BSI IT-Grundschutz · ISMS · Certification
BSI IT-Grundschutz: Consulting, Implementation and Certification
BSI IT-Grundschutz is the BSI's framework for information security management, now also as Grundschutz++ under BSI Standard 300-1. We support build, migration and certification, with project experience through to initial certification.
What is BSI IT-Grundschutz?
BSI IT-Grundschutz is the information security management framework developed by the German Federal Office for Information Security (BSI). Its centrepiece is the IT-Grundschutz Compendium — a structured catalogue describing concrete security requirements for specific system classes, processes and infrastructures: from server systems through WLAN infrastructures to physical security and cloud usage.
This catalogue-based approach is fundamentally different from ISO 27001: where ISO 27001 is risk-based and openly phrased, IT-Grundschutz prescribes concrete measures – the so-called building blocks (Bausteine) with their basic, standard and elevated requirements. For organisations that prefer a clear, prescribed implementation path – or are regulatorily required to follow one – this is a decisive advantage.
For bodies of the German federal administration, Section 44 of the BSI Act refers to the BSI standards and IT-Grundschutz as minimum requirements. For many KRITIS operators, state authorities and public-sector-adjacent organisations it is the de-facto standard. Private-sector organisations with a strong public-sector nexus or demanding security requirements also increasingly choose it, not least because it can be assessed directly by BSI-accredited auditors and evidenced through an official certificate.
Grundschutz++: the new methodology under BSI Standard 300-1
With BSI Standard 300-1 "Methodik Grundschutz++" (version 1.0 of 20 October 2026), the BSI has redesigned IT-Grundschutz. The requirements are published in machine-readable form in the Grundschutz++ user catalogue of the BSI state-of-the-art library, which according to the BSI replaces the IT-Grundschutz Compendium. The main changes:
- Protection needs are determined per business process, with only two categories: normal and high.
- An own risk assessment is mandatory in three cases only: high protection needs, assets without a suitable target object category and SOLLTE (should) requirements that are permanently not met. The method can be chosen freely but must meet 35 minimum criteria.
- MUSS (must) requirements allow no exceptions; every requirement is met, not met or not applicable with a justification.
- Automated configuration checks and technical scans are accepted as evidence.
From 1 January 2027, organisations can apply for ISO 27001 certification on the basis of Grundschutz++. According to the BSI milestone plan, classic IT-Grundschutz remains certifiable until 30 November 2031. If you hold a certificate today, we recommend planning the switch with your next recertification cycle.
The three IT-Grundschutz methodologies
Classic IT-Grundschutz under BSI Standard 200-2 distinguishes three methodologies that differ in depth, scope and certifiability. BSI Standard 300-1 no longer describes these variants; for certification under classic IT-Grundschutz they remain decisive until 2031:
Basic Protection (Basis-Absicherung)
A fast entry with baseline security measures across the whole organisation. Covers only the basic requirements of the relevant IT-Grundschutz building blocks. Suitable as a first step or for organisations with limited resources. IT-Grundschutz certification is not possible on this basis.
Core Protection (Kern-Absicherung)
Focused on the particularly worth-protecting business processes and assets, the so-called crown jewels. Full implementation depth (basic, standard and elevated requirements) within a deliberately bounded scope. Faster to deliver than standard protection and also certifiable (ISO 27001 on the basis of IT-Grundschutz).
Standard Protection (Standard-Absicherung)
Full IT-Grundschutz implementation for the entire organisation with all relevant building blocks and all requirement levels. The most demanding but also the most comprehensive methodology and, like core protection, a basis for the IT-Grundschutz certificate (ISO 27001 on the basis of IT-Grundschutz).
IT-Grundschutz Attestation and IT-Grundschutz Certificate
Evidence of IT-Grundschutz implementation can be provided in two ways — depending on the chosen methodology and the targeted maturity:
IT-Grundschutz Attestation
Low-threshold entry evidence on the basis of basic protection (Basis-Absicherungs-Testat). A BSI-certified IT-Grundschutz auditor checks the implementation of the basic requirements and confirms the level achieved, without full certification.
- Basic protection attestation
- Evidence of basic requirements
- BSI-certified auditor
- Faster to achieve than the certificate
IT-Grundschutz Certificate
The highest form of evidence of IT-Grundschutz implementation ("ISO 27001 on the basis of IT-Grundschutz"). Possible on the basis of core or standard protection; assessed by an auditor certified by the BSI. For federal authorities and demanding KRITIS evidence requirements, the certificate is the sought-after standard.
- Core or standard protection
- BSI-certified auditor
- Regular recertification
- Recognised for federal authorities & KRITIS
IT-Grundschutz or ISO 27001 — which framework fits?
Both frameworks address information security management but with different approaches and for different target groups:
| Criterion | BSI IT-Grundschutz | ISO 27001 |
|---|---|---|
| Approach | Catalogue-based, prescriptive | Risk-based, flexible |
| Target group | Authorities, KRITIS, public sector | International, private sector |
| Measures | Prescribed (building blocks) | Self-selected from Annex A |
| Evidence | Attestation or BSI certificate | ISO 27001 certificate (accredited) |
| Entry path | Structured path prescribed | Flexible, requires more own work |
| Combination | Complementary use possible | Complementary use possible |
Many organisations combine the two frameworks: ISO 27001 provides the internationally recognised certification basis; the IT-Grundschutz building blocks deliver the technical depth for specific system classes. We help you make this decision based on your concrete regulatory obligations and strategic goals.
ISMS build and external information security officer for the official nora emergency app
nora is Germany’s official emergency call app — a safety-critical application in the area of public services of general interest with the highest demands on availability, confidentiality and regulatory conformance.
