Security & governance
BSI IT-Grundschutz
BSI IT-Grundschutz is the information security methodology published by the German Federal Office for Information Security (BSI). It combines a set of standards for building a security management system with a compendium of modules that state concrete requirements for processes, applications, systems, networks and buildings.
How is IT-Grundschutz organized?
The method has two parts. The BSI standards describe how to run security as a management process: 200-1 covers the management system, 200-2 the Grundschutz methodology, 200-3 risk analysis and 200-4 business continuity management. The IT-Grundschutz Compendium then supplies the requirements. Its current edition, Edition 2023, groups modules into ten layers.
| Layer | Scope |
|---|---|
| ISMS | Security management |
| ORP | Organization and personnel |
| CON | Concepts and procedures, including the backup concept |
| OPS | Operations |
| DER | Detection and response |
| APP | Applications |
| SYS | IT systems, including servers and storage |
| IND | Industrial IT |
| NET | Networks and communication |
| INF | Infrastructure and buildings |
What does IT-Grundschutz say about backup?
Backup has its own module, CON.3, which sets out how an institution builds a backup concept and which requirements it has to meet. The idea is that backup is a documented concept, not a product setting: which data is in scope, how often it is saved, where copies are kept, who may restore, and how restores are tested. Storage systems are also addressed in the SYS layer, and recovery after an incident in the DER layer.
Who uses IT-Grundschutz?
German federal authorities use it as their baseline, and it is common across the wider public sector, in regulated industries and among KRITIS operators. An organization can be certified to ISO/IEC 27001 on the basis of IT-Grundschutz, which is why the method appears in German tenders as an alternative to a native ISO certificate. Suppliers are often asked to map product features to specific modules.
What is Grundschutz++?
The BSI has published the next generation of the method, Grundschutz++, as BSI Standard 300-1. It differs from the existing method mainly through a process-oriented approach built on the plan-do-check-act cycle, and all requirements are available in a machine-readable format. According to the published information, a management system implemented under Grundschutz++ can be certified from 2027 and is compatible with ISO/IEC 27001. Organizations working from Edition 2023 should plan for a transition.
Frequently asked questions
Is IT-Grundschutz mandatory?
It is the baseline for German federal authorities. For most companies it is voluntary, but customers, regulators and tenders frequently require it or accept it as proof.
Which IT-Grundschutz module covers backup?
Module CON.3 covers the backup concept. It belongs to the CON layer on concepts and procedures.
Is IT-Grundschutz the same as ISO 27001?
No, but they are compatible. IT-Grundschutz is more prescriptive, and certification to ISO/IEC 27001 can be obtained on the basis of IT-Grundschutz.
Related terms
- KRITIS: German critical infrastructure rules.
- GoBD: German rules for electronic records.
- Business continuity: the subject of BSI Standard 200-4.
- Disaster recovery plan: the recovery side of the backup concept.
- SOC report: another form of third-party assurance.