BSI IT-Grundschutz

BSI IT-Grundschutz is a methodology and framework developed by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) to help organizations establish and maintain effective information security. It provides a structured approach combining risk management with a catalogue of proven security measures.

The framework is built around IT-Grundschutz Compendium, a regularly updated collection of security modules covering organizational, personnel, infrastructure, and IT-specific topics. Organizations can apply IT-Grundschutz at three protection levels: Basic, Standard, and Core Protection. The Standard and Core Protection levels are aligned with ISO 27001, enabling a dual certificate (ISO 27001 based on IT-Grundschutz) to be issued.

IT-Grundschutz is particularly prevalent in German public sector organizations and critical infrastructure operators. It is recognized by German authorities as a robust approach to meeting regulatory requirements, including those under NIS 2. Its detailed, prescriptive modules make it especially practical for organizations seeking clear guidance rather than a principles-based standard alone.

Sources: standards, protection levels and the ISO 27001 link

• BSI Standards 200-1 to 200-4: The four standards are published by the BSI itself. 200-1 sets out the requirements for an information security management system, 200-2 the IT-Grundschutz methodology, 200-3 risk analysis based on IT-Grundschutz and 200-4 business continuity management.

• Three protection levels: Basic, Standard and Core Protection are defined in BSI Standard 200-2. Basic Protection implements the fundamental requirements broadly, Standard Protection is the complete approach, and Core Protection concentrates on the business processes and assets most in need of protection.

• Compatibility with ISO/IEC 27001: BSI Standard 200-1 is explicitly compatible with ISO/IEC 27001. The BSI certifies management systems as "ISO 27001 on the basis of IT-Grundschutz"; this is available for Standard and Core Protection. The mapping table published by the BSI shows how the ISO/IEC 27001 requirements correspond to the IT-Grundschutz modules.

• IT-Grundschutz Compendium: The Compendium brings together the modules with their requirements and the elementary threats G 0.1 to G 0.47 that those requirements protect against.

• Mandatory and voluntary use: IT-Grundschutz is mandatory for the German federal administration. For companies, including entities in scope of NIS2, it remains a methodology provided by the BSI alongside an ISMS based on ISO/IEC 27001, which the BSI recognises as equivalent.

Implementing BSI IT-Grundschutz with preeco | informationssicherheit

In preeco | informationssicherheit, BSI IT-Grundschutz is activated as a requirement catalogue per organisation. Further standards such as ISO/IEC 27001, NIS2, BSI C5, DORA and TISAX are loaded the same way, so security requirements from several standards are assessed side by side. For BSI IT-Grundschutz catalogues, the target protection level is selected (basic, standard or elevated protection), and every requirement is assessed with implementation status, maturity level and responsible persons. Implementation planning in line with BSI Standard 200-2 takes place on the requirement of an asset, with open measures, responsible person and deadline.

For audits, a BSI IT-Grundschutz audit catalogue is available, structured into checklists by BSI module. The elementary threats from the Compendium can be assigned to the requirements, so the audit shows what each requirement protects against. The protection requirements assessment for confidentiality, integrity and availability uses a damage scenario matrix based on the maximum principle; protection requirements are inherited across the asset tree in line with BSI Standard 200-2.

To prepare for certification, the software produces the BSI IT-Grundschutz audit documents (structure analysis, modelling and result of the IT-Grundschutz check) as well as the Statement of Applicability as PDF and DOCX, whose current state can be filed as an immutable, dated version. Evidence only counts once the responsible person has confirmed it, and the ISMS cockpit shows the degree of fulfilment per category and its development over time.