BSI Certification Support & Audit Support

BSI certification based on IT-Grundschutz follows a multi-stage process. First, the information domain is defined and protection requirements are determined. This is followed by modelling according to the IT-Grundschutz Compendium, implementing the building blocks, and preparing reference documents. A BSI-certified auditor then reviews the documentation and conducts an on-site assessment. If the result is positive, the BSI issues the certificate. The full cycle spans three years with annual surveillance audits.

The cost of BSI certification varies depending on the size of the information domain, the maturity of the existing ISMS, and the industry. Typical projects range from EUR 50,

000 to 200,

000 for consulting and audit fees. The duration is usually

9 to

18 months – depending on how closely existing documentation and technical measures already meet the requirements of the IT-Grundschutz Compendium.

ISO 27001 based on IT-Grundschutz combines the international ISO 27001 standard with the detailed methodology of the BSI IT-Grundschutz Compendium. While standard ISO 27001 gives organizations wide latitude in risk analysis and control selection, IT-Grundschutz prescribes specific building blocks and requirements. The result is a higher level of standardisation and better comparability – particularly relevant for public-sector clients and operators of critical infrastructure.

A successful BSI audit requires several prerequisites: a documented ISMS with policy and guidelines, a complete structural analysis and protection requirements assessment, modelling according to the IT-Grundschutz Compendium, evidence of implemented technical and organisational measures, and a completed risk analysis for elevated protection needs. Internal audits and a management review must also be in place.

BSI certification is particularly relevant for operators of critical infrastructure (KRITIS), federal authorities and their service providers, companies in regulated industries such as finance or healthcare, and organisations participating in public tenders. Companies that need to meet NIS 2 requirements also benefit from BSI certification as proof of their information security posture.

Our preparation begins with a pre-audit assessment: we evaluate the current state of your ISMS against IT-Grundschutz Compendium requirements and identify gaps. This is followed by a prioritised action plan, creation of missing reference documents, and an internal mock audit. During the actual audit, we support your teams through interviews and document reviews. After the audit, we assist with remediation of any non-conformities.

After initial certification, annual surveillance audits verify the ongoing effectiveness of the ISMS. Recertification takes place after three years. In between, changes to the information domain must be documented, internal audits conducted, and the IT-Grundschutz Compendium alignment updated when new editions are released. ADVISORI provides continuous support for maintaining and advancing your ISMS.