IT Security Concept: Structure and BSI Approach

In German, it is called IT-Sicherheitskonzept or simply Sicherheitskonzept. It is not a one-off document. You keep it up to date when systems, processes or threats change.

Security concept vs. security policy

The information security policy is the top-level document from senior management. It states goals, importance and roles. The security concept, by contrast, is specific and technical.

• Policy: why do we do information security, and which goals apply?
• Security concept: which systems do we have, how much protection do they need and which controls protect them?

The policy rarely changes. You update the concept on an ongoing basis.

The BSI IT-Grundschutz approach

The German BSI IT-Grundschutz explains in BSI Standard 200-2 how to build a security concept. It works in several steps.

First, you choose an approach. Basic protection is a quick start with core requirements. Standard protection covers the whole scope in full. Core protection focuses on the most critical assets, the "crown jewels". The steps below follow standard protection.

1. Structure analysis

You list everything in scope. This includes business processes, applications, IT systems, networks, rooms and buildings. A network diagram helps you see how they connect.

2. Protection needs assessment

For each object, you ask: how much harm would a loss of confidentiality, integrity or availability cause? The BSI uses three categories: "normal", "high" and "very high". They build on the core security objectives.

3. Modeling

You map each object to the right modules from the IT-Grundschutz Compendium. A server gets different modules than an office or a web app. Each module contains requirements.

4. IT-Grundschutz check

Now you check which requirements you already meet. The result is a gap analysis. It shows where controls are missing.

5. Risk analysis

For high or very high protection needs, the standard requirements are often not enough. Then you run a risk analysis, for example with BSI Standard 200-3. It shows which extra controls you need.

6. Implementation plan

Finally, you plan the work. For each open control, you set who does it, by when and with what budget. This turns the concept into a work plan.

Typical parts of a security concept

A complete IT security concept usually contains:

• Scope and link to the security policy
• Overview of business processes, applications and systems
• Network diagram
• Protection needs per object, with reasons
• Results of the risk analysis
• List of controls with their status
• Implementation plan with owners and deadlines
• Rules for keeping the concept up to date

Keep the concept readable. Long tables belong in the appendix. Put the key results up front, so management can grasp the status quickly.

Common mistakes

• Starting too big: if you try to cover everything at once, you rarely finish. A clear, limited scope helps.
• Looking only at tech: processes, rooms and people matter as much as servers and networks.
• No implementation plan: without owners and deadlines, gaps stay open.
• No upkeep: a concept that nobody updates soon stops matching reality.

The security concept in ISO/IEC 27001

ISO/IEC 27001 does not use the term "security concept". But its content shows up in several documents. The standard requires a risk assessment and a risk treatment process.

• Risk treatment plan: sets how you handle each risk and which controls you put in place.
• Statement of Applicability (SoA): shows which Annex A controls you apply and why. You also explain why you left any out.

If you already have a concept based on BSI IT-Grundschutz, you can reuse much of it for ISO 27001. The entry on IT risk management explains how risks are rated.

Who needs an IT security concept?

Any organization that depends on IT gains from a security concept. For some, it is a must in practice:

• Critical infrastructure operators: they must prove that they have suitable safeguards for their systems.
• Companies under NIS2: the NIS2 Directive requires risk management measures. A concept documents them.
• Public bodies and local authorities: many work with BSI IT-Grundschutz or must present a security concept.
• Suppliers and service providers: customers ask more and more often for a written security concept in tenders and audits.

The security concept is a central part of an information security management system (ISMS). It is usually kept up to date by the security officer or the CISO.

Frequently asked questions

How long does it take to write an IT security concept?

That depends on size and complexity. A small scope is mapped faster than many sites with their own IT. Start with your most important business processes, then expand.

How often should you update the concept?

Whenever something important changes, such as new systems, sites or threats. You should also review it at fixed intervals, for example in the yearly management review.

Can an outside expert write the concept?

Yes. Many companies get help because they lack time or experience in-house. An external information security officer or ISMS consulting can support you. But senior management stays accountable.