BSI Standards & Compendium: The Foundation for IT Security

BSI Standards 200‑1, 200‑2, and 200–3 are the three core standards of the IT-Grundschutz framework developed by the German Federal Office for Information Security (BSI). BSI Standard 200–1 defines general requirements for an Information Security Management System (ISMS), compatible with ISO 27001. BSI Standard 200–2 describes the IT-Grundschutz methodology with three approaches: basic protection, standard protection, and core protection. BSI Standard 200–3 consolidates all risk-related steps and governs risk analysis based on IT-Grundschutz. They are supplemented by BSI Standard 200–4 for Business Continuity Management.

The three protection levels in BSI Standard 200–2 address different organizational needs. Basic protection provides a quick entry point with fundamental security measures, suitable for smaller organizations. Standard protection covers all IT-Grundschutz building blocks and enables ISO 27001 certification based on IT-Grundschutz. Core protection focuses on particularly sensitive business processes and systems with elevated protection requirements, allowing targeted security investments.

The IT-Grundschutz Compendium is the central collection of all IT-Grundschutz building blocks, updated annually by the BSI. It contains process-oriented and system-oriented building blocks organized in layers: ISMS, Organization and Personnel, Concepts and Procedures, IT Operations, and Detection and Response. Each building block defines specific threats and security requirements applied when modelling an information domain.

ISO 27001 certification based on IT-Grundschutz follows a structured process. First, the information domain is defined and protection needs are assessed. Then modelling according to the IT-Grundschutz Compendium and the IT-Grundschutz check are performed. A supplementary risk analysis per BSI Standard 200–3 follows. After implementing all required measures, a BSI-certified auditor verifies conformity. ADVISORI supports the entire process and systematically prepares your organization for the audit.

BSI standards provide concrete implementation guidance that pure ISO 27001 lacks. While ISO 27001 only defines requirements, the IT-Grundschutz Compendium delivers detailed measure catalogues for each building block. This reduces interpretation ambiguity and significantly simplifies practical implementation. Additionally, ISO 27001 certification based on IT-Grundschutz is the preferred certification recognized by German authorities and regulated industries.

BSI standard implementation is mandatory for operators of critical infrastructures (KRITIS) under the German BSI Act. Federal agencies must also implement IT-Grundschutz. With the IT Security Act 2.0 and the NIS-2 Directive, the scope extends to additional essential and important entities. Furthermore, many sector-specific regulations such as BAIT, VAIT, or DORA require alignment with recognized IT security standards like BSI IT-Grundschutz.

ADVISORI guides organizations through the complete BSI standards implementation process. We begin with a gap analysis to assess your current ISMS maturity level. Based on the findings, we create a prioritized roadmap and support modelling according to the IT-Grundschutz Compendium, protection needs assessment, risk analysis per BSI Standard 200‑3, and implementation of all required measures. Our goal is a sustainable implementation that your organization can independently maintain and evolve.