it matters.
The 16 fields of action of DIN SPEC 14027.
DIN SPEC 14027 "Corporate Security" was published on 20 March 2026. It was initiated by the German Federal Ministry of the Interior as part of the National Economic Security Strategy and developed by more than 40 organisations from business, public authorities and academia. Across around 200 pages, it describes requirements for strengthening the physical resilience of organisations, an all-hazards approach and a tiered security level system from A (very high) to D (low) that can be applied independently of sector and organisation size.
The specification covers 16 fields of action in Sections 5 to 20. Continuitylab groups these into eight areas. This structure also forms the basis of our interactive mindmap and our e-learning course on DIN SPEC 14027.
Fundamentals of DIN SPEC 14027
Purpose, user groups and the all-hazards approach that brings physical and digital security together.
Protection-needs assessment
Identify assets, derive protection objectives and determine the protection need via a matrix of criticality and threat intensity. The protection-needs assessment provides a prioritisation, not a full risk assessment.
Security situation picture
The situation-picture process in five phases, from information gathering through monitoring to situation products and reporting.
Site security
Zone model and perimeter protection, access management, structural hardening and security of supply.
Reactive structures
Clearly distinguish disruption, emergency and crisis, with staff-team work and business continuity management.
Specific protection
Know-how protection, personal protection, event protection, travel security and supply-chain security.
People and culture
Security culture and awareness, integrity checks, internal investigations and threat management.
Management and governance
Setting up a corporate security management system, steering service providers and continuous improvement.
Context: what you should consider when applying it
A DIN SPEC is not a standard.
It is produced through the PAS process (Publicly Available Specification), that is, by a consortium, and is not part of the German body of standards. As a structural template it remains well usable. However, no legal or normative bindingness follows from it. Anyone who internally speaks of a standard easily creates an expectation that the document cannot meet.
It is not evidence of compliance under the KRITIS Dachgesetz.
The obligations under the KRITIS Dachgesetz (the German critical-infrastructure umbrella act) exist independently of DIN SPEC 14027. The national risk analyses and the methodological requirements under Section 12 (3) of the KRITIS Dachgesetz are still pending. Work following the DIN SPEC can do preparatory work and create structures that connect later. As evidence of compliance it is not suitable.
Protection-needs assessment and risk assessment are two different things.
The protection-needs assessment of DIN SPEC 14027 provides a well-founded prioritisation. It does not replace a risk assessment in the sense of DIN ISO 31000:2018. For decisions with liability relevance, we recommend keeping ISO 31000 as the methodological frame of reference and choosing the methodology according to the type of hazard.
The all-hazards approach needs more than one methodology.
A flood, an attempted act of sabotage and an incident in the HR area cannot sensibly be assessed with the same procedure. The all-hazards approach means leaving out no type of hazard. It does not mean treating all hazards uniformly. Where a dedicated methodology is required, we point this out.
The scope comes from economic security.
DIN SPEC 14027 emerged as part of the National Economic Security Strategy. Accordingly, it covers espionage, sabotage, insider threats and know-how protection in detail. Structural and technical protection measures, as well as hazards outside economic security, are represented more briefly. This is a statement about the scope of application, not about quality. In practice it means: additional work is needed in these areas.
Personnel measures have legal limits.
Integrity checks, internal investigations and threat management touch on employment law, data protection and co-determination. The fields of action describe what is professionally possible. Whether a measure is permissible in an individual case is a legal question. We show where these questions arise and then recommend legal advice from a lawyer. We do not provide legal advice.
A clear entry path, from overview to implementation.
Choose the entry point that fits your current question. Every step connects to the next: from the first orientation value through the in-depth assessment to ongoing measure tracking in the customer portal.
Executive Briefing
DIN SPEC 14027 placed in context for executive management, concise and decision-oriented.
Quick Check
Free online self-assessment for a first appraisal of physical resilience. The Quick Check deliberately does not ask for critical detail information on specific vulnerabilities, sites or protection gaps.
Resilience Readiness Assessment
In-depth assessment of the relevant resilience dimensions. Qualified consultants capture critical detail information in person and process it locally, usable offline and encrypted.
Resilience Portal
Protected customer area for tracking orientation value, fields of action, traffic-light ratings and measure status. The portal shows condensed results, but no complete vulnerability raw data.
Physical Resilience Workshop
For teams from security, BCM, risk, operations and management.
