What is IT-Grundschutz?
IT-Grundschutz describes how an organisation builds its information security systematically, and supplies the requirements for it. Where ISO/IEC 27001 requires every control to be derived from the organisation's own risk assessment, users here rely on modules for which the BSI has already carried out the risk assessment for normal protection needs. The BSI provides the standards and the Kompendium free of charge.
| Component | Content |
|---|---|
| BSI Standard 200-1 | requirements for an information security management system (ISMS) |
| BSI Standard 200-2 (in German) | the IT-Grundschutz methodology: approaches, structure analysis, protection needs assessment, modelling, IT-Grundschutz check |
| BSI Standard 200-3 | risk analysis based on IT-Grundschutz |
| BSI Standard 200-4 | business continuity management |
| IT-Grundschutz Kompendium (in German) | modules in ten layers, from applications (APP) to security management (ISMS); each module names threats and requirements. Edition 2023, available since 1 February 2023 |
Which approach fits: basic, core or standard protection?
BSI Standard 200-2 offers three entry points. Management decides which area is protected with which approach and documents the decision and the schedule (ch. 3.3.5).
| Approach | What is protected | Choose it when | ISO 27001 certification based on IT-Grundschutz |
|---|---|---|---|
| Basic protection (Basis-Absicherung) | the entire information domain, initially with the basic requirements only | your information security is at an early stage, the target level is normal and no asset's loss would threaten the organisation's existence | not possible; an entry point for one of the other approaches |
| Core protection (Kern-Absicherung) | a few particularly critical areas (crown jewels) in full | only a manageable, clearly delimitable part of your business processes has a markedly increased protection need | possible in principle for the delimited information domain |
| Standard protection (Standard-Absicherung) | the entire information domain in full | you need an even, comparable level or a certificate for the whole organisation | intended |
Under BSI Standard 200-2, basic and core protection are entry points; the medium-term aim must be a security concept under standard protection, which the BSI prefers. If a customer requires a certificate for the whole organisation, the route leads to standard protection in any case. What a customer means by "IT-Grundschutz" and how the route differs from ISO 27001 is covered in ISO 27001 vs BSI IT-Grundschutz.
Which requirements apply, and when is a risk analysis needed?
Each module divides its requirements into basic requirements, standard requirements and requirements for increased protection needs. Under BSI Standard 200-2, basic and standard requirements together represent the state of the art and must be met for certification.
You determine the protection need of each target object for confidentiality, integrity and availability in the categories "normal", "high" and "very high". BSI Standard 200-2 requires an explicit risk analysis under BSI Standard 200-3 in cases including where a target object
- has a high or very high protection need in at least one of these,
- cannot be adequately modelled with the modules, or
- runs in an atypical scenario.
How is the BSI developing IT-Grundschutz?
The BSI is rebuilding IT-Grundschutz, which the BSI also calls IT-Grundschutz++ (as of October 2026). According to the BSI's IT-Grundschutz page (in German):
- A digital ruleset in JSON format replaces the text-based Kompendium; each requirement is recorded as a machine-readable rule.
- The basic, standard and increased-protection levels are replaced by flexible performance figures with dynamic thresholds.
- The checklists from the "Weg in die Basis-Absicherung" (WiBA, the path to basic protection) become a fixed part.
- The current IT-Grundschutz is maintained in parallel and remains applicable during a multi-year transition; an update of the Kompendium is planned.
You do not need to wait. Edition 2023 modules remain applicable during the transition, and the structure analysis and protection needs assessment describe your information domain whatever form the requirements later take.
For whom is IT-Grundschutz binding?
For federal administration bodies: under § 44(1) of the BSI Act (BSIG), their minimum requirements follow from the BSI standards, the Kompendium and the federal minimum standards. The Act prescribes no particular methodology for companies, NIS2 entities included; IT-Grundschutz becomes binding for them when a contract or customer requires it. How to build an ISMS by either route is described in the guide ISMS implementation.