BSI IT-Grundschutz, Simply Explained – and How Open Source Helps

Germany's Federal Office for Information Security (BSI) created IT-Grundschutz, a proven guide to information security. Public authorities work with it, many companies use it as a reference – and there are plenty of good ideas in it for small businesses too. Here's a friendly overview.

What is IT-Grundschutz?

IT-Grundschutz is a method for building up information security step by step. It has two parts:

• BSI standards (for example 200-1, 200-2 and 200-3): They describe the approach – how to set up security management and assess risks.
• IT-Grundschutz Compendium: A collection of "modules" for typical topics, such as backups, cloud use, servers, office workplaces or emergency planning.

Each module describes what to pay attention to. The nice thing: the texts are practical and freely available from the BSI.

A few example modules

The cloud module in particular covers questions every business can ask itself: Where is the data? How do you get it back if you want to switch providers? Is there a plan for an outage?

And what is C5?

C5 stands for "Cloud Computing Compliance Criteria Catalogue". It's a BSI criteria catalogue specifically for cloud providers. Many providers have themselves audited against it. A C5 attestation is a helpful factor when choosing a cloud service – but it doesn't replace your own thinking about which data you want to keep where.

How open source helps with Grundschutz

IT-Grundschutz doesn't prescribe specific software. But open source can make many requirements pleasantly simple:

• Backups: You decide how and where data is backed up.
• Location: You choose the data centre or run the server on your own premises.
• Ability to switch: Open formats and standards make a later move easier.
• Transparency: The code is open, and settings are easy to document.
• Permissions: Tools like Keycloak let you manage logins centrally and clearly.

For small businesses: keep it practical

Nobody needs to aim for certification straight away. For small businesses, it's usually enough to put the most important basic ideas into practice:

1. Know which data and systems you have
2. Protect logins with two-factor authentication
3. Install updates regularly
4. Make backups and test them
5. Write down a small emergency plan

The BSI also offers starter materials specifically for smaller organisations.

Briefly explained: protection needs

A central idea in IT-Grundschutz is protection needs. For each type of data, you ask yourself three things:

Depending on the answers, you speak of normal, high or very high protection needs. That determines which measures make sense. A family calendar needs something different from a tax office.

An example from a small office

An architecture office with eight people goes through the basic ideas. It finds that plans and contracts have high protection needs for integrity and availability, and customer data for confidentiality. A few clear steps follow:

1. Daily, encrypted backups of the project folders, with a copy in a second location.
2. Two-factor login for all accounts.
3. A password manager for the whole team.
4. A one-page emergency plan with the most important contacts.

The project data lives in a Nextcloud in a German data centre. Backups, updates and access are documented so that even a stand-in during holidays can keep track.

Conclusion

IT-Grundschutz is a helpful compass for better security. With open-source tools where you control location, backups and access yourself, many requirements can be implemented well and understandably. As an external information security officer, I'm happy to support you – more under Consulting.

If you'd like to give it a try, I'm happy to help – just drop me a line.