BSI IT-Grundschutz Guide: Modules, Methodology and Certification

IT-Grundschutz is the German Federal Office for Information Security's (BSI) complete method for building an information security management system, and organisations that treat it as a long checklist end up with thousands of requirements and no clear risk picture. It combines four BSI Standards (200-1 to 200-4) with the IT-Grundschutz Compendium of modules, and it can lead to an ISO 27001 certificate issued by the BSI on the basis of IT-Grundschutz. It is the reference method for German federal and many state and municipal bodies, and it is widely used by critical infrastructure operators and their suppliers. This guide explains the methodology, the Compendium Edition 2023 structure, the three protection approaches, how certification works, and what the planned modernisation known as Grundschutz++ means for current programmes. It is written for ISMS leads, CISOs, auditors and IT teams in Germany or working with German public sector and regulated customers. Status was checked on bsi.bund.de in October 2026.

Key takeaways

• Method plus catalogue. BSI Standard 200-1 sets ISMS requirements, 200-2 the methodology, 200-3 risk analysis and 200-4 business continuity; the Compendium supplies the modules and requirements you model against.
• Edition 2023 is the current Compendium. It has been available since 1 February 2023 and contains 111 modules in ten layers; only the German version is valid as a basis for certification.
• Three ways in. Basis-Absicherung (basic protection) gives quick broad coverage, Kern-Absicherung (core protection) protects the crown jewels first, and Standard-Absicherung (standard protection) is the full method that leads to certification.
• Certification is BSI-run. A BSI-certified auditor examines reference documents and the site, and the BSI certification body reviews the report and issues the ISO 27001 certificate on the basis of IT-Grundschutz; a Testat covers Basis-Absicherung.
• Grundschutz++ is coming, but not yet. The BSI is rebuilding IT-Grundschutz as a process-oriented, machine-readable JSON rule set to replace the Compendium, with a multi-year transition during which the current version stays usable.

What it is and who it applies to

IT-Grundschutz covers technical, organisational, infrastructural and personnel security. Its central idea is that for normal protection needs, the BSI has already done the threat and risk analysis for typical components, so an organisation can apply ready-made requirements and save risk analysis for what is unusual or highly sensitive. It is compatible with ISO/IEC 27001 and draws on ISO/IEC 27002.

IT-Grundschutz profiles are pre-built application scenarios for a sector that organisations can adapt. The BSI lists profiles for shipping companies (shore and ship operations), space infrastructure and small and medium-sized airports, among others.

IT-Grundschutz is organisation-wide. It is different from the BSI's cloud catalogue C5, which is a service-level attestation for cloud providers issued by public accountants; we cover that in our Germany BSI C5 Guide.

Structure and key requirements

The BSI Standards

The three protection approaches in 200-2

• Basis-Absicherung: implements the basic requirements across the whole scope quickly. Good for a first pass or a small organisation; it can be confirmed with a Testat but not an ISO certificate.
• Kern-Absicherung: applies the full method to a narrow set of critical business processes and assets first, leaving the rest for later.
• Standard-Absicherung: the full method across the scope, with basic and standard requirements, risk analysis where needed, and the route to ISO 27001 certification on the basis of IT-Grundschutz.

The Compendium, Edition 2023

Each module describes the typical threats for its subject and then lists requirements. Separate implementation guidance (Umsetzungshinweise) explains how to meet them. Requirements are graded as basic, standard and for elevated protection needs, and the modules include a risk assessment for normal protection needs that reflects the state of the art at publication.

Use the German Edition 2023 PDFs and the errata and change documents published with them. The English translation has historically been a draft and is not valid for certification.

Grundschutz++: status in October 2026

• What the BSI says: the new IT-Grundschutz is process-oriented and based on a digital rule set in JSON that is intended to replace the text-based Compendium. The current version remains usable during a multi-year transition and a Compendium update is also planned.
• Protection levels: the fixed basic, standard and elevated levels are to be replaced by flexible performance figures with dynamic thresholds; requirements become technology-neutral, with state-of-the-art solutions stored as recommended metadata; WiBA checklists are generated from the requirements.
• Reported timeline: the BSI presented the concept at it-sa 2024 (as reported by heise). Advisory firm Rödl & Partner reported in May 2026 that a Grundschutz++ methodology guide was published in April 2026 for pilot projects, not for immediate migration of existing certifications, and that current IT-Grundschutz stays valid until the end of 2028 with a certifiable framework targeted for 2028. These dates are secondary reports: confirm them with the BSI before planning a migration.

Identity and NHI requirements

Identity controls are spread across several modules. ORP.4 Identity and access management aims to ensure that users and IT components can reach only the IT resources and information they need and are authorised to use. That wording explicitly includes IT components, which is the hook for service accounts, technical users, API keys and workload identities.

Model these modules against every target object where they apply and record the result in the IT-Grundschutz check. See the Service Account Security Guide, the Group Managed Service Accounts (gMSA) Guide and the Secrets Management Guide.

