IT-Grundschutz · BSI standards · certification to ISO 27001

IT-Grundschutz — information security to BSI methodology, documented so it can be audited

We build your ISMS to BSI IT-Grundschutz — with the structure analysis, the protection requirements assessment, modelling against the Compendium, the IT-Grundschutz check and the risk analysis to BSI standard 200-3.

  • Full service 12,000 – 39,900 € depending on company size
  • 8–14 months to being ready for certification
  • Recognised by federal, state and local government
  • ISO 27001 certificate on the basis of IT-Grundschutz
  • 30 minutes assessment
Book an IT-Grundschutz assessment Start the IT-Grundschutz check
notivia since 2003· +50 ISMS clients*· +20 Full-service projects*· ISO 27001, NIS-2 & IT-Grundschutz in one platform· ★★★★★5.0

* Audit success relates to completed full-service certification projects since 2019.

Quick check

This page is for you if …

  • … you belong to public administration or work for it.
  • … your clients require IT-Grundschutz rather than ISO 27001 .
  • … you need a an ISO 27001 certificate on the basis of IT-Grundschutz .
  • … you want to prepare for concrete requirements rather than abstract controls.
  • … you want to know what certification costs and how long it takes.
Our services for IT-Grundschutz

Four building blocks. One route to compliance.

BSI IT-Grundschutz — methodically sound, documented for audit, ready for certification.

Maximum support

Full-service support

We take you through the full procedure under BSI standard 200-2 — from the structure analysis through modelling and the IT-Grundschutz check to the risk analysis and certification preparation.

This suits you if you want IT-Grundschutz with as little internal project load as possible.
  • Structure analysis & protection requirements
  • Modelling against the Compendium
  • The IT-Grundschutz check
  • Risk analysis to 200-3
from €12,000 one-off · M from 24,000 € · L from 39,900 € for one bounded information domain · plus the certification audit · all prices exclude VAT
Request a quote
Ongoing

Ongoing IT-Grundschutz support

We keep your information domain current: working in new Compendium modules, updating the protection requirements, maintaining implementation status and preparing the annual review.

This suits you if the information domain has to stay current all year — not just for the audit.
  • Compendium updates
  • Updating the protection requirements
  • Maintaining implementation status
  • Preparing the surveillance audit
from €950 / month
Enquire about ongoing support
12-month minimum term · 3 months' notice
One-off / yearly

Internal IT-Grundschutz review

We review your information domain against the Compendium modules, your evidence and the requirements of BSI standards 200-1 to 200-3.

This suits you if you want to know where you stand before the certification audit.
  • A review against the Compendium
  • Completeness of the modelling
  • Evidence mapping
  • A report with an action plan
from €3,500 one-off
Enquire about an audit
Self-service

Build it yourself

Build IT-Grundschutz yourself — the ISMS platform takes you through the requirements step by step.

  • The guide shows the next step
  • AI produces your documents
  • 800+ templates to build on
  • Support can be added at any time
from€249/ month · cancellable monthly
See the self-service option

Additionally for IT-Grundschutz

Standard-specific extras — bookable individually

Risk analysis to 200-3

Assessing the elementary threats and deriving measures where protection needs are high.

from €3,900

Business continuity to 200-4

Building business continuity to BSI standard 200-4 — the tiered model from reactive to standard.

from €5,900

Combined review with ISO 27001

One internal review for both — saves around 40 % of the effort.

from €4,500
Ongoing IT-Grundschutz support: 12-month minimum term · 3 months' notice to the end of the month · all prices exclude VAT.
Free initial assessment

Information security to IT-Grundschutz — clarity in 30 minutes

The BSI methodology: what has to be done, who it pays off for, and what it costs.

Lead consultant
Lead consultant
Your contact
  • A quick answer
  • Realistic figures for time and cost
  • No sales pressure, no obligation
  • From notivia GmbH, Stuttgart — since 2019
think why NETFORMIC Animus Intelligence Crest Digital Veoma VERDURE
Book directly — the quickest way
Pick a 30-minute slot yourself
or send us a message

    No spam·No obligation·A quick answer·GDPR-compliant
    Prefer to call? +49 711 35 15 705
    Start on your own

    Two tools — ready to use right now

    Before you get in touch: work out the cost and explore the platform — free and without obligation.

    Free IT-Grundschutz check · 3 min

    How far along is your information security?

