IT-Grundschutz.
Understand BSI IT-Grundschutz: standards, the Compendium and the path from an information domain to an audited ISMS.
- BSI Standards 200-1 to 200-4
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 8 min.
Short answer.
IT-Grundschutz is the BSI methodology for establishing and operating an information security management system. BSI Standard 200-2 describes the process; the IT-Grundschutz Compendium provides security requirements for typical contexts. Organisations define their information domain, determine protection needs and check implementation. ISO 27001 certification on the basis of IT-Grundschutz is one possible form of evidence.
BSI standards and the IT-Grundschutz Compendium.
IT-Grundschutz combines a security process with a catalogue of recurring security requirements. An information security management system, or ISMS, defines how an organisation protects its information, makes decisions and checks the effectiveness of its measures. BSI Standard 200-1 describes this management system; BSI Standard 200-2 details the IT-Grundschutz methodology.
The IT-Grundschutz Compendium organises security requirements into modules for different subjects and target objects. These include security management, personnel, applications, IT systems, networks and infrastructure. In developing the modules, the BSI considered typical risks for normal protection needs. Supplementary implementation guidance explains possible measures but is a separate aid.
The standards complement one another with different tasks. BSI Standard 200-3 describes additional risk analysis; BSI Standard 200-4 addresses business continuity management, meaning preparation for disruptions and continuation of important business processes. A catalogue alone therefore replaces neither the security organisation nor decisions about an organisation's own protection needs.
The BSI overview accessed during this research lists the 2023 edition of the IT-Grundschutz Compendium. For a specific project, record the edition used, its associated errata and the applicable audit basis. Subsequent changes to the catalogue version must remain traceable in the security concept.
Who BSI IT-Grundschutz is suitable for.
IT-Grundschutz is intended for companies, public authorities and other organisations seeking to organise information security systematically. BSI Standard 200-1, section 1.3, also considers smaller institutions. Whether its use is mandatory in a particular case depends on the applicable statutory, regulatory or contractual requirements; the methodology itself is not a general law for businesses.
Basic Protection provides a broad starting point with fundamental requirements. Core Protection focuses on particularly important business processes and the resources they need. Standard Protection follows the full methodological process for the defined information domain. BSI Standard 200-2, section 3.3 and sections 6 to 8, describes these three approaches.
The decision depends on the objective and a manageable scope. Organisations that initially secure particularly critical services still need clear interfaces with supporting services. Those seeking certification should agree the intended assessment subject with the audit team early; Basic Protection alone is insufficient under BSI Standard 200-2, section 11.
What IT-Grundschutz fundamentally requires.
IT-Grundschutz requires a traceable security concept and an ongoing security process. The following areas describe the methodology in general terms; the specific requirements only emerge from the defined information domain and chosen approach.
Responsibility and security organisation.
Management sets security objectives, holds overall responsibility and provides resources. Responsibilities and communication channels must fit the organisation. BSI Standard 200-1, sections 4 and 7, addresses management principles and the security process; purchasing technology alone does not create an ISMS.
Information domain and structural analysis.
Structural analysis records the business processes, information and target objects within scope, together with their dependencies. BSI Standard 200-2, section 8.1, covers applications, networks, IT systems and rooms, among other things. The description should explain which resources actually enable the services under consideration.
Determine protection needs with clear reasoning.
The protection needs assessment evaluates potential damage to confidentiality, integrity and availability. BSI Standard 200-2, section 8.2, describes the normal, high and very high categories and their transfer to dependent target objects. Classification requires substantiated assumptions from business functions, rather than simply selecting technical metrics.
Model the appropriate modules.
Modelling selects appropriate modules from the IT-Grundschutz Compendium and assigns them to the target objects under consideration. BSI Standard 200-2, section 8.3, explains selection and adaptation. Coverage of the information domain is decisive: a long list of modules without a justified connection to the actual structure is not a robust security concept.
Check implementation and develop it further.
The IT-Grundschutz Check examines actual implementation against the relevant requirements. BSI Standard 200-2, section 8.4, describes preparation, comparison of required and actual status, and documentation. Interviews and verifiable records help substantiate statements; BSI Standard 200-1, section 7, addresses ongoing monitoring and improvement of the security process.
Treat additional risks.
Additional risk analysis is needed particularly for high or very high protection needs, where suitable modules are missing, or for special operating scenarios. BSI Standard 200-3, sections 1.2 and 1.3, explains these cases. A threat overview, risk classification and treatment lead to reasoned decisions and, where appropriate, additional measures.