Awareness & E-Learning
For the whole organisation, not just individual teams.
Get to know DIN SPEC 14027 in our free online course "Corporate Security as a Management Task": eight lessons, at your own pace.
Start the course for freeSecure entry. Secure data capture.
The Quick Check is deliberately designed as a secure entry point: it provides a first orientation value without asking for specific vulnerabilities, operational protection gaps or confidential site details online. Sensitive detail data only arises in the in-depth consulting, captured by people, processed locally, usable offline and protected by encryption.
Online for orientation only
The Quick Check does not ask for critical vulnerability details. It serves the first self-assessment and shows which fields of action should be examined more closely.
Confidential capture by people
Critical detail information is not collected via the website or an online form. It is recorded in the subsequent consulting process by qualified consultants and processed locally.
Encrypted processing in a controlled environment
Complete capture data is not stored in insecure cloud repositories. It stays in a controlled, encrypted working environment. For confidential collaboration, files are transferred encrypted.
The result: interested parties can use the Quick Check with a low threshold, without disclosing critical detail information. Confidential vulnerability data is only captured in the consulting process, by people, locally, usable offline and encrypted.
Four partners with clearly separated roles
Physical resilience calls for different competencies: assessment, implementation, enablement, organisational development. For this we work in a network of independent partners.
The roles stay separate in the process. Assessment and implementation do not necessarily lie in the same hands, and reviewing effectiveness is distinguishable from implementation. You can obtain each service individually, with us, with one of the partners or with a provider of your choice. This separation matters more to us than an offering that is as closed as possible.
Particularly relevant if you …
Seven gaps that become visible in an event.
Most of them can be closed before they become a problem. Our checklist helps with the first comparison.
Download the checklistStart with the entry point that fits.
Let's talk about the next sensible step.
We will get back to you with a fitting proposal, pragmatic, confidential and with no obligation.
What decision-makers ask about DIN SPEC 14027.
A DIN SPEC is not a law and not a basis for certification. It is a published specification that can be used as a structural template. It helps to assess physical resilience in a structured way and to make it comprehensible both internally and externally.
No. It is a specification developed through the PAS process and is not part of the German body of standards. As a structural template it remains useful, but no bindingness follows from it.
No. The obligations exist independently, and the legislator's methodological requirements are still pending. Work following the DIN SPEC can do preparatory work but does not replace evidence of compliance. Whether and how you are affected is a legal question and belongs with a lawyer.
No. Physical resilience arises from the interplay of security, BCM, operations, facility, HR and management. That is precisely why it is a management task for leadership, not just for one department.
BCM ensures that critical processes keep running. Physical resilience addresses the precondition for that: sites, infrastructure and people. BCM without physical resilience stays theory. The two belong together.
For everyone who wants a first appraisal quickly and without preparation, typically those responsible in security, BCM, risk or executive management. It provides a position assessment and prepares the internal discussion.
Concise and decision-oriented: we place DIN SPEC 14027 in context for your organisation, point out relevant fields of action and create a shared basis for decisions on the next steps, typically in 60 to 90 minutes.
Explicitly yes. The point is to place what already exists in context, identify gaps and bring measures into a robust overall system.
A central one. E-learning alone is not enough, but without e-learning awareness never reaches the whole organisation. The combination of training, simulation and e-learning ensures that behaviour in critical situations really holds.
No. The Quick Check is a low-threshold entry point and provides a first orientation value. It does not replace an audit, a certification or evidence of DIN SPEC compliance. It helps make fields of action visible and prepare the next discussion.
No. The Quick Check deliberately does not ask for critical detail information on specific vulnerabilities, sites or operational protection gaps. It provides a first orientation value and shows which fields of action should be considered in the next step.
Confidential detail data is not collected via an online form. It only arises in the in-depth consulting and is recorded by qualified consultants. Processing takes place locally, usable offline and encrypted.
No. The customer portal shows condensed results such as orientation value, traffic-light ratings per field of action, measure status and evaluations. Verbatim vulnerability descriptions and complete capture data are not stored there.
No. Confidential content is not sent by email. Complete capture data is not stored in insecure cloud repositories. For confidential collaboration, we work with encrypted processing and protected exchange.
Because a realistic expectation is the basis for a viable project. We use DIN SPEC 14027 where it holds well and state openly where additional work or a different discipline is needed.