    10 questions on organisation, documentation, technical measures and evidence. Rate your maturity in 3 minutes.

    Start the check

    Or do it yourself

    The ISMS platform with its IT-Grundschutz module

    The multi-standard ISMS covers the structure analysis, the protection requirements, the modelling and the implementation status — made for teams that want to maintain IT-Grundschutz in a structured way.

    Explore the platform
    Guide · PDF

    IT-Grundschutz guide for security officers

    What the BSI standards require, how modelling works, how certification runs — explained plainly.

    Download the guide
    The standard in brief

    What has to be in place for ISO 27001?

    Eight steps — the procedure set out in BSI standard 200-2.

    1. The security policy and the security organisation
    2. Structure analysis of the information domain
    3. Protection requirements assessment (normal / high / very high)
    4. Modelling against the IT-Grundschutz Compendium
    5. The IT-Grundschutz check (target versus actual)
    6. Risk analysis to BSI standard 200-3
    7. Implementation planning and implementation
    8. Internal audit and certification preparation

    In the initial call we show you which points you already meet.

    Book a free initial assessment
    WHO IS IT FOR?

    Who needs IT-Grundschutz?

    IT-Grundschutz is the recognised methodology for information security in the German public sector — and increasingly wherever public bodies are the customer.

    Public administration

    Federal, state and local government use IT-Grundschutz as their governing standard. For many public bodies it is mandatory.

    KRITIS operators

    For operators of critical infrastructure, IT-Grundschutz is an established way of evidencing security to the BSI — with more concrete requirements than ISO 27001 alone.

    Public-sector service providers

    IT service providers, data centres and software houses working for public bodies have to meet their customers' standard.

    METHODOLOGY

    The layers of the IT-Grundschutz Compendium

    The Compendium arranges around 100 modules in ten layers. Each module sets out concrete requirements — not abstract objectives.

    ISMS

    Security management

    Building and running the information security management system.

    ORP

    Organisation & personnel

    Responsibilities, HR processes, awareness and permissions.

    CON

    Concepts & procedures

    The cryptography concept, data protection, deletion, software development, protection requirements.

    OPS

    Operation

    IT operations, outsourcing, patch and change management, logging.

    DER

    Detection & response

    Detecting incidents, handling them, forensics and contingency planning.

    APP

    Applications

    Office software, directory services, web applications, email, databases.

    SYS

    IT systems

    Servers, clients, mobile devices, virtual environments, printers.

    IND

    Industrial IT

    ICS, control systems, programmable logic controllers, sensors.

    NET

    Networks & communication

    Network architecture, firewalls, Wi-Fi, remote access and VPN.

    INF

    Infrastructure

    Buildings, rooms, data centres, cabling and utilities.

    APPROACHES

    The three approaches

    IT-Grundschutz offers three routes — you do not have to secure everything at once.

    B

    Basic protection

    The quick way in: only the basic requirements of every relevant module. Not certifiable, but effective immediately.

    K

    Core protection

    Full protection for the crown jewels: a small, particularly valuable part of the domain.

    S

    Standard protection

    The complete route across the whole information domain — the prerequisite for certification.

    Z

    Certification

    ISO 27001 on the basis of IT-Grundschutz: a BSI certificate, issued after an audit by certified auditors.

    THE CENTRAL MODULES

    Where almost every domain starts

    These Compendium modules apply to practically every organisation.

    ISMS.1 security management

    The policy, roles, resources and the regular review by management.

    ORP.1 organisation

    Setting responsibilities, making the rules known, documenting exceptions.

    ORP.4 identity management

    Granting permissions, reviewing them and reliably withdrawing them when someone leaves.

    CON.3 backup

    The backup concept, retention and restore tests — demonstrably rehearsed.

    OPS.1.1.5 logging

    What is logged, how long it is kept, who evaluates it.

    OPS.1.1.3 patch management

    Assessing, testing, applying and documenting updates.

    DER.2.1 incident handling

    Reporting routes, assessment, containment and follow-up for security incidents.

    SYS.1.1 general server

    Hardening, access, logging and a secure baseline configuration.

    NET.1.1 network architecture

    Segmentation, the zone concept and securing the boundaries.

