BSI IT-Grundschutz: the method, the standards and the Compendium explained

What is BSI IT-Grundschutz?

IT-Grundschutz is the methodology of Germany's Federal Office for Information Security (BSI) for building an information security management system and protecting information appropriately. It has two parts: BSI Standards 200-1 to 200-4, which describe the approach, and the IT-Grundschutz Compendium, which contains the requirements for typical processes and systems.

The approach is aimed at public authorities and companies of any size. Its core idea is that typical threats do not have to be analysed afresh in every organisation: for normal protection needs the Compendium sets out proven requirements, and a separate risk analysis is only needed where they are not sufficient.

IT-Grundschutz is a complete security process

BSI Standard 200-1 describes the general requirements for an ISMS. Standard 200-2 specifies how an information security process is built with IT-Grundschutz. Standard 200-3 adds the risk analysis, Standard 200-4 business continuity management.

The IT-Grundschutz Compendium contains modules (Bausteine) for typical processes, applications, systems, networks and infrastructures. These modules are not adopted wholesale but modelled against your own information domain.

The method reduces recurring analysis work

For typical target objects, the threat landscape and the requirements are already structured. The organisation still has to check whether the domain under consideration carries particular risks, operating conditions or increased protection needs.

• Define the information domain and the scope
• Record business processes, information, applications and technology
• Determine protection needs and account for dependencies
• Model the appropriate modules and check the requirements
• Treat additional risks and keep the process up to date

IT-Grundschutz and ISO 27001

BSI Standard 200-1 is compatible with ISO/IEC 27001. An organisation that fully implements Standard or Core Protection can apply to the BSI for an ISO 27001 certificate on the basis of IT-Grundschutz, audited by auditors certified by the BSI. Basic Protection alone is not enough for it.

For organisations that already work to ISO 27001, the BSI publishes a mapping table between the requirements of the standard and the modules of the Compendium. It shows where the two overlap and where IT-Grundschutz becomes more specific.

Compendium, edition and Grundschutz++

Edition 2023 is the last annual edition of the IT-Grundschutz Compendium. Since then the BSI has been developing IT-Grundschutz further under the name Grundschutz++. Certifications and audits follow the audit basis the BSI currently names; settle which one applies before you plan a project.

Do not start with all the modules

An effective start begins with the security process and a clearly defined information domain. The IT-Grundschutz starter check shows whether these foundations are already sound.