# What is BSI IT-Grundschutz?

IT-Grundschutz is the security methodology of Germany’s Federal Office for Information Security (BSI), widely used by German public bodies and companies. It consists of BSI standards that describe how to build an information security management system, carry out a protection-needs assessment and handle risks, plus a compendium of modules with concrete requirements for typical components such as servers, networks, applications, buildings and processes. Instead of starting every risk assessment from scratch, you model your environment with the relevant modules and apply their requirements, analysing risks separately only where protection needs are high or no module fits. An ISO 27001 certificate on the basis of IT-Grundschutz can be issued through the BSI, which combines both approaches. It is detailed and can be heavy for a small company, but its modules are a free, practical checklist even if you never seek certification, and they help with German NIS2 duties under the BSIG. Its network modules include logging and detection requirements that network monitoring helps evidence. NetSenX does not assess Grundschutz conformity.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/what-is-bsi-it-grundschutz

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is the difference between a certification and an attestation report?](https://netsenx.com/en/faq/certification-vs-attestation-what-is-the-difference)
- [How do we prepare for our first ISO 27001 certification audit?](https://netsenx.com/en/faq/how-to-prepare-for-a-first-iso-27001-audit)
- [What is ISO/IEC 27001, in plain terms?](https://netsenx.com/en/faq/what-is-iso-27001)
- [What is an information security management system?](https://netsenx.com/en/faq/what-is-an-isms)
- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)