It is rarely either-or: both lead to an information security management system (ISMS), and certification to ISO 27001 on the basis of IT-Grundschutz combines them. This guide compares approach, certification and effort and shows how to combine both. Standards and BSI documents are paraphrased in our own words, and the example is invented.
Two routes to the same goal
ISO/IEC 27001:2022 is an international standard. It sets out what an ISMS must achieve: context and scope, leadership, risk assessment and risk treatment, operation, evaluation and improvement. Which controls you implement follows from your own risk assessment. Annex A with its 93 controls is a cross-check against blind spots, not a mandatory catalog. You record the result in the Statement of Applicability.
IT-Grundschutz is the method of the German Federal Office for Information Security (BSI). BSI Standards 200-1 to 200-3 describe the procedure, and the IT-Grundschutz Compendium (Edition 2023) provides the requirements: 111 modules in ten layers, from ISMS and personnel through applications and IT systems to industrial IT (IND) and infrastructure. For normal protection requirements, the BSI already assessed the threats when it wrote the modules. You need your own risk analysis under BSI Standard 200-3 where protection requirements are high or very high, or where no module fits.
In short: ISO 27001 asks "Which risks do you have, and how do you treat them?" IT-Grundschutz says "For this kind of system, these requirements apply. Check whether you meet them."
The differences at a glance
| Criterion | ISO/IEC 27001 | BSI IT-Grundschutz |
|---|---|---|
| Approach | Risk-based: controls from your own risk assessment | Module-based: requirements per target object, risk analysis for elevated protection requirements |
| Requirements | Requirements for the management system, Annex A as a cross-check | Concrete requirements at three levels: basic, standard, elevated protection requirements |
| Entry | One route, extent set by the scope | Basic, Core or Standard Protection |
| Certification | Accredited certification body, in Germany accredited by DAkkS | ISO 27001 on the basis of IT-Grundschutz, the BSI is the certification body, audits by BSI-certified auditors |
| Validity | Three years, annual surveillance audits | Three years, annual surveillance audits |
| Evidence | Mandatory documents of the standard, Statement of Applicability | Fixed reference documents A.0 to A.6, such as structure analysis, modeling, IT-Grundschutz Check, implementation plan |
| Recognition | Widespread internationally | Mainly in Germany and the public sector |
| Access | Standard must be purchased | Standards and Compendium free of charge from the BSI |
Certification: two certificates, one standard
For native ISO 27001, you choose an accredited certification body. It checks readiness in the stage 1 audit and effectiveness in the stage 2 audit. Our guide to ISO 27001 certification walks you through the process.
For ISO 27001 on the basis of IT-Grundschutz, the BSI itself is the certification body. An auditor certified by the BSI reviews the reference documents, audits on site and writes an audit report. The BSI reviews the report and decides on the certificate. It confirms that your information domain meets the requirements of ISO/IEC 27001 and of IT-Grundschutz.
The prerequisite is Standard Protection, or Core Protection for a clearly bounded area. Basic Protection is not enough for a certificate. For Basic Protection the BSI offers an attestation, which is also issued by an auditor certified by the BSI.
Effort: where it arises
There are no flat figures. Effort depends on the scope and on where you stand today, and it arises in different places.
- ISO 27001: You think more for yourself. Risk method, risk assessment and the choice of controls are up to you. That gives freedom and keeps documentation lean, but it takes experience for the assessment to hold up.
- IT-Grundschutz: You check more. Edition 2023 has 1,834 active requirements, and modeling selects only the ones that apply to you. Structure analysis, protection requirements assessment and the check per target object are thorough and documentation-heavy, but you derive little on your own.
- Entry in stages: With Basic and Core Protection, IT-Grundschutz allows a smaller start. Both are interim steps. Standard Protection is meant to follow in the medium term.
Grundschutz++: what changes
The BSI is replacing the Compendium with Grundschutz++, whose methodology has been available as BSI Standard 300-1 since October 2026: about 1,000 solution-neutral requirements in 20 practices, machine-readable and with the protection levels "normal" and "elevated" instead of the previous levels. According to the BSI milestone plan (as of October 2026), Grundschutz++ can be certified from 1 January 2027. Certification on the basis of classic IT-Grundschutz remains possible until 30 November 2031. If you are starting out and only want to be certified in 2027 or later, it is best to plan directly with Grundschutz++.
What the law requires
§ 30 BSIG (German BSI Act) obliges essential and important entities to take risk management measures and lists the topics they must cover at a minimum. The act does not prescribe a particular method for companies. Both routes work if you explicitly map every number of § 30(2) BSIG. For German federal administration bodies, however, IT-Grundschutz is mandatory: under § 44 BSIG, their minimum requirements follow from the BSI Standards, the Compendium and the minimum standards. Neither route automatically covers reporting duties or registration.
Decision guide
| Your situation | Obvious route |
|---|---|
| Customers abroad ask for a certificate | ISO 27001, native or on the basis of IT-Grundschutz if your customers know the BSI certificate |
| German federal administration body | IT-Grundschutz (§ 44 BSIG) |
| Public-sector clients in Germany ask for the BSI method | IT-Grundschutz, ISO 27001 on the basis of IT-Grundschutz |
| Little experience with risk assessment, preference for concrete requirements | IT-Grundschutz, starting with Basic or Core Protection |
| Lean ISMS with your own choice of controls | ISO 27001 |
| Only a few crown jewels matter, such as design data | Core Protection, extended later |
| NIS2 duties under § 30 BSIG | Either, with a mapping to § 30(2) BSIG |
Combining both
Many companies do not have to commit to one:
- ISO 27001 as the frame, modules as a source of controls. The standard leaves open where your controls come from. The Compendium modules, such as the IND modules for controllers and operator stations, are a good source for risk treatment.
- Grundschutz for the core, ISO 27001 for the whole. An area with high protection requirements follows the BSI method, and the company's ISMS follows ISO 27001.
- One certificate for both. Certification to ISO 27001 on the basis of IT-Grundschutz confirms both sets of requirements.
The key point: one control, one piece of evidence.
Example from mechanical engineering
The example is invented. A machine builder with 250 employees supplies car makers in several countries and also modernizes pumping stations for municipal utilities. The car makers ask for ISO 27001, and one utility asks for the BSI method.
- Decision: ISO 27001 as the ISMS for the whole company.
- Addition: For remote maintenance and control systems, the team uses the IND and NET modules as a source of controls.
- Evidence: The same control counts in both projects. The utility receives a mapping to the modules, and the car makers receive the certificate.
Checklist
- You know which customers and clients ask for which evidence.
- You have clarified whether § 30 or § 44 BSIG applies to you.
- The scope or information domain is set.
- You have decided whether your team would rather assess its own risks or check given requirements.
- For IT-Grundschutz, the approach is chosen: Basic, Core or Standard Protection.
- You have clarified whether your international customers know and accept a BSI certificate.
- Shared controls are maintained once and used for both frameworks.
IT-Grundschutz and ISO 27001 in Complass
Two frameworks in two spreadsheets mean double upkeep and two versions of the truth. In Complass both work together:
- Both methods guided: ISO 27001 from the project mandate to a certification-ready ISMS, IT-Grundschutz along BSI Standards 200-1 to 200-3 with Basic, Core or Standard Protection.
- Grundschutz per target object: target objects from the asset inventory, protection requirements by the maximum principle, module proposals, the IT-Grundschutz Check as a guided flow and the implementation plan. You export reference documents A.3, A.4 and A.6 as Excel and PDF.
- Document once: Shared controls count for several frameworks. A catalog entry can take its status and evidence from another project instead of copying them.
- Edition 2023 and Grundschutz++: identifiers and levels of Edition 2023 with our own short descriptions, and the Grundschutz++ user catalog in the original wording.
Frequently asked questions
Is a certificate on the basis of IT-Grundschutz an ISO 27001 certificate?
Yes. It confirms the requirements of ISO/IEC 27001 and, in addition, those of IT-Grundschutz. It is issued by the BSI, not by a private certification body. Whether a customer abroad accepts it in the same way as a certificate from an accredited body is best clarified with that customer beforehand.
Is IT-Grundschutz mandatory for companies?
No. For companies it is voluntary. It is mandatory for German federal administration bodies under § 44 BSIG. § 30 BSIG does not prescribe a particular method for companies.
Which route costs less?
There is no general answer. With ISO 27001, effort tends to arise in your own risk assessment, with IT-Grundschutz in structure analysis, modeling and the IT-Grundschutz Check. The BSI Standards and the Compendium are free of charge, while the ISO standard must be purchased.
Should we still start with Edition 2023 now?
If you want to be certified soon, the BSI milestone plan allows certification on the basis of classic IT-Grundschutz until 30 November 2031. If you only want to be certified in 2027 or later, it is best to plan directly with Grundschutz++.
Can we switch from one route to the other later?
Yes. Scope, inventory, protection requirements, risks and evidence are the foundation of both routes.
In a demo, we show you with the demo company how ISO 27001 and IT-Grundschutz run side by side with shared controls.
Request a demo Try it for 14 days
Read more
- Guide "ISO 27001 certification: process, timeline and effort"
- Guide "Defining the ISMS scope: steps and example"
- Guide "ISO 27001 and NIS2: where they overlap"
- Guide "Creating the ISO 27001 Statement of Applicability (SoA), with a template"
- BSI IT-Grundschutz in Complass
- ISO 27001 in Complass
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The current wording of the BSIG, the current versions of the BSI Standards, the Compendium and the BSI certification scheme, and your licensed edition of ISO/IEC 27001 are authoritative. As of November 2026.