BSI IT-Grundschutz: Modules, Approach and Certification Explained Simply

What Is the BSI IT-Grundschutz?

IT-Grundschutz is the best-known IT security standard from Germany. It is published by the Federal Office for Information Security (BSI). The basic idea dates back to the 1990s: many organizations have similar systems and similar risks. So it makes sense to write ready-made rules for typical areas.

This saves work. Instead of looking at every risk on its own, a company checks which modules apply and puts their rules into practice. Only areas that need very strong protection get their own risk analysis.

IT-Grundschutz does not only cover technology. It also covers processes, staff and buildings. A complete ISMS can be built on it.

The Components

The BSI Standards 200-1 to 200-4

• BSI standard 200-1: what a management system for information security must do.
• BSI standard 200-2: the method itself, meaning the actual steps.
• BSI standard 200-3: risk analysis based on IT-Grundschutz.
• BSI standard 200-4: business continuity management, meaning preparing for emergencies and crises.

The IT-Grundschutz Compendium

The Compendium holds all modules. Each module covers one topic, lists the typical threats and names the rules. The rules come in three levels: basic, standard and high protection needs.

The basis is a list of 47 basic threats, such as fire, malware, theft or user errors. The modules refer to these threats.

IT-Grundschutz Profiles

Profiles are templates for certain sectors, for example for towns or universities. They show which modules usually apply there. This makes it easier to start.

The Modules at a Glance

The modules are sorted into layers. Each layer has a short code:

• ISMS: security management itself.
• ORP: roles and staff, such as user accounts and access rights.
• CON: concepts, such as the crypto concept or data protection.
• OPS: operations, such as patch and change management.
• DER: detection and response, such as handling security incidents.
• APP: applications, such as web applications or Active Directory.
• SYS: IT systems such as servers, clients and smartphones.
• IND: industrial IT, such as control systems in production.
• NET: networks and communication.
• INF: buildings, server rooms and workplaces.

An example: module OPS.1.1.3 covers patch and change management. Among other things, it says security updates must be planned, tested and installed soon.

Three Levels of Protection

• Basic protection: the entry point. All areas get the most important basic rules. Good for smaller firms or as a first step.
• Core protection: the most valuable areas, the so-called crown jewels, are protected especially well first.
• Standard protection: the full path. All areas are fully protected. It is the basis for a certificate.

The Approach in Seven Steps

Standard protection follows a set process:

1. Structure analysis: which business processes, applications, systems, networks and rooms are there?
2. Protection needs: how bad would it be if data leaked, was changed or could not be reached? The levels are normal, high and very high.
3. Modeling: which modules fit which parts of the organization?
4. IT-Grundschutz check: which requirements are already met, and which are not?
5. Risk analysis: areas that need high protection or have no matching module get their own analysis under BSI standard 200-3.
6. Planning: missing steps are ranked and planned with owners and deadlines.
7. Doing and improving: the steps are put in place and checked on a regular basis.

IT-Grundschutz and ISO 27001

ISO 27001 is an international standard. It says what an ISMS must achieve, but not in detail how. IT-Grundschutz is much more hands-on. It says just what to do for single systems.

The two can be combined. The BSI awards its own certificate: ISO 27001 based on IT-Grundschutz. The audit is carried out by auditors certified by the BSI. The basis is standard protection.

Which path fits depends on the goal. Companies that work internationally often choose plain ISO 27001. Public bodies, towns and firms that work for the state often rely on IT-Grundschutz.

Who Uses IT-Grundschutz

• Federal bodies: for them, IT-Grundschutz is largely required.
• States and towns: many use it as the basis of their security.
• Critical services: operators of power, water or health services use it to prove that they meet the law.
• Companies: suppliers to the state and mid-sized firms in particular value the clear rules.

IT-Grundschutz also helps with the NIS-2 directive. Many of the steps it asks for are found right in the modules.

Benefits and Challenges

Benefits:

• Hands-on: ready-made rules instead of an empty frame.
• Free of charge: all standards and the Compendium are freely available from the BSI.
• Known: public bodies, auditors and many customers know and accept the standard.
• Step by step: basic protection allows a small start.

Challenges:

• Size: the Compendium is very large. Without a tool, it is easy to lose track.
• Paperwork: every rule must be checked and its status written down.
• New editions: modules are revised. The BSI is currently working on a modernized form of IT-Grundschutz under the name Grundschutz++.

Software Support

Specialized tools help with the work. In SecTepe.Core, you pick ISO 27005 or BSI 200-3 as the method for each risk. With BSI 200-3, you link a threat from the BSI catalog and set the protection need. Core spots new IT-Grundschutz editions in its framework change management and shows which controls they affect.

Conclusion

BSI IT-Grundschutz is a hands-on toolkit for information security. Standards 200-1 to 200-4 describe the steps, and the Compendium gives the clear rules. If you start with basic protection and work your way up to standard protection step by step, you build a solid basis, also for ISO 27001 and NIS-2.