BSI IT-Grundschutz

IT-Grundschutz is the German Federal Office for Information Security's method for building an information security management system from documented building blocks rather than from scratch. You model your assets against the BSI catalogue, assess their protection needs and check each control. turingsecure holds the structure analysis, the assessment and the control status the method produces.

What the Method Requires

A Building-Block Model From Assets to Controls

IT-Grundschutz works in layers. The BSI Compendium groups requirements into building blocks for topics such as applications, IT systems, networks and physical infrastructure. You start with a structure analysis that records every asset in scope and the way those assets connect, then apply the building blocks that match each part of the model.

Next comes the protection-needs assessment, which rates the confidentiality, integrity and availability each asset requires as normal, high or very high. The Grundschutz check then compares the building-block requirements against what is actually in place and marks each control as fulfilled, partially fulfilled or open, which produces the gap list you work through.

IT-Grundschutz building-block model with structure analysis and protection needs

The Grundschutz Method

Four Stages, One Documented Model

Structure Analysis: Record every asset in scope and how they connect. turingsecure keeps the asset register the building blocks are applied against.
Protection Needs: Rate confidentiality, integrity and availability per asset as normal, high or very high, so effort follows the value at stake.
Grundschutz Check: Compare each building-block requirement against reality and mark it fulfilled, partial or open. The result is a tracked gap list.
Route to ISO 27001: IT-Grundschutz leads to an ISO 27001 certificate on the basis of IT-Grundschutz. Evidence stays linked to each control for the audit.