The process under BSI Standard 200-2.
Define the mandate and approach.
Agree security objectives, owners and resources with management, and select Basic, Core or Standard Protection under BSI Standard 200-2, section 3.3.
Record the information domain.
Define the scope and document business processes, information, target objects and dependencies in the structural analysis under BSI Standard 200-2, section 8.1.
Justify protection needs.
Determine potential damage with the responsible business owners and transfer protection needs to supporting resources under BSI Standard 200-2, section 8.2.
Model and check implementation.
Select suitable modules and assess their implementation through the IT-Grundschutz Check under BSI Standard 200-2, sections 8.3 and 8.4.
Decide on risks and measures.
Add any necessary risk analyses under BSI Standard 200-3 and define measures with priorities, owners and implementation deadlines.
Track effectiveness and changes.
Review measures and the security concept regularly and after relevant changes so that the security process remains effective under BSI Standard 200-1, section 7.
IT-Grundschutz certification and auditable evidence.
The formal evidence is called an ISO 27001 certificate on the basis of IT-Grundschutz. A BSI-certified auditor examines the defined information domain; the BSI certification body evaluates the audit report and decides on certification. BSI Standard 200-2, section 11, provides this route for Standard Protection and, in principle, Core Protection.
The reference documents show the path from security objectives to implementation. The BSI audit scheme, section 2.3, lists the overarching policy and specific policies, structural analysis, protection needs assessment, modelling, IT-Grundschutz Check, risk analysis and implementation plan. An audit therefore checks more than the existence of documents: the described measures must be demonstrably implemented in the examined domain.
The BSI certification scheme reviewed during research, section 2.8.1, provides for a three-year term with annual surveillance audits. Section 2.8.3 addresses recertification. Significant changes to the certified information domain must be taken into account; an ongoing renewal process does not automatically extend an expired certificate.
Read more on the blog.
- A pragmatic approach to IT-GrundschutzPlan a manageable starting point with a clear structure and traceable responsibilities.
- Connecting protection needsBring protection needs and risk assessment together in a consistent working model.
- IT-Grundschutz++ and OSCALRead the time-specific assessment of IT-Grundschutz's development towards machine readability.
Understanding other frameworks.
ISO 27001 describes ISMS requirements; IT-Grundschutz combines such a management system with the BSI methodology and Compendium. NIS2 concerns statutory duties for certain entities, and an IT-Grundschutz certificate alone does not demonstrate their fulfilment. BSI Standard 200-4 provides a methodology for business continuity management; ISO 22301 addresses requirements for a corresponding management system.
In Secani.
Secani provides work areas for structural analysis, protection needs assessment, modelling and the IT-Grundschutz Check. Risks and an implementation plan complement this work. This allows substantive decisions and implementation status in an IT-Grundschutz project to be documented; examination and certification decisions remain with the audit team and responsible body.
Start with a defined information domain.
The first step is a shared understanding of scope. Name the business processes under consideration and their owners, record supporting resources and decide which approach fits your objective. BSI Standard 200-2, sections 3 and 8.1, provides the methodological starting point.
Sources.
- ISO 22301:2019: Business continuity management systems
- BSI Standard 200-1: Information security management systems
- BSI Standard 200-2: IT-Grundschutz methodology
- BSI Standard 200-3: Risk analysis on the basis of IT-Grundschutz
- BSI Standard 200-4: Business continuity management
- BSI: IT-Grundschutz Compendium
- BSI: certification scheme for ISO 27001 on the basis of IT-Grundschutz
- BSI: audit scheme for ISO 27001 audits on the basis of IT-Grundschutz
Frequently asked questions.
No. Under BSI Standard 200-2, an information domain can also cover a defined part of an organisation. The dependencies and interfaces relevant to its business processes must nevertheless be considered.
No. Modelling selects the modules suitable for the information domain. BSI Standard 200-2, section 8.3, describes selection and justified adaptation.
Not simply because it is operated externally. BSI Standard 200-2, sections 8.3.5 and 8.3.7, accounts for cloud systems and external service providers in modelling. Responsibilities and interfaces form part of the security concept.
No. ISO 27001 certification on the basis of IT-Grundschutz concerns the audited information domain and associated ISMS. The BSI certification scheme describes the assessment subject; this does not amount to blanket certification of all products used.
Manage IT-Grundschutz with a clear audit trail.
Discuss how you can structure your IT-Grundschutz project in Secani.
This page explains the BSI methodology. BSI publications and the audit basis applicable to the particular project take precedence.