BSI Standards 200-1 to 200-4

IT-Grundschutz, issued by the German Federal Office for Information Security (BSI), rests on two pillars: the 200 series of BSI Standards, which provide the method, and the annually updated IT-Grundschutz Compendium, which contains the concrete requirements and implementation guidance for each module. BSI Standard 200-1 sets out the general requirements for an information security management system (ISMS) and is deliberately aligned with ISO/IEC 27001: management responsibility, a security policy, roles such as the information security officer, resources, documentation and continual improvement following the PDCA cycle. Working to 200-1 therefore does not create a German special case; it builds an ISMS structure that maps onto internationally recognised standards while being considerably more prescriptive.

BSI Standard 200-2 describes the IT-Grundschutz methodology itself and offers three routes: basic protection (Basis-Absicherung) as a fast, broad entry level, core protection (Kern-Absicherung) focused on the organisation's most critical assets, and standard protection (Standard-Absicherung) as the full, certifiable approach. The sequence is always the same: define the information domain, carry out a structure analysis, determine protection needs against the objectives of confidentiality, integrity and availability, model the domain using the compendium modules, run the IT-Grundschutz check as a target-actual comparison, and then plan and implement the missing measures. BSI Standard 200-3 takes over wherever the standard requirements are not sufficient: for target objects with high or very high protection needs, for cases with no suitable module and for atypical deployment scenarios, a risk analysis based on the elementary threats is performed, assessed and translated into risk treatment – avoid, reduce, transfer, or accept the residual risk by formal management decision.

BSI Standard 200-4 replaced the earlier Standard 100-4 and describes how to build a business continuity management system (BCMS). It is staged: a reactive BCMS creates a rapid incident-response capability, the build-up stage adds a business impact analysis and continuity plans, and the standard BCMS reaches a level comparable to ISO 22301. For companies the series matters for two reasons. First, an ISO 27001 certificate can be obtained on the basis of IT-Grundschutz. Second, customers and supervisory authorities accept IT-Grundschutz as a recognised state of the art. The 200 series also provides a defensible, auditable structure for the risk management and continuity duties arising from the German BSIG as shaped by the NIS2 implementation act; the precise national implementation and evidence deadlines remain in flux and should be verified for each specific case.