IT-Grundschutz BSI

BSI standard 200–1 defines general requirements for an information security management system (ISMS). BSI standard 200–2 describes the IT-Grundschutz methodology with three approaches: basic protection, standard protection and core protection. BSI standard 200–3 governs risk analysis based on IT-Grundschutz when protection needs exceed the normal level. Together they form the methodological foundation for IT-Grundschutz implementation.

Implementation follows a structured process: first, the information domain is defined and a structural analysis is performed. Then protection needs are determined for all identified objects. Next, suitable building blocks from the IT-Grundschutz Compendium are assigned (modelling). The basic security check compares the current state against requirements. Where protection needs are elevated, a supplementary risk analysis per BSI standard 200–3 follows.

ISO 27001 is an international standard with abstract ISMS requirements. IT-Grundschutz is a concrete BSI methodology that provides detailed measure recommendations via the IT-Grundschutz Compendium. Organisations can obtain ISO 27001 certification on the basis of IT-Grundschutz, combining international recognition with the methodological depth of the BSI approach.

IT-Grundschutz is particularly relevant for German federal authorities and public institutions subject to BSI requirements, critical infrastructure (KRITIS) operators with compliance obligations under the BSI Act, organisations seeking ISO 27001 certification on IT-Grundschutz basis, and any organisation wanting a structured entry into information security.

The IT-Grundschutz Compendium contains over

100 building blocks organised in ten layers, ranging from ISMS processes through organisation and personnel to technical systems such as networks and applications. Each building block describes typical threats and concrete security measure requirements. The BSI updates the Compendium annually to address current threats and technologies.