02 / Compliance and certification
IT-Grundschutz, module by module, without drowning in the compendium
We help you model your information domain against the BSI's IT-Grundschutz, check what is in place and close the gaps, whether you aim for certification or a solid baseline.
Overview
What IT-Grundschutz is
IT-Grundschutz is the methodology of the German Federal Office for Information Security (BSI). It consists of the BSI standards, which describe how to build an information security management system and how to apply the method, and the IT-Grundschutz Compendium, a library of modules with requirements for typical processes, applications, systems and rooms.
The work follows a clear path: define the information domain, analyse its structure, determine protection needs, model it with the right modules, and run the IT-Grundschutz check to see which requirements are met. Where protection needs are high or a module does not fit, a risk analysis fills the gap. The BSI describes different levels of protection, so an organisation can start with a basic level and build up.
An ISO 27001 certification on the basis of IT-Grundschutz is issued by the BSI itself, after an audit by an auditor certified by the BSI. Black Fox does not issue it. We help with the modelling, the check and closing the gaps, and support you during the audit.
Who it is for
German public bodies and their service providers, operators who are asked to follow IT-Grundschutz by a customer or a supervisory authority, and organisations that want an ISO 27001 certification on the basis of IT-Grundschutz rather than a native ISO/IEC 27001 certificate.
The work, from scoping to evidence.
What we do
Information domain and structure analysis
We define the scope and record business processes, applications, IT systems, networks and rooms in a structure that can be modelled.
Protection needs
Protection needs for confidentiality, integrity and availability, determined with the process owners and inherited down to the systems that carry them.
Modelling
Each target object mapped to the modules of the IT-Grundschutz Compendium that apply, with reasons where a module is left out.
IT-Grundschutz check
A requirement-by-requirement review of what is implemented, partly implemented or missing, with interviews and evidence.
Risk analysis
Where protection needs are high or modules do not cover a target, a risk analysis along the lines of the BSI method.
Gap closure
Policies, procedures and technical measures to close the gaps, including hardening of the systems concerned.
How the engagement runs
Kickoff
We agree the information domain, the level of protection you are aiming for, the people involved and the deadline, and sign an NDA first if you need one.
Structure analysis and protection needs
Workshops with your owners, ending in a documented structure and agreed protection needs.
Modelling and check
We model the domain and run the IT-Grundschutz check, ending in a prioritised implementation plan.
Gap closure
We work with your teams on documents, measures and evidence.
Audit preparation
If you aim for certification, we coordinate the audit by a BSI-certified auditor, help you prepare for it and help with any findings that follow.
What you receive
- Definition of the information domain and structure analysis
- Protection needs assessment
- Modelling of the domain against the compendium
- IT-Grundschutz check results
- Risk analysis where required
- Prioritised implementation plan
Questions
Who issues the certificate?
The BSI. An ISO 27001 certification on the basis of IT-Grundschutz is granted by the BSI after an audit by an auditor certified by the BSI. Black Fox prepares you, coordinates the audit and supports you during it.
How is this different from a native ISO/IEC 27001 certification?
Both rest on an ISMS. With IT-Grundschutz, the controls come from the modules of the compendium instead of your own selection from Annex A, and the method prescribes how you model and check your environment. That is more detailed work, and also more guidance.
Do we have to implement the whole compendium?
No. You model your information domain with the modules that apply to it, and the requirements depend on the level of protection you choose and on your protection needs.
Can you work in German?
Yes. The team works in English, German and French, and the BSI material and your documentation can stay in German.
Related services
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Governance and riskPolicies and proceduresBlack Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language.
Find out what the compendium means for your systems
Tell us about your information domain and your goal. We will show you which modules apply and where the gaps are.