[{"data":1,"prerenderedAt":428},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/bsi-it-grundschutz-microsoft-365-posts_en":51,"/en/blog/bsi-it-grundschutz-microsoft-365-surround-posts_en":417},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":379,"description":380,"extension":381,"faq":382,"howto":392,"image":409,"meta":411,"navigation":412,"path":413,"seo":414,"stem":415,"__hash__":416},"posts_en/en/3.blog/11.bsi-it-grundschutz-microsoft-365.md","BSI IT-Grundschutz, Simply Explained – and How Open Source Helps",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","https://snowblue.de/about",{"src":59},"/michael.webp",{"label":61},"Guide",{"type":63,"value":64,"toc":367},"minimark",[65,69,82,87,90,106,109,113,173,176,180,186,190,193,225,229,232,250,253,257,264,320,323,327,330,344,347,351,360],[66,67,53],"h1",{"id":68},"bsi-it-grundschutz-simply-explained-and-how-open-source-helps",[70,71,72,73,77,78,81],"p",{},"Germany's ",[74,75,76],"strong",{},"Federal Office for Information Security (BSI)"," created ",[74,79,80],{},"IT-Grundschutz",", a proven guide to information security. Public authorities work with it, many companies use it as a reference – and there are plenty of good ideas in it for small businesses too. Here's a friendly overview.",[83,84,86],"h2",{"id":85},"what-is-it-grundschutz","What is IT-Grundschutz?",[70,88,89],{},"IT-Grundschutz is a method for building up information security step by step. It has two parts:",[91,92,93,100],"ul",{},[94,95,96,99],"li",{},[74,97,98],{},"BSI standards"," (for example 200-1, 200-2 and 200-3): They describe the approach – how to set up security management and assess risks.",[94,101,102,105],{},[74,103,104],{},"IT-Grundschutz Compendium:"," A collection of \"modules\" for typical topics, such as backups, cloud use, servers, office workplaces or emergency planning.",[70,107,108],{},"Each module describes what to pay attention to. The nice thing: the texts are practical and freely available from the BSI.",[83,110,112],{"id":111},"a-few-example-modules","A few example modules",[114,115,116,129],"table",{},[117,118,119],"thead",{},[120,121,122,126],"tr",{},[123,124,125],"th",{},"Module",[123,127,128],{},"What it's about",[130,131,132,143,153,163],"tbody",{},[120,133,134,140],{},[135,136,137],"td",{},[74,138,139],{},"CON.3 Backup concept",[135,141,142],{},"How is data backed up, and does restoring work?",[120,144,145,150],{},[135,146,147],{},[74,148,149],{},"OPS.2.2 Cloud usage",[135,151,152],{},"What to look out for when choosing and using cloud services",[120,154,155,160],{},[135,156,157],{},[74,158,159],{},"ORP.4 Identity and access management",[135,161,162],{},"Who is allowed to access what?",[120,164,165,170],{},[135,166,167],{},[74,168,169],{},"DER.4 Business continuity management",[135,171,172],{},"What happens if something fails?",[70,174,175],{},"The cloud module in particular covers questions every business can ask itself: Where is the data? How do you get it back if you want to switch providers? Is there a plan for an outage?",[83,177,179],{"id":178},"and-what-is-c5","And what is C5?",[70,181,182,185],{},[74,183,184],{},"C5"," stands for \"Cloud Computing Compliance Criteria Catalogue\". It's a BSI criteria catalogue specifically for cloud providers. Many providers have themselves audited against it. A C5 attestation is a helpful factor when choosing a cloud service – but it doesn't replace your own thinking about which data you want to keep where.",[83,187,189],{"id":188},"how-open-source-helps-with-grundschutz","How open source helps with Grundschutz",[70,191,192],{},"IT-Grundschutz doesn't prescribe specific software. But open source can make many requirements pleasantly simple:",[91,194,195,201,207,213,219],{},[94,196,197,200],{},[74,198,199],{},"Backups:"," You decide how and where data is backed up.",[94,202,203,206],{},[74,204,205],{},"Location:"," You choose the data centre or run the server on your own premises.",[94,208,209,212],{},[74,210,211],{},"Ability to switch:"," Open formats and standards make a later move easier.",[94,214,215,218],{},[74,216,217],{},"Transparency:"," The code is open, and settings are easy to document.",[94,220,221,224],{},[74,222,223],{},"Permissions:"," Tools like Keycloak let you manage logins centrally and clearly.",[83,226,228],{"id":227},"for-small-businesses-keep-it-practical","For small businesses: keep it practical",[70,230,231],{},"Nobody needs to aim for certification straight away. For small businesses, it's usually enough to put the most important basic ideas into practice:",[233,234,235,238,241,244,247],"ol",{},[94,236,237],{},"Know which data and systems you have",[94,239,240],{},"Protect logins with two-factor authentication",[94,242,243],{},"Install updates regularly",[94,245,246],{},"Make backups and test them",[94,248,249],{},"Write down a small emergency plan",[70,251,252],{},"The BSI also offers starter materials specifically for smaller organisations.",[83,254,256],{"id":255},"briefly-explained-protection-needs","Briefly explained: protection needs",[70,258,259,260,263],{},"A central idea in IT-Grundschutz is ",[74,261,262],{},"protection needs",". For each type of data, you ask yourself three