Protection needs analysis, modelling and certification per BSI IT-Grundschutz

IT-Grundschutz: BSI Security Standards

IT-Grundschutz from the Federal Office for Information Security (BSI) provides organisations with a proven methodology for systematically building information security.

  • 01Structured approach to IT security using proven methods
  • 02Appropriate security level with proportionate effort
  • 03Fulfillment of regulatory requirements and compliance standards
  • 04Systematic risk analysis and treatment
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

What Is IT-Grundschutz?

BSI IT-Grundschutz is the most widely used information security methodology in Germany. The BSI standards 200-1 to 200-3 and the IT-Grundschutz Compendium form the framework for establishing, operating and improving an information security management system (ISMS). Organisations achieve an appropriate level of security for their IT systems — cost-effectively and verifiably.

We support you throughout the complete implementation of IT-Grundschutz – from the initial protection needs assessment through modeling and implementation of measures to continuous monitoring and improvement.

2 service modules

Service scope

01

IT-Grundschutz Modeling

Systematic capture and modeling of your IT landscape in accordance with the IT-Grundschutz methodology.

  • Structural analysis and information domain definition
  • Protection needs assessment for all assets
  • Building block assignment and derivation of measures
  • Documentation in accordance with BSI standards
02

Basic Security Check

Review of current security measures against IT-Grundschutz requirements.

  • Systematic review of all relevant building blocks
  • Identification of security gaps
  • Prioritized recommendations for action
  • Roadmap for improving IT security

5 phases

Our Approach

We follow the proven IT-Grundschutz methodology of the BSI and adapt it to your specific requirements.

  1. Structural analysis and definition of the information domain

  2. Protection needs assessment for all information and processes

  3. Modeling with IT-Grundschutz building blocks

  4. Basic security check and action planning

  5. Supplementary security analysis for elevated protection needs

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
We support our clients in implementing IT-Grundschutz in a structured and pragmatic manner – with the goal of establishing an effective security level while simultaneously laying the foundation for a subsequent ISO 27001 certification. Our expertise combines regulatory requirements with practical implementation – efficient, targeted, and future-proof.
ADVISORI expert opinion

Our Strengths

  • 01Many years of expertise in applying the IT-Grundschutz methodology
  • 02Experienced BSI-certified IT-Grundschutz practitioners and consultants
  • 03Practical implementation with a focus on cost-effectiveness
  • 04Support for certifications and audits

Expert tip

IT-Grundschutz offers a pragmatic approach to IT security. By combining standard security measures with supplementary risk analyses, even complex IT environments can be secured efficiently.

5 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about IT-Grundschutz BSI

What do BSI standards 200-1, 200-2 and 200-3 cover?

BSI standard 200‑1 defines general requirements for an information security management system (ISMS). BSI standard 200‑2 describes the IT-Grundschutz methodology with three approaches: basic protection, standard protection and core protection. BSI standard 200‑3 governs risk analysis based on IT-Grundschutz when protection needs exceed the normal level. Together they form the methodological foundation for IT-Grundschutz implementation.

What does a typical IT-Grundschutz implementation look like?

Implementation follows a structured process: first, the information domain is defined and a structural analysis is performed. Then protection needs are determined for all identified objects. Next, suitable building blocks from the IT-Grundschutz Compendium are assigned (modelling). The basic security check compares the current state against requirements. Where protection needs are elevated, a supplementary risk analysis per BSI standard 200‑3 follows.

What is the difference between IT-Grundschutz and ISO 27001?

ISO 27001 is an international standard with abstract ISMS requirements. IT-Grundschutz is a concrete BSI methodology that provides detailed measure recommendations via the IT-Grundschutz Compendium. Organisations can obtain ISO 27001 certification on the basis of IT-Grundschutz, combining international recognition with the methodological depth of the BSI approach.

Who benefits most from IT-Grundschutz?

IT-Grundschutz is particularly relevant for German federal authorities and public institutions subject to BSI requirements, critical infrastructure (KRITIS) operators with compliance obligations under the BSI Act, organisations seeking ISO 27001 certification on IT-Grundschutz basis, and any organisation wanting a structured entry into information security.

What is the IT-Grundschutz Compendium?

The IT-Grundschutz Compendium contains over 100 building blocks organised in ten layers, ranging from ISMS processes through organisation and personnel to technical systems such as networks and applications. Each building block describes typical threats and concrete security measure requirements. The BSI updates the Compendium annually to address current threats and technologies.