    OVERLAP

    ISO 27001 and IT-Grundschutz — one certificate

    IT-Grundschutz does not replace ISO 27001, it makes it concrete. Follow the standard protection route and you end up with an ISO 27001 certificate on the basis of IT-Grundschutz — issued by the BSI. The difference is the method: ISO 27001 says what has to be achieved; the Compendium also says how. If you already run an ISO 27001 ISMS you bring most of the management system requirements with you and mainly add the modelling.

    IT-GrundschutzISO 27001
    BSI 200-1 Managementsystem Cl. 4–10 ISMS requirements
    Structure analysis Cl. 4.3 scope
    Protection requirements assessment Cl. 6.1 risk assessment
    The IT-Grundschutz check Cl. 9.1 monitoring & measurement
    Modelling Annex A / Statement of Applicability
    BSI 200-3 Risikoanalyse Cl. 6.1.3 risk treatment
    around 70 %
    overlap in the management system requirements — the modelling comes on top
    OUR SOLUTION

    Implementing IT-Grundschutz with iso-easy

    1

    Record the domain

    Recording every object in the information domain: applications, systems, rooms, networks.

    2

    Protection requirements & modelling

    Establishing the protection requirements and assigning the matching Compendium modules.

    3

    The Grundschutz check

    A target-versus-actual comparison for each requirement, documenting implementation status and closing the gaps.

    4

    Certification

    The risk analysis, the internal audit and support through to the BSI certificate.

    Structure analysis Protection requirements Modelling The Grundschutz check Risk analysis 200-3 BSI certificate

    Or do it yourself

    The ISMS platform for IT-Grundschutz — and 10 further standards

    Digitalise the structure analysis, the protection requirements, the modelling and the implementation status in a multi-standard ISMS. With an AI copilot, templates and the audit guide — made for teams with internal resources that want to keep the domain current.

    • Multi-standard ISMS
    • AI copilot & templates
    • Audit guide
    • Cancellable monthly

    from €249

    / month · Starter with 1 standard

    Explore the platform
    FAQ

    Frequently asked questions about IT-Grundschutz

    What is IT-Grundschutz?
    IT-Grundschutz is the methodology of the German Federal Office for Information Security (BSI) for building an information security management system. It consists of BSI standards 200-1 to 200-4 and the IT-Grundschutz Compendium with around 100 modules and well over 1,000 concrete requirements.
    What is the difference from ISO 27001?
    ISO 27001 describes what an ISMS has to achieve and leaves the how to you. IT-Grundschutz additionally supplies concrete measures for every module — from server hardening to physical access control. That takes many decisions off your hands, but it asks for more documentation.
    Do I get a certificate of its own?
    You receive an ISO 27001 certificate on the basis of IT-Grundschutz, issued by the BSI. It connects internationally and counts in the German public sector as the stronger evidence, because the audit goes deeper.
    What is modelling?
    In modelling you assign the matching Compendium modules to every object in your information domain — SYS.1.1 and SYS.2.2.3 to a Windows server, for example. The result is your own catalogue of requirements. This assignment is the step that ISO 27001 does not have.
    Do I have to go straight to standard protection?
    No. Basic protection covers only the basic requirements to start with and is far quicker to implement — but it cannot be certified. Core protection secures the most important assets specifically. For certification you need standard protection across the whole domain.
    How large may the information domain be?
    You define the domain yourself — but it has to be sensibly bounded and able to function on its own. Too large a domain drives effort and duration up considerably. In practice many start with a clearly delimited area and extend it later.
    What does BSI standard 200-3 require?
    The risk analysis under 200-3 becomes due for objects with high or very high protection needs, for objects with no matching module and for unusual deployment scenarios. You work with the catalogue of elementary threats and derive additional measures.
    How much internal work does this mean for us?
    For a mid-sized domain, reckon on 40–60 person-days on your side. The largest block is the structure analysis, because it has to pull knowledge together from IT, the business departments and facilities. That is exactly where the platform takes the most off your hands.
    How long does certification take?
    With our support, typically 8–14 months for a mid-sized domain. If you already run an ISO 27001 ISMS that shortens markedly, because the policy, the roles and the management review are already in place.
    Does IT-Grundschutz suit companies with no public-sector link?
    Yes, but the question is whether it pays. If your clients ask for ISO 27001, the direct route is usually more economical. If you have public-sector customers or operate critical infrastructure, IT-Grundschutz is often the better choice — and sometimes the only one accepted.