What is BSI IT-Grundschutz?

IT-Grundschutz is the security methodology of Germany’s Federal Office for Information Security (BSI), widely used by German public bodies and companies. It consists of BSI standards that describe how to build an information security management system, carry out a protection-needs assessment and handle risks, plus a compendium of modules with concrete requirements for typical components such as servers, networks, applications, buildings and processes. Instead of starting every risk assessment from scratch, you model your environment with the relevant modules and apply their requirements, analysing risks separately only where protection needs are high or no module fits. An ISO 27001 certificate on the basis of IT-Grundschutz can be issued through the BSI, which combines both approaches. It is detailed and can be heavy for a small company, but its modules are a free, practical checklist even if you never seek certification, and they help with German NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. duties under the BSIG. Its network modules include logging and detection requirements that network monitoring helps evidence. NetSenX does not assess Grundschutz conformity.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics