BSI IT-Grundschutz

BSI Standard 200-1/2/3 + Compendium - baseline, standard, high protection requirements.


Short name	Grundschutz
Region	Europe
Country or scope	Germany
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Grundschutz

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for Grundschutz.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for Grundschutz and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`DE-BSI-200-2-SA` Structure Analysis Inventory	The Grundschutz methodology begins with a structure analysis capturing all applications, IT systems and their dependencies, so every software component must be inventoried (BSI-Standard 200-2, structure analysis phase)	Scan
`DE-BSI-200-3-ID` Risk Analysis Target Objects	Risk analysis requires unambiguously identified target objects so threats can be mapped to them, which means components need machine-resolvable identifiers (BSI-Standard 200-3)	Scan
`DE-BSI-OPS113` Patch and Change Management	Patch and change management requires knowing the exact version of every deployed software component so updates and security patches can be planned and verified (IT-Grundschutz Compendium module OPS.1.1.3 Patch- und Änderungsmanagement)	Scan
`DE-BSI-CON8` Secure Software Development Sourcing	Secure development requires that third-party and open-source components are obtained from trustworthy sources and their integrity verified, evidenced by cryptographic hashes (IT-Grundschutz Compendium module CON.8 Software-Entwicklung)	Scan
`DE-BSI-APP6` Software Approval and Documentation	General software use requires an approval process and documented software inventory, so components must be fully described with both name and version (IT-Grundschutz Compendium module APP.6 Allgemeine Software)	Scan
`DE-BSI-OPS2-OUT` Outsourcing and Supplier Control	When IT operation or development is outsourced, the responsible organisation must retain oversight of suppliers, which requires the supplier of each software component to be named (IT-Grundschutz Compendium outsourcing modules, OPS.2.x)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`BSI-200-1-ISMS`	Information Security Management System (Standard 200-1)
`BSI-200-2-Methodology`	IT-Grundschutz Methodology (Standard 200-2)
`BSI-200-3-RiskAnalysis`	Risk Analysis (Standard 200-3)
`BSI-ISMS-Module`	ISMS Compendium Module
`BSI-ORP-Module`	Organisation and Personnel (ORP Module)
`BSI-CON-Module`	Concepts and Procedures (CON Module)
`BSI-OPS-Module`	Operations (OPS Module)
`BSI-NET-Module`	Networks and Communications (NET Module)
`BSI-SYS-Module`	IT Systems (SYS Module)
`BSI-APP-Module`	Applications (APP Module)
`BSI-IND-Module`	Industrial IT (IND Module)
`BSI-ProtectionNeeds`	Protection Needs Assessment

Policy templates

Written for Grundschutz:

BSI Grundschutz Information Security Manual

And 22 from the standard set, adapted to Grundschutz.