IT-Grundschutz (the BSI baseline protection approach) has existed for decades and is one of the best-known foundations for information security in German-speaking countries. The approach: instead of analyzing every threat individually, it specifies proven requirements for typical modules such as servers, clients, email or the data center. A separate risk analysis is only needed where protection requirements are higher or no module fits.
What does IT-Grundschutz consist of?
- BSI Standard 200-1: management systems for information security, that is, building and operating an ISMS.
- BSI Standard 200-2: the IT-Grundschutz methodology itself.
- BSI Standard 200-3: risk management for areas with increased protection requirements, see IT risk analysis.
- BSI Standard 200-4: business continuity management.
- IT-Grundschutz Compendium: The 2023 edition contains 111 modules with requirements, grouped into areas such as organization, operations, applications, systems and networks.
Basic, standard and core protection
Standard 200-2 defines three approaches. Basic protection is an entry point that implements the most important requirements broadly. Core protection first protects the particularly important business processes and assets. Standard protection is the complete approach and, according to the BSI, compatible with certification under ISO/IEC 27001. Such an ISO 27001 certificate based on IT-Grundschutz requires an audit by an auditor recognized by the BSI. It is valid for three years with annual surveillance audits.
Grundschutz++: the modernization
The BSI is rebuilding the method under the name Grundschutz++: fully process-oriented and with a machine-readable set of rules intended to replace the previous Compendium. According to the BSI timeline from October 2026, Grundschutz++ is to be published on October 27, 2026, and become certifiable from January 1, 2027. Certifications under the previous IT-Grundschutz remain possible until November 30, 2031.
Practice for SMEs and municipalities in Austria
IT-Grundschutz is a German method, but it is also used in Austria as a practical working aid. For the Austrian context, there is also the Austrian Information Security Handbook (Österreichisches Informationssicherheitshandbuch). A-SIT updates it on behalf of the Federal Chancellery, and it is aligned with the ISO/IEC 27000 series. For municipalities, the BSI has published WiBA, the "path to basic protection" (Weg in die Basis-Absicherung): checklists with test questions that give a first overview without in-depth knowledge of the method. Austrian municipalities can use them for orientation. If you fall under NIS2, you can use requirements from the Compendium as concrete measures. The NIS2 applicability check clarifies which obligations apply.
Risks and limits
- Scope: Full standard protection is a lot of work for small organizations. Start with basic or core protection.
- Translating it to your own operations: Modules do not always fit exactly. Deviations must be justified.
- Transition phase: Structure and tools change with Grundschutz++. New projects should plan for the switch from the start.
How TOMORIS relates
EXPERTS Strategy & Consulting translates goals, risks and budget into a prioritized roadmap. EXPERTS Cyber Security implements the technical requirements.