BSI Standards & Compendium: The Foundation for IT Security

BSI Standards 200‑1, 200‑2, and 200‑3 are the three core standards of the IT-Grundschutz framework developed by the German Federal Office for Information Security (BSI). BSI Standard 200‑1 defines general requirements for an Information Security Management System (ISMS), compatible with ISO 27001. BSI Standard 200‑2 describes the IT-Grundschutz methodology with three approaches: basic protection, standard protection, and core protection. BSI Standard 200‑3 consolidates all risk-related steps and governs risk analysis based on IT-Grundschutz. They are supplemented by BSI Standard 200‑4 for Business Continuity Management.

Basic protection offers an initial breadth-first approach. Standard protection applies the methodology across the defined information domain; core protection prioritises especially important assets and processes. Model the applicable building blocks for the chosen scope rather than applying every block in the catalogue. Agree the approach and any certification objective before planning implementation.

The Compendium provides process and system building blocks with threats and security requirements. Use it to model the actual information domain and document applicability. Record the edition used and assess published changes; do not assume a new complete edition appears every year.

ISO 27001 certification based on IT-Grundschutz follows a structured process. First, the information domain is defined and protection needs are assessed. Then modelling according to the IT-Grundschutz Compendium and the IT-Grundschutz check are performed. A supplementary risk analysis per BSI Standard 200‑3 follows. After implementing all required measures, a BSI-certified auditor verifies conformity. ADVISORI supports the entire process and systematically prepares your organization for the audit.

IT-Grundschutz offers a structured modelling method and reusable building blocks. This can help teams translate security requirements into an implementation backlog. The appropriate approach depends on scope, customer obligations and the intended assurance outcome. Compare maintenance effort and available expertise as well as the desired certification route.

IT-Grundschutz is not automatically mandatory for every KRITIS operator or NIS2 entity. The BSI Act requires appropriate risk-management measures for entities within scope. Whether a specific BSI method or certification is required depends on applicable administrative, sectoral or contractual requirements. Establish those obligations before selecting the method.

ADVISORI guides organizations through the complete BSI standards implementation process. We begin with a gap analysis to assess your current ISMS maturity level. Based on the findings, we create a prioritized roadmap and support modelling according to the IT-Grundschutz Compendium, protection needs assessment, risk analysis per BSI Standard 200‑3, and implementation of all required measures. Our goal is a sustainable implementation that your organization can independently maintain and evolve.