Implementation steps

1. Initiate the security process (200-1). Management takes responsibility, approves a security policy and appoints an information security officer with resources.
2. Choose the approach (200-2). Start with Basis- or Kern-Absicherung if resources are tight; plan Standard-Absicherung if certification is the goal.
3. Define the scope (Informationsverbund). Business processes, applications, IT systems, networks, rooms and the people who use them. A certificate can cover a whole organisation or a defined part such as a data centre.
4. Structure analysis. Inventory processes, applications, systems, networks and rooms, grouping similar objects to keep the model manageable. Include technical accounts and keys.
5. Protection needs assessment. Rate confidentiality, integrity and availability as normal, high or very high per process, then inherit to applications and systems.
6. Modelling. Assign Compendium modules to each target object.
7. IT-Grundschutz check. Record for each requirement whether it is implemented, partly implemented, not implemented or not applicable, with justification.
8. Risk analysis (200-3). For objects with high or very high protection needs, or with no fitting module, identify additional threats and decide on treatment.
9. Implementation plan. Prioritise missing requirements, assign owners, budget and dates; deliver basic requirements first.
10. Operate and improve. Internal audits (DER.3.1), management review, incident lessons and edition updates feed back into the model.

Pilot and rollback: test the model on one business process before scaling. When a new Compendium edition or Grundschutz++ is introduced, run the new mapping in parallel for one cycle and keep the previous check results until the auditor has accepted the new baseline.

Decision guidance

• ISO 27001 native or on the basis of IT-Grundschutz: the native route lets you design controls from your own risk assessment and is recognised internationally through accredited certification bodies; the IT-Grundschutz route gives detailed, ready-made requirements and a BSI-issued certificate that German public sector customers know well, at the cost of more documentation.
• Small organisations: start with WiBA checklists or Basis-Absicherung, then a Testat; move to Standard-Absicherung only when a customer or regulator needs the certificate.
• Large organisations: use Kern-Absicherung for the most critical services first, and invest in tooling that can import machine-readable requirements, since Grundschutz++ is moving to JSON.

Evidence and assessment

• Audit process: the auditor reviews the reference documents the organisation prepares (policies, structure analysis, protection needs, modelling, IT-Grundschutz check, risk analysis and implementation plan), carries out an on-site inspection and writes an audit report that the BSI certification body reviews before awarding the certificate.
• Governing documents: the certification scheme (version 2.2 of 1 February 2026), the auditing scheme and the test basis (Prüfgrundlage, version 4.8), with BSI guidance on reference documents and outsourcing. Check the BSI page for the current versions before an audit.
• Contact: certification questions go to the BSI certification team ([email protected]).

Detection and measurement

• Coverage: percentage of target objects modelled and with a completed IT-Grundschutz check.
• Basic requirements: percentage of basic requirements fully implemented (target 100% before certification).
• Risk analysis: number of high or very high protection objects without a completed 200-3 risk analysis (target zero).
• Implementation plan: percentage of overdue actions, and median age of open actions.
• Identity: percentage of technical accounts in the structure analysis with a named owner and a review date in the last 12 months.

Mapping to other frameworks

• ISO 27001: an ISO 27001 certificate on the basis of IT-Grundschutz confirms the organisation meets ISO 27001 requirements as well as specific IT-Grundschutz requirements. See the ISO 27001 Certification Guide and the ISO 27002 Controls Guide.
• NIS2: heise reported that the BSI linked the modernisation to the German NIS2 implementation law. An IT-Grundschutz ISMS supports NIS2 risk management obligations, but check the national law for what entities must report and evidence. See the NIS2 Directive Guide.
• C5: an IT-Grundschutz certificate does not produce a C5 cloud attestation; the procedures are separate.

Common pitfalls

• Modelling everything individually. Skipping grouping in the structure analysis produces thousands of check entries nobody maintains. Group similar objects and document the grouping rule.
• Treating modules as the whole risk analysis. Modules cover normal protection needs. High-need objects without a 200-3 risk analysis are a frequent audit finding and a real gap.
• Using the English draft. Certification uses the German edition; requirements in a translation can differ.
• Leaving technical accounts out of ORP.4. Service accounts and keys sit outside the account review and privileged access processes, although ORP.4 covers IT components too.
• Assuming the cloud provider covers OPS.2.2. Customer-side identity is yours. In the Snowflake breach, attackers used stolen credentials on customer accounts without MFA; the provider platform was not found to be at fault.
• Migrating to Grundschutz++ too early, or ignoring it. Rushing a certified ISMS onto a pilot framework risks the certificate; ignoring it leaves you with manual Word-based documentation when tooling moves to JSON.

Practitioner checklist

• Confirm management approval, policy and an appointed information security officer under BSI Standard 200-1.
• Choose Basis-, Kern- or Standard-Absicherung and record why.
• Complete the structure analysis, including technical accounts, keys and cloud tenants.
• Assess protection needs per business process and inherit them consistently.
• Model against the German Compendium Edition 2023 and apply the published errata.
• Run a 200-3 risk analysis for every high or very high protection object.
• Track the implementation plan with owners and dates, basic requirements first.
• Check the current certification scheme and test basis versions before booking a BSI-certified auditor.
• Assign someone to follow Grundschutz++ publications and plan a parallel mapping before the transition ends.

Standards and references

• BSI: IT-Grundschutz
• BSI: BSI-Standards 200-1 to 200-4
• BSI: IT-Grundschutz-Kompendium
• BSI: IT-Grundschutz modules, Edition 2023
• BSI: Certification scheme for ISO 27001 on the basis of IT-Grundschutz
• BSI: Zertifizierte Informationssicherheit
• Rödl & Partner: Grundschutz++ and information security
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: ISO 27001 Certification Guide · NIS2 Directive Guide · Data Sovereignty and Residency Guide · Global Cybersecurity Regulatory Map. For cloud provider attestation, see our Germany BSI C5 Guide. This guide summarises the BSI IT-Grundschutz methodology and certification scheme as checked in October 2026 and is not legal advice.