BSI Grundschutz Methodology: Approach per BSI Standard 200-2

The BSI IT-Grundschutz methodology is the operational guideline from Germany's Federal Office for Information Security (BSI) for implementing an Information Security Management System (ISMS). BSI Standard 200‑2 describes three approaches: basic protection as a quick entry point, core protection for especially critical business processes, and standard protection as the comprehensive approach with ISO 27001 certification option based on IT-Grundschutz.

Basic protection provides a quick entry with fundamental security measures and suits organizations without an existing ISMS. Core protection focuses on especially critical business processes and assets (crown jewels) and protects them as a priority. Standard protection is the complete approach with structural analysis, protection requirements assessment, modeling of all modules, and enables ISO 27001 certification based on IT-Grundschutz.

Standard protection follows a defined process model: 1) Defining the scope, 2) Structural analysis of the information domain, 3) Determining protection requirements for all identified target objects, 4) Modeling with appropriate modules from the IT-Grundschutz Compendium, 5) IT-Grundschutz check (target-actual comparison), 6) Supplementary risk analysis for elevated protection requirements, and 7) Consolidation and implementation of measures.

The IT-Grundschutz Compendium is the operational foundation of the methodology, containing over 100 modules across ten layers (e.g., ISMS, ORP, CON, OPS, DER, APP, SYS, IND, NET, INF). Each module describes specific requirements and implementation guidance for certain aspects of information security. During modeling, appropriate modules are mapped to the identified target objects of the information domain.

German federal agencies are obligated to implement IT-Grundschutz under the UP Bund framework. Critical infrastructure operators must demonstrate adequate security measures under Section 8a BSIG, with IT-Grundschutz recognized as valid proof. Through NIS2 and the IT Security Act 2.0, the circle of affected organizations expands. State agencies and municipalities also increasingly follow IT-Grundschutz.

ADVISORI guides organizations through all phases of BSI IT-Grundschutz implementation: from selecting the appropriate approach through structural analysis and protection requirements assessment to modeling, the IT-Grundschutz check, and implementing all measures. With experience from over 520 information security projects, we shorten implementation time and prepare organizations for ISO 27001 certification based on IT-Grundschutz when needed.

Duration and costs depend on the chosen approach and organization size. Basic protection for medium-sized companies can be implemented in 3‑6 months. Standard protection with a certification goal typically takes 12‑18 months. Consulting costs range from EUR 20,000 to 80,000 depending on scope. ADVISORI provides an individual project plan with transparent effort estimates after an initial analysis.