Blackfort Technology built the complete ISMS in line with BSI IT-Grundschutz for nora, supported the subsequent certification and provided the external information security officer for the duration of the project. The engagement included the selection and implementation of relevant IT-Grundschutz building blocks, production of the complete security documentation, preparation for the external audit and the operational leadership of the information security function in a highly sensitive, publicly exposed environment.
The project stands as an example of how we work: technical IT-Grundschutz competence, regulatory understanding and the ability to take operational responsibility in complex, publicly visible programmes.
Our services around BSI IT-Grundschutz
Grundschutz++: decision and migration
Decision paper for top management on framework and timing, comparison of an existing ISMS with BSI Standard 300-1 using the BSI mapping tables, a risk method that meets the 35 minimum criteria, and the switch at your next recertification cycle.
Gap analysis and maturity assessment
Structured assessment of current security posture against the relevant IT-Grundschutz building blocks. Identification of gaps, prioritisation by risk and derivation of a realistic implementation plan.
Scoping and methodology selection
Substantiated decision support on the choice between basic, core and standard protection and on the definition of a sensible, certifiable scope. This decision shapes the entire project.
Building-block selection, documentation and implementation support
Selection and implementation of the relevant IT-Grundschutz building blocks, production of the complete security documentation (security concept, policies, risk analyses) and support for the technical and organisational measures.
Certification preparation and audit support
Preparation for the external IT-Grundschutz audit, conduct of internal pre-audits, alignment with the auditor and specialist support during the certification assessment.
External Information Security Officer (ISO/CISO)
Taking on the ISO/CISO function on a temporary basis — from the project phase through to permanent operation. We ensure continuity of the information security function even when internal resources are missing or being built up.
→ External Information Security OfficerImplement BSI IT-Grundschutz in a structured way — with an experienced partner
Blackfort Technology supports authorities, KRITIS operators and public-sector-adjacent organisations through the build and certification under BSI IT-Grundschutz. From the initial assessment to successful certification, and where required with an external information security officer throughout the engagement.
Frequently asked questions about BSI IT-Grundschutz
What is BSI IT-Grundschutz?
BSI IT-Grundschutz is an information security framework developed by the German Federal Office for Information Security (BSI). Unlike ISO 27001, which is risk-based, IT-Grundschutz provides a detailed catalogue – the IT-Grundschutz Compendium – with specific requirements and security measures for concrete system classes, processes and infrastructures. It is mandatory for German federal authorities; for many critical infrastructure (KRITIS) operators and public-sector-adjacent organisations it is the de-facto standard.
What is the difference between IT-Grundschutz and ISO 27001?
ISO 27001 is risk-based and international: it defines what an ISMS must achieve but leaves the concrete measures open. BSI IT-Grundschutz is prescriptive and catalogue-based: it specifies concrete requirements for individual building blocks (e.g. Windows servers, WLAN, cloud usage). ISO 27001 suits internationally operating organisations; IT-Grundschutz is the preferred choice for authorities, KRITIS operators and organisations with a strong German nexus. Both frameworks can be combined: ISO 27001 as the certification basis, IT-Grundschutz for technical depth.
Which methodologies does BSI IT-Grundschutz define?
The BSI distinguishes three methodologies: Basic Protection (Basis-Absicherung) offers a fast entry with baseline security measures; for it the BSI offers an attestation (Testat) but no certification. Core Protection (Kern-Absicherung) focuses on particularly critical business processes and assets ("crown jewels"). Standard Protection (Standard-Absicherung) is the full implementation of all IT-Grundschutz requirements across the organisation. Certification "ISO 27001 on the basis of IT-Grundschutz" is possible on the basis of both core and standard protection.
What is the difference between IT-Grundschutz Attestation and IT-Grundschutz Certificate?
For basic protection, the BSI offers an attestation (Basis-Absicherungs-Testat), issued by a BSI-certified IT-Grundschutz auditor, which confirms implementation of the basic requirements. It is the low-threshold entry evidence and does not amount to full certification. The IT-Grundschutz certificate ("ISO 27001 on the basis of IT-Grundschutz") is the higher form of evidence: it is possible on the basis of both core and standard protection, is assessed by an auditor certified by the BSI and must be renewed regularly. The certificate is the formal evidence for federal authorities and demanding KRITIS requirements.
How long does it take to introduce BSI IT-Grundschutz?
That depends substantially on the starting position, chosen scope and methodology. Core protection for a limited scope is realistically achievable in 6–12 months. A full standard protection with subsequent certification typically takes 12–24 months – depending on organisational size, IT complexity and available internal resources. Realistic project planning at the outset is decisive for project success.
What is Grundschutz++?
Grundschutz++ is the next generation of IT-Grundschutz. The methodology is set out in BSI Standard 300-1 (version 1.0 of 20 October 2026), and the requirements are published in machine-readable form in the user catalogue of the BSI state-of-the-art library. Protection needs are determined per business process, an own risk assessment is mandatory in three cases only, and automated checks are accepted as evidence. From 1 January 2027, organisations can apply for ISO 27001 certification on the basis of Grundschutz++.
Does an existing IT-Grundschutz ISMS have to switch to Grundschutz++ now?
Not immediately. According to the BSI milestone plan, classic IT-Grundschutz remains certifiable until 30 November 2031. In our view, there is a lot to be said for planning the switch with the next recertification cycle. Organisations building a new ISMS that will be certified in 2027 or later should start directly under BSI Standard 300-1.
Certification path
Key facts
Related topics
IT-Grundschutz consulting
From gap analysis through to certification — with proven project experience from the public sector.
Request nowKontakt aufnehmen
Bereit für den nächsten Schritt?
Sprechen Sie mit uns über Ihre Sicherheitsanforderungen – konkret, ohne Verpflichtung und auf Augenhöhe.