Getting Started with BSI IT-Grundschutz

Introduction

BSI IT-Grundschutz is Germany's comprehensive methodology for information security, developed and maintained by the Bundesamt für Sicherheit in der Informationstechnik (BSI), the German Federal Office for Information Security. It has been a cornerstone of information security in German public administration and critical infrastructure for decades.

Unlike ISO 27001, which is principles-based and leaves many implementation details to the organization, Grundschutz provides highly detailed, prescriptive guidance. The IT-Grundschutz-Kompendium contains hundreds of specific recommendations organized into modules (Bausteine) that cover everything from server room security to mobile device management.

The Grundschutz Methodology

BSI IT-Grundschutz follows a structured approach with three qualification levels:

Basis-Absicherung (Basic Protection)

The entry level, designed for organizations that are just starting with systematic information security. It covers fundamental security measures and helps establish a baseline. This is where most SMBs should begin.

Standard-Absicherung (Standard Protection)

The recommended level for most organizations. It involves a complete security assessment based on the IT-Grundschutz-Kompendium and aligns with ISO 27001. Organizations can pursue a combined ISO 27001 certification "auf Basis von IT-Grundschutz" at this level.

Kern-Absicherung (Core Protection)

A focused approach that concentrates on the organization's most critical business processes and assets. Useful when resources are limited and you need to protect the crown jewels first.

For a project starting today, the existing compendium remains the working basis. If you keep Bausteine, requirements and mappings machine-readable from the start rather than in documents, you will not have to rebuild the structure when Grundschutz++ arrives.

Understanding the IT-Grundschutz-Kompendium

The IT-Grundschutz-Kompendium is the heart of the methodology. It contains Bausteine (modules) organized into 10 layers:

• ISMS. Information security management
• ORP. Organization and personnel
• CON. Concepts and procedures
• OPS. Operations (IT operations, third-party operations)
• DER. Detection and response
• APP. Applications (web, email, databases, directory services)
• SYS. IT systems (servers, clients, mobile devices, IoT)
• IND. Industrial IT / OT systems
• NET. Networks (architecture, firewalls, VPN, WLAN)
• INF. Infrastructure (buildings, data centers, workspaces)

Each Baustein contains:

• A description of the topic and its relevance
• Threat scenarios specific to that module
• Requirements at three levels: Basis (basic), Standard, and Erhöht (elevated)
• Cross-references to other related Bausteine

Step-by-Step: Starting Your Grundschutz Project

Step 1: Define the Information Domain (Informationsverbund)

Your Informationsverbund is similar to the ISMS scope in ISO 27001. It defines which business processes, IT systems, applications, networks, and physical locations are covered.

For a first project, start focused. A single department or one critical business process is more manageable than trying to cover the entire organization at once.

Step 2: Conduct Structural Analysis (Strukturanalyse)

Map out all components within your Informationsverbund:

• Business processes and their dependencies
• Applications and IT services
• IT systems (servers, clients, network devices)
• Communication links and network segments
• Physical locations (buildings, rooms)

Group similar components to keep the analysis manageable. For example, if you have 50 identical workstations, they can be treated as one group.

Step 3: Protection Needs Assessment (Schutzbedarfsfeststellung)

For each component, determine the protection needs across three dimensions:

• Confidentiality. What happens if information is disclosed?
• Integrity. What happens if information is altered?
• Availability. What happens if the system is unavailable?

Rate each dimension as normal, high, or very high based on the potential business impact.

Step 4: Modeling (Modellierung)

Map the appropriate Bausteine to your components. For example:

• A Linux server gets Bausteine for SYS.1.1 (General Server) and SYS.1.3 (Linux Server)
• Your office gets INF.1 (General Building) and INF.7 (Office Workspace)
• Your web application gets APP.3.1 (Web Applications)

The BSI provides a modeling guide that recommends which Bausteine apply to which component types.

Step 5: IT-Grundschutz Check

For each applicable Baustein, work through the requirements and assess your implementation status:

• Yes. The requirement is fully implemented
• Partially. Some aspects are implemented
• No. The requirement is not implemented
• Not applicable. The requirement does not apply (with justification)

This produces your compliance gap report. Focus on closing gaps in Basis requirements first, then move to Standard requirements.

Step 6: Supplementary Risk Analysis

For components with high or very high protection needs, a supplementary risk analysis is required. The standard Grundschutz measures may not be sufficient for these critical assets.

Identify additional threats beyond what the Bausteine cover, assess their risk, and define additional security measures.

Grundschutz vs. ISO 27001

Grundschutz or ISO 27001 is the most common opening question. The two do not exclude each other; the BSI explicitly provides for the combined certification.

• ISO 27001 alone. More flexibility, internationally recognized, widely accepted by customers and partners worldwide
• BSI IT-Grundschutz alone. More prescriptive, strong in German public sector and critical infrastructure contexts
• ISO 27001 auf Basis von IT-Grundschutz. Combined certification that uses Grundschutz's detailed methodology while achieving international ISO 27001 recognition

For German organizations, especially those working with public sector clients or operating critical infrastructure, the combined approach often provides the most value.

Tools and Resources

The BSI provides several free resources:

• IT-Grundschutz-Kompendium. The complete catalogue of Bausteine. The last annual edition is Edition 2023; since then the BSI has been developing Grundschutz into a digital ruleset under the name Grundschutz++, and a binding timeline is still pending
• BSI Standards 200-1, 200-2, 200-3, 200-4. The methodology documents
• IT-Grundschutz Profile. Pre-built templates for common use cases

KaitoSec ships the compendium as machine-readable Bausteine, with requirements and cross-references included. You assign Bausteine to your assets and work through the requirements instead of copying content out of PDFs.

Getting Started Today

Start with a tightly drawn information domain and the Basis requirements. A domain that stands after four weeks is worth more than one meant to cover the whole organisation and never finished.