BSI IT-Grundschutz:
Germany's National Security Standard

BSI IT-Grundschutz is a security framework published by Germany's Federal Office for Information Security (BSI). It comprises the IT-Grundschutz Compendium with over 200 building blocks, the IT-Grundschutz methodology and the BSI certification scheme. Internationally, it is most closely comparable to ISO 27001 - but whereas ISO 27001 provides a management framework describing "what" is required, IT-Grundschutz also prescribes "how" through detailed, practical implementation guidance. IT-Grundschutz is particularly suited for German government agencies, KRITIS operators, organizations with public sector contracts, and organizations operating within the German legal framework. An ISO 27001 certification based on IT-Grundschutz is possible and recognized.

ISO 27001 is the international standard for Information Security Management Systems (ISMS) - it describes the "what" (requirements) but provides limited guidance on the "how". BSI IT-Grundschutz is the German approach that delivers both: a methodological framework (methodology) and a comprehensive control catalog (Compendium) with concrete implementation guidance for over 200 building blocks. ISO 27001 is more flexible and internationally recognized; IT-Grundschutz is more detailed and is the dominant reference in German government and KRITIS environments. An ISO 27001 certification based on IT-Grundschutz ("ISO 27001 based on IT-Grundschutz") combines both approaches and is officially recognized by the BSI.

Critical infrastructure operators (KRITIS) under §31 BSIG are legally required to implement appropriate organizational and technical measures to prevent disruptions to their critical services and demonstrate compliance to the BSI every two years. IT-Grundschutz (or an equivalent standard such as ISO 27001) is accepted as a recognized compliance framework. KRITIS operators span sectors including energy, water, food, IT and telecommunications, health, finance, transport, and state and administration - above sector-specific thresholds.

The IT-Grundschutz Compendium distinguishes three protection levels: (1) Basic Protection (Basis-Absicherung): Entry-level IT-Grundschutz with the most important security measures - the "must have" controls. Suitable for organizations beginning systematic security work, or as an immediate remediation measure. (2) Standard Protection (Standard-Absicherung): Full implementation of the IT-Grundschutz methodology with protection needs assessment and risk analysis - the reference point for most applications and the basis for BSI Grundschutz certification. This level maps most closely to ISO 27001. (3) Core Protection (Kern-Absicherung): Focus on the organization's "crown jewels" - the most critical information assets with the highest protection requirements. Suitable for organizations with very limited resources who need to prioritize their most critical assets first.

The IT-Grundschutz Compendium is the core document of BSI IT-Grundschutz - a regularly updated collection of security requirements and implementation guidance. It is organized into ten layers (ISMS, ORP, CON, OPS, DER, APP, SYS, IND, NET, INF) and contains over 200 building blocks. Each building block describes a system component or process, formulates basic and standard requirements plus requirements for elevated protection needs, and provides concrete implementation guidance. The Compendium is updated annually and is freely available on the BSI website - unlike ISO standards which require purchase.

BSI Grundschutz certification proceeds through several phases: (1) Structural Analysis: documentation of all IT systems, applications and rooms within the information domain. (2) Protection Needs Assessment: evaluation of protection needs for all target objects in confidentiality, integrity, availability. (3) Modeling: assignment of appropriate IT-Grundschutz building blocks to all target objects. (4) IT-Grundschutz Check: target/actual comparison of all measures through interviews with responsible personnel. (5) Risk Analysis: for target objects with elevated protection needs or missing building blocks. (6) Implementation: implementing the identified measures. (7) Audit by BSI-certified auditor and issuance of the Grundschutz certificate.

Costs for BSI IT-Grundschutz implementation vary significantly by organization size, scope of the information domain and target protection level. For a medium-sized government agency or SME (50-200 employees) targeting Standard Protection, consulting costs of EUR 30,000-80,000 over 9-15 months are realistic. BSI Grundschutz certification audit costs are additional (EUR 10,000-25,000). For organizations with an existing ISO 27001 ISMS, costs are significantly lower as approximately 70% of requirements overlap. We provide a binding fixed-price proposal after a free initial consultation.

NIS2 (Directive EU 2022/2555) requires affected entities to implement a cybersecurity risk management system with specific measures - including incident management, business continuity, supply chain security and procurement security. An IT-Grundschutz-compliant information domain (Standard Protection) fulfills the essential NIS2 requirements for technical and organizational measures. For KRITIS operators under §31 BSIG, IT-Grundschutz is explicitly recognized as a compliance framework. AWARE7 advises on both IT-Grundschutz and NIS2 implementation.