BSI Grundschutz Implementation

BSI IT-Grundschutz is an information security framework developed by Germany's Federal Office for Information Security (BSI). It provides a structured methodology for systematically protecting IT systems, data and business processes. It is mandatory for German federal agencies (under UP Bund) and widely adopted by critical infrastructure operators (KRITIS), companies seeking ISO 27001 certification based on IT-Grundschutz, and any organisation that needs a demonstrable level of information security. Compared to standalone ISO 27001, IT-Grundschutz stands out for its level of detail: the Compendium contains over 100 modules with specific requirements and implementation guidance.

The implementation is based on four BSI Standards: BSI Standard 200‑1 defines requirements for an Information Security Management System (ISMS). BSI Standard 200‑2 describes the IT-Grundschutz methodology with three approaches: Baseline Protection, Standard Protection and Core Protection. BSI Standard 200‑3 covers supplementary risk analysis for areas with elevated protection needs. BSI Standard 200‑4 addresses Business Continuity Management. Standard Protection under 200‑2 is the typical path toward certification.

The implementation follows a structured process according to BSI Standard 200‑2: First, the scope and information network (Informationsverbund) are defined. Then a protection needs assessment evaluates all assets against the protection goals of confidentiality, integrity and availability. Next, appropriate modules from the IT-Grundschutz Compendium are mapped to target objects (modelling), followed by a Grundschutz check comparing the current state with target requirements. For elevated protection needs, a supplementary risk analysis per BSI Standard 200‑3 is conducted. Identified measures are then implemented, documented and reviewed in regular cycles.

The three approaches under BSI Standard 200‑2 differ in scope and depth: Baseline Protection (Basis-Absicherung) is the entry level, securing the most important areas with fundamental measures – suitable as a first step for organisations without an existing ISMS. Core Protection (Kern-Absicherung) focuses on particularly sensitive business processes and assets (the so-called crown jewels) and quickly achieves a high protection level for critical areas. Standard Protection (Standard-Absicherung) covers the entire information network and is the prerequisite for ISO 27001 certification based on IT-Grundschutz. Many organisations start with Baseline Protection and gradually expand to Standard Protection.

Duration depends on organisation size, scope and the chosen protection level. For Baseline Protection in a medium-sized company, 3 to 6 months is realistic. A complete Standard Protection implementation with certification preparation typically takes 9 to 15 months for mid-sized organisations (50 to 200 employees). Consulting costs range from EUR 30,000 to EUR 80,000 depending on scope. Certification audit costs are additional, typically EUR 10,000 to EUR 25,000 depending on the certification body. Key cost and timeline factors include existing documentation, current security measures and available internal resources.

Yes, IT-Grundschutz is designed to be compatible with ISO 27001 – ISO 27001 certification based on IT-Grundschutz is an explicitly supported certification path recognised by the BSI. Organisations already operating an ISMS under ISO 27001 can use the detailed IT-Grundschutz Compendium modules as practical implementation guidance. Synergies also exist with other frameworks: critical infrastructure operators can use IT-Grundschutz as evidence under Section 8a BSIG. Integration with TISAX (automotive), C5 (cloud security) or industry-specific standards is also possible, since the Grundschutz methodology is systematic and offers many overlaps.

With Grundschutz++, the BSI is fundamentally modernising its framework. From 2026, Grundschutz++ will gradually replace the existing IT-Grundschutz Compendium. Key changes: the rigid module structure is being replaced by a more flexible, modular system. Requirements will be more risk-based and better aligned with international standards. During a transition phase expected to last until 2028, organisations can work with and be certified under both the existing Compendium and Grundschutz++. For organisations starting implementation now, it is advisable to design an architecture that accounts for the transition to Grundschutz++ from the outset – ADVISORI supports this transformation process.