While ISO 27001 describes what a management system must achieve, IT-Grundschutz additionally provides concrete requirements for typical systems and workflows. It is especially common in the German public sector and among companies working with the federal government.
The BSI standards
Standard 200-1 describes the information security management system, 200-2 the IT-Grundschutz methodology, 200-3 risk analysis and 200-4 business continuity management. Together they form the methodological framework.
Compendium and modules
The IT-Grundschutz Compendium contains modules for servers, clients, networks, cloud use, organisation and personnel, among others. Each module describes threats and requirements, implemented according to protection needs.
Three approaches
Basic protection is an entry point with the most important requirements, core protection secures particularly critical areas, and standard protection covers the whole organisation. Based on standard protection, ISO 27001 certification on the basis of IT-Grundschutz is possible.
Relevance for NIS2
For entities under Germany’s NIS2 implementation act, IT-Grundschutz is a recognised way to implement the required risk management in a structured manner, but not the only one. Which method fits depends on customers and sector; see our offer on building an ISMS.