Framework
BSI IT-Grundschutz
Information security according to the BSI methodology, step by step: from choosing the approach through structure analysis and the IT-Grundschutz check to certification and the switch to Grundschutz++.
What is IT-Grundschutz?
IT-Grundschutz is the method of the German Federal Office for Information Security (BSI) for building an information security management system. BSI Standards 200-1 to 200-3 describe the procedure, the IT-Grundschutz Compendium (Edition 2023) contains the requirements. The successor to the Compendium is Grundschutz++, which can be certified from 1 January 2027.
Content as of:
Does it apply to me?
For companies, IT-Grundschutz is voluntary. It is suitable for organisations of any size that want to build information security according to a proven method, aim for certification according to ISO 27001 on the basis of IT-Grundschutz or want to meet the risk management obligations under Section 30 BSIG in a structured way.
For federal administration entities, IT-Grundschutz and the BSI minimum standards are binding minimum requirements. Complass explains the method in its own words and refers to chapters and identifiers; you will find the wording of the Edition 2023 requirements in the free BSI Compendium.
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Legal basis
- BSI-Standard 200-2IT-Grundschutz methodology
- BSI-Standard 200-3Risk analysis on the basis of IT-Grundschutz
- § 30 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗Risk management measures of essential and important entities
- § 44 BSIG§ 44 BSIG Vorgaben des Bundesamtes(1) Die Einrichtungen der Bundesverwaltung müssen Mindestanforderungen zum Schutz der in der Bundesverwaltung verarbeiteten Informationen erfüllen. Die Mindestanforderungen ergeben sich aus den BSI-Standards und dem Grundschutzkompendium (IT-Grundschutz) sowie aus den Mindeststandards für die Sicherheit in der Informationstechnik des Bundes (Mindeststandards) in den jeweils geltenden Fassungen. Die jeweils geltenden …Open original (gesetze-im-internet.de) ↗Minimum requirements of the federal administration from IT-Grundschutz and minimum standards
Key dates
- IT-Grundschutz Compendium Edition 2023 available (replaces Edition 2022) · BSI, IT-Grundschutz Compendium
- Publication of the Grundschutz++ methodology at it-sa 2026 · BSI, Grundschutz++ milestone plan
- Grundschutz++ can be certified (ISO 27001 on the basis of Grundschutz++) · BSI, Grundschutz++ milestone plan
- End of certifiability of classic IT-Grundschutz · BSI, Grundschutz++ milestone plan
There are no statutory deadlines for companies to introduce IT-Grundschutz. The dates above concern the switch to Grundschutz++ according to the BSI milestone plan; you enter audit dates in the project plan.
How Complass helps
Ten phases according to BSI Standard 200-2
Initiation with choice of approach, organisation, structure analysis, protection requirements, modelling, IT-Grundschutz check, risk analysis, implementation, improvement as well as certification and switch; each step shows what applies to Basic and Core Protection.
Edition 2023 and Grundschutz++
The requirements of Edition 2023 with identifier, level and our own short description, and the Grundschutz++ user catalogue in the original wording, each with status and evidence.
Templates following the reference documents
Including policy, definition of the approach, structure analysis, protection requirements assessment, modelling, risk analysis with the elementary threats, implementation plan and overview of reference documents A.0 to A.6.
Modelling and check per target object
Target objects from the asset inventory, single or as a group, protection requirements by the maximum principle, module proposals, the IT-Grundschutz check per target object as a guided flow and the implementation plan; you export reference documents A.3, A.4 and A.6 as Excel and PDF.
Linked to assets and risks
Structure analysis and protection requirements in the asset inventory, risk analysis with the template according to BSI Standard 200-3, shared controls with ISO 27001 and NIS2.
The phases in the module
- Initiating the security process
- Organising the security process
- Structure analysis
- Protection requirement assessment
- Modelling
- IT-Grundschutz check
- Risk analysis according to BSI Standard 200-3
- Implementing the security concept
- Maintenance and continual improvement
- Certification and switch to Grundschutz++
Catalogue: IT-Grundschutz Compendium 2023 – ISMS Security Management, ORP Organisation and Personnel
Matching modules
Compliance management
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreAsset management
IT and OT assets in one place, agentless capture, with SBOM, vendor advisories, end of support, licence reconciliation, identities, relationships and zones per IEC 62443-3-2.
Learn moreRisk management
Risk register with qualitative or quantitative assessment, risk appetite and treatment plan, linked to assets, vulnerabilities and incidents.
Learn moreFrequently asked questions
Does Complass certify according to IT-Grundschutz?
No. The certification body for ISO 27001 on the basis of IT-Grundschutz is the BSI; the audit is carried out by an auditor certified by the BSI. Complass prepares you with templates, catalogues and evidence.
Are the texts of the IT-Grundschutz Compendium included?
No. For Edition 2023, Complass contains identifiers, levels and its own short descriptions; you read the wording in the free BSI Compendium. The BSI publishes the Grundschutz++ requirements under the CC BY-SA 4.0 licence; they are included in the original wording.
Should we still start with Edition 2023?
If you want to be certified soon, you can do so on the basis of classic IT-Grundschutz until 30 November 2031. If you only want to be certified in 2027 or later, it is best to plan directly with Grundschutz++; structure analysis, protection requirements and risk analysis remain usable in both cases.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.