BSI basic protection, also known as “IT basic protection”, is a concept and methodology of the German Federal Office for Information Security (BSI). This approach aims to ensure information security in organizations, particularly with regard to the IT infrastructure. But what exactly is behind it, how can I get certified and how do I prepare for it? We answer these and other questions in this article.

BSI IT-Grundschutz is a voluntary security standard of the German Federal Office for Information Security. Similar to ISO 27001, it is dedicated to setting up an information security management system (ISMS) to control information security in organizations. It offers specific measures to protect IT systems with normal protection requirements. This generally saves companies from having to carry out their own risk analysis and enables them to use the BSI’s standard protection. The aim of the BSI is to offer companies and public institutions a simple and practical approach to improving cyber security. It is important to know: IT baseline protection is not mandatory. This is merely an aid to improving information security in companies and the provision of blanket standard measures. Also good to know: The topic of data protection as defined by the GDPR is not fully covered by IT baseline protection. The topic is touched on, but reference is then made to the requirements of the German data protection authorities.

As part of IT baseline protection, there are various BSI standards that you should familiarize yourself with. These define requirements for a management system and methods for its introduction. There are a total of four different standards:

There is also the IT baseline protection compendium. It contains specific measures for the security of your IT infrastructure. They are divided into 10 subject areas with a total of 113 modules. Companies must decide for themselves which modules are relevant to them.

The IT-Grundschutz profiles are also interesting. These are sample examples of the implementation of IT baseline protection using various application examples. So there is a suitable pattern for every company.

IT baseline protection distinguishes between three variants to protect your IT. With basic protection, a company fulfills the basic requirements in all IT areas. This means that IT security can be significantly improved quickly with certain measures. The BSI recommends standard protection. This means that a company can demonstrate comprehensive protection of its own IT systems. For core coverage, the standard requirements are only applied in certain areas. The focus here is on critical processes and systems. When determining protection requirements, it is also possible that increased protection requirements are identified. The IT baseline protection also contains requirements for this. Do you meet the standard or core requirements? Great, then you can take out basic protection certification. This is an ISO 27001 certification based on IT baseline protection. All framework data such as validity period etc. are therefore the same. You only receive your own certificate from the BSI for basic protection. It is valid for two years.

BSI IT-Grundschutz offers a practice-oriented methodology for setting up an information security management system that meets the requirements of ISO 27001. In terms of the basic ISMS requirements, ISO 27001 and IT-Grundschutz are therefore largely the same. However, as IT-Grundschutz is mainly known in Germany, an ISO certificate based on IT-Grundschutz may not be recognized internationally. The difference between ISO 27001 and IT baseline protection lies in their approach: The ISO standard is more abstract and focuses on general processes, while IT baseline protection offers users concrete steps for securing their IT through detailed measures from various building blocks. This difference is also reflected in the length of the standards: Compared to ISO 27001, BSI IT-Grundschutz is far more comprehensive.

Below we have briefly listed everything that needs to be done before certification:

The certification process is basically the same as for ISO 27001. After your company has submitted an application for certification, a remote audit takes place in which the submitted documents are reviewed. This includes: Guidelines for information security, structural analysis, protection needs assessment, modeling, IT baseline protection check, risk analysis and the measures implementation plan. Finally, a second audit takes place on site. The implementation of the safety measures is checked. The Federal Office receives the audit report and, in the best case, issues an ISO certificate based on IT baseline protection. Annual audits are then carried out for monitoring purposes.

Identity and access management plays a crucial role in IT baseline protection. There is even a separate module for this – ORP.4 Identity and authorization management. But the topic is also relevant in other modules. It is therefore worth taking a closer look at the secure management of accounts and access rights. ORP.4 in turn lists various requirements (ORP.4.A1 to ORP.4.A17) that companies must meet with regard to their authorization management. This includes, for example, deactivating inactive identifiers and ensuring that each identifier is uniquely assigned to a person. The BAYOOSOFT Access Manager helps you to fulfill these requirements. And the tool also saves you a lot of time and effort. It standardizes the routine tasks of user and authorization management and supports the provision of IT services such as mailboxes, software distribution or telephony. Not only individual tasks, but entire process chains are optimized, which means that the use of resources and error rates are far lower than with manual processing. Sounds exciting, but complicated? The BSI provides an online course on IT baseline protection. This makes it easier for you to get started.

You can find more information on the official website of the BSI.