What is the BSI?

The BSI in plain English

Road safety relies on traffic rules, vehicle inspection centers, and traffic alerts on the radio. In the digital world, Germany’s BSI handles many of these tasks under one roof. It issues recommendations and standards, tests and certifies IT products, warns of acute threats, and, in particularly serious cases, helps deal with security incidents.

The BSI was founded in 1991 and is headquartered in Bonn. As a federal authority, it serves the federal administration, businesses, and the general public.

Particularly useful for businesses: many BSI publications are free of charge and openly available – from its comprehensive framework to concise recommendations for small and medium-sized enterprises.

What the BSI does

1. Standards and recommendations: The BSI developed IT-Grundschutz – a methodology for building up information security systematically – with BSI Standards 200-1 to 200-4 and the IT-Grundschutz Compendium. The BSI is currently transitioning IT-Grundschutz step by step to “Grundschutz++,” a digital framework intended to replace the Compendium; the existing IT-Grundschutz remains usable during a transition period of several years. In addition, there are Technical Guidelines, for example on cryptographic methods, as well as minimum standards for the federal administration. With its guide “Durchführungskonzept für Penetrationstests” (an implementation concept for penetration tests), the BSI has also set out a framework for planning and conducting pentests.
2. Warnings and situational awareness: With CERT-Bund, the federal government’s computer emergency response team, and the National IT Situation Center, the BSI monitors the threat landscape and warns of critical vulnerabilities. Once a year, it publishes its report “The State of IT Security in Germany.”
3. Supervision of regulated companies: The BSI Act (BSIG) transposes the EU’s NIS2 Directive into German law. NIS2 covers significantly more sectors and companies than the previous rules. Operators of critical infrastructure (KRITIS), such as energy or water utilities, and companies that fall under these rules must register with the BSI and report significant security incidents to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance). Operators of critical facilities must also regularly provide the BSI with evidence of their protective measures.
4. Testing and certification: The BSI certifies IT products and management systems, for example according to ISO 27001 on the basis of IT-Grundschutz.
5. Dialogue with industry: With the Alliance for Cyber Security (Allianz für Cyber-Sicherheit), the BSI has launched an initiative for sharing experience between government and industry.

A practical example

A machinery manufacturer with 120 employees uses the BSI’s information to check whether it falls under the NIS2 rules. The assessment: as a medium-sized company in the machinery sector, it counts as an “important entity.”

Management registers the company with the BSI and defines who detects, assesses, and reports significant security incidents on time. To build up the necessary security measures, the head of IT uses IT-Grundschutz as a guide. To verify that the measures are effective, the head of IT commissions a penetration test based on the BSI’s implementation concept.

Why does this matter for businesses?

For many companies, the BSI is now more than a source of information. With Germany’s implementation of the NIS2 Directive in the BSI Act, the group of companies that must meet statutory security obligations, register with the BSI, and report significant incidents has grown considerably. Responsibility for implementation lies with senior management.

But companies without legal obligations benefit too: the BSI’s standards and recommendations are vendor-neutral, practical, and free of charge. They provide a solid basis for planning security measures – and for showing customers, insurers, or auditors that you follow recognized benchmarks.

What businesses should do now

• Check whether you’re affected: Find out whether your company is subject to KRITIS or NIS2 obligations. The main criteria are sector and company size and, for critical facilities, certain thresholds. The BSI’s anonymous online self-assessment provides initial, non-binding guidance.
• Define reporting channels: If you’re affected, register with the BSI and determine who detects, assesses, and reports significant security incidents.
• Use the warnings: Subscribe to the BSI’s warning and information services to learn about critical vulnerabilities early.
• Use standards as guardrails: Follow IT-Grundschutz or ISO/IEC 27001 to build up your security measures systematically.
• Demonstrate effectiveness: Have your protective measures reviewed regularly through penetration tests, and document the results.
• Seek dialogue: Initiatives such as the Alliance for Cyber Security offer access to information and to other companies’ experience.

Note: This article is for general information only and does not constitute legal advice.

How Rootsektor can help

Our penetration tests are guided by the BSI’s implementation concept, among other standards. This gives you clear, verifiable results for your security management and, on completion, a test certificate you can present to customers, partners, insurers, and auditors. Rootsektor is also a participant in the Alliance for Cyber Security – learn more under Partners & Network. You’ll find an overview of our services under Penetration Testing, and you can request a fixed-price quote after scoping via our Pentest Quote page.