BSI Grundschutz Catalogue: 113 Building Blocks for IT Security

The BSI IT-Grundschutz Compendium is the central reference work of the German Federal Office for Information Security (BSI) for implementing information security. It contains over 100 building blocks organised in ten layers, divided into process building blocks (e.g. ISMS, business continuity management, data protection) and system building blocks (e.g. clients, servers, networks, cloud, industrial control systems). Each building block describes typical threats and specific security requirements. The compendium is updated annually and has replaced the former BSI Grundschutz Catalogues since 2017.

The former BSI Grundschutz Catalogues contained detailed measure recommendations and threat descriptions in an extensive catalogue format. Since 2017, the BSI has replaced these with the IT-Grundschutz Compendium. The key difference: the compendium works with compact building blocks of approximately ten pages each, formulating requirements rather than specific measures. This gives organisations more flexibility in implementation and allows better adaptation to individual circumstances.

BSI IT-Grundschutz defines three protection levels according to BSI Standard 200‑2: Basic protection provides a quick entry point with fundamental security measures. Standard protection systematically covers normal protection needs and forms the basis for ISO 27001 certification based on IT-Grundschutz. Core protection focuses specifically on particularly sensitive business processes and IT systems (crown jewels). Organisations can combine protection levels and expand them incrementally.

Implementation follows BSI Standard 200‑2 in defined steps: First, a structural analysis captures all IT systems and business processes. Then protection needs are assessed. During modelling, relevant Grundschutz building blocks are assigned to target objects. The IT-Grundschutz Check (target-actual comparison) reveals the current implementation status. This is followed by risk analysis, action planning and actual implementation. ADVISORI guides organisations through all phases to complete documentation and certification readiness.

Costs and duration depend on organisation size, scope and target protection level. For standard protection in a mid-sized organisation, 6 to 12 months is typical. Basic protection can be achieved in 3 to 6 months. Main cost drivers are the scope of the information network, the number of relevant building blocks and the existing maturity level of information security. ISO 27001 certification based on IT-Grundschutz additionally requires external audit costs.

Yes, BSI IT-Grundschutz and ISO 27001 complement each other. ISO 27001 certification based on IT-Grundschutz is an officially recognised certification path that combines the systematic BSI methodology with the international ISO standard. Organisations already operating an ISMS according to ISO 27001 can use the Grundschutz building blocks as concrete implementation guidance. Conversely, an ISMS implemented according to BSI standards meets ISO 27001 requirements. ADVISORI supports the integration of both frameworks.

A direct legal obligation to implement BSI IT-Grundschutz exists for German federal authorities. For organisations in the critical infrastructure (KRITIS) sector, the BSI Act requires adequate security measures, with IT-Grundschutz serving as a recognised proof. Through NIS2 and DORA, IT security requirements are increasing for many more organisations. BSI IT-Grundschutz provides a structured framework to demonstrably meet these requirements. In public sector procurement, BSI certification is increasingly required.