BSI IT-Grundschutz in plain English
When you build a house, you don’t have to reinvent structural engineering. There are proven blueprints, standards, and checklists. IT-Grundschutz works in a similar way for information security. For typical systems and processes, the BSI has described which threats exist and which safeguards are appropriate – from servers and telephone systems to working with service providers.
Instead of analyzing every risk individually, an organization checks which of these modules apply to it and implements the associated requirements. In other words, for normal protection needs, the BSI has already done the risk assessment in advance. An additional risk analysis is mainly needed where protection needs are high or no suitable module exists.
IT-Grundschutz is especially widespread in public authorities, municipalities, and universities. But many companies also use the modules as a practical checklist – without any intention of getting certified.
How IT-Grundschutz works
IT-Grundschutz has two core elements:
- BSI Standards 200-1 to 200-4: Standard 200-1 describes the requirements for an ISMS, i.e., a management system for information security. 200-2 explains the IT-Grundschutz methodology, and 200-3 covers risk analysis. 200-4 deals with business continuity management – the precautions that keep operations running even in emergencies and crises.
- The IT-Grundschutz Compendium: It contains the modules, organized in layers – from security management, operations, and attack detection to applications, IT systems, networks, buildings, and industrial IT. Each module lists typical threats and requirements, divided into basic requirements, standard requirements, and requirements for elevated protection needs.
The process follows set steps. First, the area under consideration is defined – the so-called information domain. Then business processes, applications, and systems are recorded and their protection needs assessed: normal, high, or very high. Next, each object is assigned the appropriate modules, and a target/actual comparison checks what has already been implemented – the IT-Grundschutz Check.
There are three ways to get started. Basic Protection quickly creates a foundation. Core Protection first protects the most valuable areas particularly thoroughly. Standard Protection comprehensively covers the entire information domain. Organizations that want to prove their implementation can obtain ISO 27001 certification on the basis of IT-Grundschutz; the certificate is issued by the BSI.
The BSI is currently transitioning IT-Grundschutz step by step to “Grundschutz++”: process-oriented and with a digital, machine-readable set of rules that is easier to implement with software tools and is intended to replace the IT-Grundschutz Compendium. The existing IT-Grundschutz remains usable during a transition period of several years.
A practical example
Here’s a typical scenario: A county administration wants to put its information security on a solid foundation but has only a small IT team. It starts with Basic Protection, using an IT-Grundschutz profile for municipal administrations – a template that already takes the typical structures of a municipality into account. Step by step, fundamentals such as assigning permissions, data backup, and emergency planning are put in place. While working through the module for web applications, the team notices that the citizen portal is run by an external service provider and has never been independently tested. A penetration test – an authorized, simulated attack – uncovers an outdated software component with a known security vulnerability there. The findings feed into the next stage: Standard Protection for the most important specialized applications.
Why does this matter for businesses?
IT-Grundschutz translates abstract security goals into concrete, verifiable requirements. That saves time, because nobody has to start from scratch. According to the BSI, organizations that implement Standard Protection achieve a level of security that is appropriate and sufficient for normal protection needs. This creates a recognized benchmark for auditors, supervisory authorities, and business partners.
In the public sector, IT-Grundschutz is often the central framework. Companies that fall under NIS2 can also find a structured basis in it for the required risk management. One important limitation applies, however: a completed IT-Grundschutz Check shows what is planned and documented – not whether the measures will withstand a real attack.
What businesses should do now
- Choose your entry point: Start with Basic Protection if you need a solid foundation quickly.
- Use templates: Check whether there is a suitable IT-Grundschutz profile for your industry or type of organization.
- Assess protection needs honestly: Identify the processes and data whose failure or disclosure would cause the greatest damage.
- Repeat the check regularly: Systems and requirements change – your target/actual comparison should keep pace.
- Test implementation in practice: Use penetration tests and vulnerability assessments to check whether your measures actually work.
- Plan the switch: Follow the transition to “Grundschutz++” and plan your move within the transition period.
How Rootsektor can help
As a Germany-based security company, Rootsektor tests whether the measures in your security concept work in practice – from the citizen portal to the internal network to Active Directory. In doing so, we align our approach with the BSI guide “Durchführungskonzept für Penetrationstests” (an implementation concept for penetration tests); the results can be incorporated directly into your security concept, internal audits, and risk assessment. You can read which tests are particularly suitable for public administrations, schools, and universities under Public Sector & Education. You’ll receive a fixed-price quote after scoping via our Pentest Quote page.