Select standards, model the scope, document implementation

BSI Standards & Compendium: The Foundation for IT Security

We help you connect BSI methodology with the applicable Compendium building blocks: define your information domain, assess protection needs and document implementation gaps, owners and evidence.

  • 01Documented scope and applicable building blocks
  • 02Prioritised implementation backlog with owners
  • 03Traceable control evidence for audit preparation
  • 04Handover of methods and review responsibilities
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

BSI Standards Compendium

BSI Standards 200-1, 200-2, and 200-3 together with the IT-Grundschutz Compendium form the foundation for professional information security management in Germany. BSI Standard 200-1 defines ISMS requirements, BSI Standard 200-2 describes the IT-Grundschutz methodology with basic, standard, and core protection levels, and BSI Standard 200-3 governs risk analysis.

ADVISORI guides you through the complete implementation of all BSI standards — from gap analysis through implementation to certification preparation.

We provide a complete implementation of the BSI Standards Compendium — from analysis and planning through systematic execution to the ongoing maintenance and updating of all standards.

2 service modules

Service scope

01

BSI Standards Assessment

Comprehensive assessment of all relevant BSI standards for your organization.

  • Complete inventory of all applicable BSI standards
  • Relevance and applicability analysis for your industry
  • Gap analysis against current implementation
  • Prioritized implementation roadmap
02

Complete Standards Implementation

Systematic implementation of all relevant BSI standards within your organization.

  • Step-by-step implementation according to BSI methodology
  • Integration into existing processes and systems
  • Training and change management
  • Continuous monitoring and optimization

5 phases

Our Approach

We follow a systematic methodology for the complete implementation of the BSI Standards Compendium, tailored to your specific requirements.

  1. Comprehensive analysis of all applicable BSI standards

  2. Prioritization and roadmap development for implementation

  3. Systematic implementation according to BSI methodology

  4. Integration into existing security architectures

  5. Continuous monitoring and improvement

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Our Strengths

  • 01In-depth expertise across all BSI standards and their application
  • 02Support for modelling, implementation planning and evidence review
  • 03Comprehensive implementation approaches for complex organizations
  • 04Ongoing support and updating of standards

Expert Tip

The BSI Standards Compendium offers not just individual standards, but a comprehensive approach to IT security. The systematic application of all relevant standards creates a coherent and resilient security architecture.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about BSI Standards Compendium

What are BSI Standards 200-1, 200-2, and 200-3?

BSI Standards 200‑1, 200‑2, and 200‑3 are the three core standards of the IT-Grundschutz framework developed by the German Federal Office for Information Security (BSI). BSI Standard 200‑1 defines general requirements for an Information Security Management System (ISMS), compatible with ISO 27001. BSI Standard 200‑2 describes the IT-Grundschutz methodology with three approaches: basic protection, standard protection, and core protection. BSI Standard 200‑3 consolidates all risk-related steps and governs risk analysis based on IT-Grundschutz. They are supplemented by BSI Standard 200‑4 for Business Continuity Management.

How do basic, standard, and core protection differ in BSI Standard 200-2?

Basic protection offers an initial breadth-first approach. Standard protection applies the methodology across the defined information domain; core protection prioritises especially important assets and processes. Model the applicable building blocks for the chosen scope rather than applying every block in the catalogue. Agree the approach and any certification objective before planning implementation.

What does the IT-Grundschutz Compendium contain?

The Compendium provides process and system building blocks with threats and security requirements. Use it to model the actual information domain and document applicability. Record the edition used and assess published changes; do not assume a new complete edition appears every year.

How does BSI IT-Grundschutz certification work?

ISO 27001 certification based on IT-Grundschutz follows a structured process. First, the information domain is defined and protection needs are assessed. Then modelling according to the IT-Grundschutz Compendium and the IT-Grundschutz check are performed. A supplementary risk analysis per BSI Standard 200‑3 follows. After implementing all required measures, a BSI-certified auditor verifies conformity. ADVISORI supports the entire process and systematically prepares your organization for the audit.

What advantages do BSI standards offer over a standalone ISO 27001 implementation?

IT-Grundschutz offers a structured modelling method and reusable building blocks. This can help teams translate security requirements into an implementation backlog. The appropriate approach depends on scope, customer obligations and the intended assurance outcome. Compare maintenance effort and available expertise as well as the desired certification route.

Which organizations are required to implement BSI standards?

IT-Grundschutz is not automatically mandatory for every KRITIS operator or NIS2 entity. The BSI Act requires appropriate risk-management measures for entities within scope. Whether a specific BSI method or certification is required depends on applicable administrative, sectoral or contractual requirements. Establish those obligations before selecting the method.

How does ADVISORI support BSI standards implementation?

ADVISORI guides organizations through the complete BSI standards implementation process. We begin with a gap analysis to assess your current ISMS maturity level. Based on the findings, we create a prioritized roadmap and support modelling according to the IT-Grundschutz Compendium, protection needs assessment, risk analysis per BSI Standard 200‑3, and implementation of all required measures. Our goal is a sustainable implementation that your organization can independently maintain and evolve.