IT-Grundschutz

IT-Grundschutz is the German Federal Office for Information Security's (BSI) methodology and control catalog for building an information security management system.

It consists of the BSI Standards (200-1 on ISMS requirements, 200-2 on the IT-Grundschutz methodology with its basic, standard, and core protection approaches, 200-3 on risk analysis, and 200-4 on business continuity) and the IT-Grundschutz-Kompendium, a catalog of modules (Bausteine) covering processes, applications, systems, networks, and infrastructure, each with specific requirements.

The 2023 edition of the Kompendium, with 111 modules in ten layers, is the current certification basis while BSI develops its successor, Grundschutz++ (verify status on the BSI site).

IT-Grundschutz is compatible with ISO/IEC 27001 and the BSI issues an "ISO 27001 certificate on the basis of IT-Grundschutz", which is the standard expectation for German federal agencies and common in German critical infrastructure and public sector supply chains.

In writing, an organization following IT-Grundschutz needs the security policy and ISMS scope, a structure analysis of the information domain (assets, applications, systems, networks, rooms), protection requirement determinations, the modeling that assigns Kompendium modules to assets, the IT-Grundschutz check recording each requirement's implementation status, a risk analysis for assets with high protection needs, the implementation plan, and the usual management system records.

The BSI certificate requires an audit by a BSI-certified auditor and is valid for three years with annual surveillance.