BSI Standard 200-2 describes three IT-Grundschutz implementation approaches: Basic Protection (Basis-Absicherung), Standard Protection (Standard-Absicherung), and Core Protection (Kern-Absicherung). They differ in scope and depth. They are not three certification levels. [1, 2]
Basic Protection can be independently assessed for an attestation (Testat). Standard and Core Protection can support ISO 27001 certification based on IT-Grundschutz, subject to the requirements of the BSI certification scheme. This guide explains the differences and how to choose an approach. [3, 4]
What BSI IT-Grundschutz covers
IT-Grundschutz is the methodology and supporting guidance from Germany’s Federal Office for Information Security (BSI) for establishing and maintaining information security. It addresses organizational, personnel, physical, and technical safeguards, extending beyond endpoint security.
BSI Standard 200-1 defines requirements for an information security management system (ISMS). Standard 200-2 explains the implementation methodology, Standard 200-3 covers risk analysis, and Standard 200-4 addresses business continuity management. The IT-Grundschutz Compendium supplies modules containing security requirements. [1, 5]
An information domain (Informationsverbund) is the defined area being considered, including its processes, information, people, systems, and supporting infrastructure. It may cover an entire organization or a clearly bounded part. Scope matters when describing what an attestation or certificate actually covers. [1]
The three approaches at a glance
| Approach | Scope and purpose | Requirements | External recognition |
| Basic Protection | Broad baseline across the defined information domain | Applicable Basic requirements | Testat issued by a BSI-certified IT-Grundschutz auditor; no ISO 27001 certificate on this basis alone |
| Standard Protection | Comprehensive protection across the defined information domain | Applicable Basic and Standard requirements, with additional safeguards where risk analysis requires them | ISO 27001 certification based on IT-Grundschutz is possible |
| Core Protection | Priority protection for especially critical processes and assets, including dependencies | Applicable Basic and Standard requirements, with additional safeguards based on risk analysis | ISO 27001 certification based on IT-Grundschutz is possible for the defined scope |
Sources: BSI methodology, certification, attestation, and requirements guidance. [1, 2, 3, 4, 6]
Basic Protection
Basis-Absicherung provides an initial baseline by implementing the applicable Basic requirements across the selected information domain. It is useful when an organization needs to address fundamental gaps before undertaking a more comprehensive approach. Plan how to progress to Standard or Core Protection as security needs and resources require. [7]
A Basic Protection Testat is available after document review and an on-site assessment. A BSI-certified IT-Grundschutz auditor issues it under the BSI assessment scheme. BSI’s certification body does not issue the attestation. Basic Protection alone does not qualify for ISO 27001 certification based on IT-Grundschutz. [3, 4]
Standard Protection
Standard-Absicherung provides comprehensive protection for the selected information domain. It includes a structured security process, assessment of protection needs, selection of applicable Compendium modules, an IT-Grundschutz check, and risk analysis where required. It addresses both Basic and Standard requirements. [1, 6]
The scope can cover the whole organization or a defined part. A certificate for one information domain should not be presented as evidence that every service, location, or business unit is certified. [1, 3]
Core Protection
Kern-Absicherung prioritizes the information and processes most important to the organization. Include the people, systems, infrastructure, and external dependencies needed to protect those processes. A smaller scope can still involve substantial work. [1, 2]
Core Protection includes the applicable Basic and Standard requirements, with risk analysis informing additional safeguards. It does not automatically represent a higher maturity level than Standard Protection. Its distinguishing feature is the concentrated scope and priority given to critical assets. [2, 6]
How certification works
For either Standard or Core Protection, ISO 27001 certification based on IT-Grundschutz requires an audit by a BSI-certified ISO 27001 IT-Grundschutz auditor. The audit report is submitted to BSI, which reviews it and makes the certification decision. Applying the methodology or passing an internal assessment does not by itself result in certification. [3]
Confirm the accepted audit basis, scope, required evidence, and application process before scheduling the audit. Also confirm whether a customer or tender requires ordinary ISO/IEC 27001 certification or specifically ISO 27001 certification based on IT-Grundschutz.
How to choose the right approach
Use the following scenarios as planning examples rather than estimates of cost or duration.
- Establishing a baseline: an organization with inconsistent security practices starts with Basic Protection across its defined information domain and plans further improvement.
- Comprehensive implementation: an organization wants a complete security process for its defined scope, potentially including BSI certification, and selects Standard Protection.
- Protecting critical processes first: an organization prioritizes essential services through Core Protection, with an explicit plan for dependencies and risks outside that initial scope.
Select the approach based on protection needs, existing controls, available resources, and the assurance customers or other stakeholders require. Neither Basic nor Core Protection is a mandatory preliminary stage before Standard Protection. [1, 2]
Operational readiness checklist
- Assign management responsibility, an information security owner, and resources for implementation and ongoing review.
- Define the information domain, its boundaries, interfaces, and intended certification scope.
- Identify critical information and processes, and inventory supporting systems, applications, services, and owners.
- Select the applicable Compendium modules and document how requirements will be assessed for the chosen approach.
- Record existing controls, gaps, decisions, and actions with accountable owners and target dates.
- For Standard or Core Protection, complete the required protection-needs assessment and risk analysis steps.
- Establish repeatable patching, access management, backup and restoration testing, and vulnerability-remediation procedures.
- Keep evidence that controls operate over time, such as patch records, restore-test results, access reviews, and exception approvals.
- If seeking external recognition, confirm the current assessment scheme and evidence requirements with a qualified auditor.
How NinjaOne can support endpoint operations
NinjaOne can support endpoint visibility, patch deployment, monitoring, and automated IT tasks for internal IT teams and MSPs. These capabilities can help teams implement selected operational controls and maintain records for review across distributed environments. Map the capabilities you use to your security concept and the systems in scope. [8]
An endpoint management platform supports part of the security program. Certification also depends on governance, people, physical security, risk decisions, and evidence across the defined scope. Software alone cannot provide or guarantee certification.
Planning for Grundschutz modernization
BSI is developing Grundschutz++ with an updated methodology and machine-readable requirements. This article explains the three approaches in BSI Standard 200-2. For a new implementation or certification project, check BSI’s current Grundschutz++ guidance and the applicable certification rules before selecting the audit basis and timetable. Do not assume that a proposed transition date automatically extends an existing certificate. [9]
