In the current geopolitical environment, the protection of critical infrastructures should actually be at the top of governments’ agendas. However, most EU member states, including Germany, are not making any progress in implementing European directives in this area. They should have fully transposed the NIS 2 Directive (Directive 2022/2555) on network security and the CER Directive (Directive 2022/2557) on the analogous resilience of critical facilities into national law by Oct. 17. In 26 member states, however, this has not happened for one or even both directives.