BSI IT-Grundschutz
Basis, Standard and Kern protection approaches, the BSI 200-series methodology, the Sicherheitskonzept, and a cross-mapping to ISO 27001 and NIS2, all on the same data model as the BCMS, DSMS and AIMS.
One control, several standards
Operate the detailed BSI methodology as ISMS software and connect approved safeguards to ISO 27001 and NIS2 where the requirements genuinely overlap. Each framework keeps its own scope and assessment logic.
One control
Supplier & third-party due diligence
From control to policy
Record the information domain, applications, systems, rooms, networks and dependencies, then apply the relevant Bausteine. The model remains connected to owners, risks and evidence.
One control
Supplier & third-party due diligence
Management systems
Policies and procedures
Use the Bausteine, requirements and implementation guidance as structured records instead of copying the Compendium from PDFs into a separate working file.
01
KaitoSec ships with the complete IT-Grundschutz-Kompendium structured as machine-readable Bausteine. Every module, requirement, and implementation hint is searchable, assignable, and linkable to your asset inventory. No manual copy-paste from PDFs.
02
BSI Standard 200-1 (ISMS management), 200-2 (IT-Grundschutz methodology), 200-3 (risk analysis), and 200-4 (business continuity) each have dedicated workflow templates. You follow the prescribed methodology step by step, with evidence captured at every stage. 200-4 lives in the same workspace as your ISO 22301 BCMS.
03
Bring completed modules, risk decisions and residual-risk documentation together as the basis of the Sicherheitskonzept. The approved, versioned state remains traceable for review.
04
Many German organisations carry Grundschutz, ISO 27001 and NIS2 obligations in parallel. KaitoSec maintains bidirectional control mappings between all three. Evidence collected once feeds every framework it belongs to. One preparation carries three audits.
Document implementation status in the Grundschutz Check and carry risks that need additional analysis into risk management software for BSI 200-3, including treatment, owner and review date.
01
Assign Bausteine to your IT systems, applications, and infrastructure components. KaitoSec tracks implementation status per requirement, shows your implementation level across the entire security concept, and generates the Umsetzungsplan for certification.
02
KaitoSec guides the protection-needs assessment for every asset and documents classification as normal, high or very high. Relevant modules and the risk scope are suggested for review.
03
Map Grundschutz, ISO 27001 and NIS2 to the same controls where requirements genuinely align. Approved evidence can then be reused without hiding differences between the frameworks.
BSI IT-Grundschutz software must represent the Compendium with all its Bausteine and support structural analysis, protection-needs assessment, modelling, the Grundschutz Check and risk analysis under BSI 200-3. KaitoSec covers all six phases and uses migration to import existing registers from Excel, verinice or HiScout. Our BSI IT-Grundschutz starter guide walks through all six phases in order.
Basic Protection implements only the basic requirements; Standard Protection is the route to an ISO 27001 certificate based on IT-Grundschutz, while Core Protection focuses on the most critical assets. KaitoSec lets you choose the approach for each information domain.
In IT-Grundschutz modelling, the relevant Compendium Bausteine are assigned to the target objects from the structural analysis. The KaitoSec agent proposes the mapping and reports unmodelled Bausteine as findings, as shown in the import demo.
Yes. KaitoSec imports exports from both tools and retains target objects, Bausteine and status. The tool comparison explains what changes when you switch, and migration describes the process. This comparison of IT-Grundschutz tools goes deeper on verinice and HiScout specifically.
Grundschutz++ is the BSI's machine-readable evolution of IT-Grundschutz. KaitoSec works with OSCAL-based catalogues and is therefore designed for machine-readable requirements, which is particularly relevant for municipalities moving from WiBA to Grundschutz++.
Compare methodology depth, operating model, migration paths and cross-framework work directly. The comparison pages state where each product differs instead of hiding the trade-offs.
