IT-Grundschutz Compendium: structure, layers and modules

What is the IT-Grundschutz Compendium?

The IT-Grundschutz Compendium is the collection of modules (Bausteine) that the approach under BSI Standard 200-2 works with in practice. Each module covers a typical subject, such as a process like data backup or a target object like a web server, and describes its threat landscape and the requirements to be met.

The standards describe the approach, the Compendium the content. Which modules apply to an organisation is only decided by modelling its own information domain: not every module is relevant, and some are applied to several target objects.

Ten layers: process and system modules

The modules are organised into ten layers. The first five hold process modules, which usually apply to the whole information domain. The other five hold system modules, which are assigned to individual target objects.

• ISMS: security management
• ORP: organisation and personnel
• CON: concepts and approaches
• OPS: operations
• DER: detection and response
• APP: applications
• SYS: IT systems
• IND: industrial IT
• NET: networks and communication
• INF: infrastructure

How a module is built

Every module follows the same pattern: a description with introduction, objective and scope, the specific threat landscape and the requirements, plus further information. Requirements name a responsible role and use the modal verbs MUST, SHOULD and MAY so that their binding force is unambiguous.

The requirements come in three levels. Which levels are implemented depends on the chosen approach and on the protection needs.

• Basic requirements: implemented first and the basis of Basic Protection
• Standard requirements: together with the basic requirements, the benchmark for normal protection needs
• Requirements for elevated protection needs: proposals selected after a risk analysis

Elementary threats as a shared basis

The Compendium also lists 47 elementary threats, from fire (G 0.1) through malware to social engineering. They are the starting point of the risk analysis under BSI Standard 200-3. Cross-reference tables show for each module which requirement addresses which threat.

Which edition applies?

Edition 2023 is the last annual edition of the Compendium. Since then the BSI has been developing IT-Grundschutz further under the name Grundschutz++. Certifications and audits follow the audit basis the BSI currently names; check it before the project starts so that modelling and the IT-Grundschutz-Check rest on the same version.