things:",[114,265,266,279],{},[117,267,268],{},[120,269,270,273,276],{},[123,271,272],{},"Protection goal",[123,274,275],{},"Question",[123,277,278],{},"Example",[130,280,281,294,307],{},[120,282,283,288,291],{},[135,284,285],{},[74,286,287],{},"Confidentiality",[135,289,290],{},"How bad would it be if unauthorised people saw the data?",[135,292,293],{},"Patient records, client data",[120,295,296,301,304],{},[135,297,298],{},[74,299,300],{},"Integrity",[135,302,303],{},"How bad would it be if the data were changed unnoticed?",[135,305,306],{},"Invoices, contracts",[120,308,309,314,317],{},[135,310,311],{},[74,312,313],{},"Availability",[135,315,316],{},"How bad would it be if the data were unavailable for a while?",[135,318,319],{},"Appointment calendar, email",[70,321,322],{},"Depending on the answers, you speak of normal, high or very high protection needs. That determines which measures make sense. A family calendar needs something different from a tax office.",[83,324,326],{"id":325},"an-example-from-a-small-office","An example from a small office",[70,328,329],{},"An architecture office with eight people goes through the basic ideas. It finds that plans and contracts have high protection needs for integrity and availability, and customer data for confidentiality. A few clear steps follow:",[233,331,332,335,338,341],{},[94,333,334],{},"Daily, encrypted backups of the project folders, with a copy in a second location.",[94,336,337],{},"Two-factor login for all accounts.",[94,339,340],{},"A password manager for the whole team.",[94,342,343],{},"A one-page emergency plan with the most important contacts.",[70,345,346],{},"The project data lives in a Nextcloud in a German data centre. Backups, updates and access are documented so that even a stand-in during holidays can keep track.",[83,348,350],{"id":349},"conclusion","Conclusion",[70,352,353,354,359],{},"IT-Grundschutz is a helpful compass for better security. With open-source tools where you control location, backups and access yourself, many requirements can be implemented well and understandably. As an external information security officer, I'm happy to support you – more under ",[355,356,358],"a",{"href":357},"/en/consulting","Consulting",".",[70,361,362,363,359],{},"If you'd like to give it a try, I'm happy to help – ",[355,364,366],{"href":365},"/en/contact","just drop me a line",{"title":368,"searchDepth":369,"depth":369,"links":370},"",2,[371,372,373,374,375,376,377,378],{"id":85,"depth":369,"text":86},{"id":111,"depth":369,"text":112},{"id":178,"depth":369,"text":179},{"id":188,"depth":369,"text":189},{"id":227,"depth":369,"text":228},{"id":255,"depth":369,"text":256},{"id":325,"depth":369,"text":326},{"id":349,"depth":369,"text":350},"2026-05-20T00:00:00.000Z","The BSI's IT-Grundschutz is a proven guide to information security. What it's about and what small businesses can take from it.","md",[383,386,389],{"q":384,"a":385},"Do I have to implement IT-Grundschutz as a small business?","Usually there's no obligation. But IT-Grundschutz is a very good guide to orient yourself by. The BSI also offers simplified starter materials for small businesses.",{"q":387,"a":388},"What's the difference between IT-Grundschutz and C5?","IT-Grundschutz describes how an organisation builds up its information security overall. C5 is a BSI criteria catalogue specifically for cloud providers. It helps you assess the security of a cloud service.",{"q":390,"a":391},"Is open source automatically more secure?","Not automatically. Security mainly depends on good setup, updates and backups. But open source has the advantage that the code can be openly reviewed and you decide where the software runs.",{"name":393,"description":394,"totalTime":395,"steps":396},"Starting small with IT-Grundschutz","A simplified introduction to the Grundschutz method for small businesses.","P4W",[397,400,403,406],{"name":398,"text":399},"Take stock","List all devices, programs, online services and rooms that deal with your data.",{"name":401,"text":402},"Assess protection needs","For each type of data, think about how bad loss, downtime or unauthorised access would be.",{"name":404,"text":405},"Choose suitable measures","Use the Grundschutz modules to pick suitable measures, for example for backups or cloud use.",{"name":407,"text":408},"Implement and review","Put the measures in place, document them briefly and review them regularly.",{"src":410},"/img/blog/photo-1518770660439-4636190af475.webp",{},true,"/en/blog/bsi-it-grundschutz-microsoft-365",{"title":53,"description":380},"en/3.blog/11.bsi-it-grundschutz-microsoft-365","wuVsTE-RRXLxbaAezh8_OQfoyGqdP62x3jMkLBsjR7U",[418,423],{"title":419,"path":420,"stem":421,"description":422,"children":-1},"NIS2 and GDPR, Calmly Explained – What Small Businesses Should Know","/en/blog/nis2-gdpr-microsoft-paradox","en/3.blog/10.nis2-gdpr-microsoft-paradox","NIS2 and GDPR sound like a lot of paperwork. Here's a calm, clear look at what they're about and how open source helps you stay organised.",{"title":424,"path":425,"stem":426,"description":427,"children":-1},"AI Assistants at Work – How to Keep Track of Your Data","/en/blog/microsoft-copilot-flex-routing","en/3.blog/12.microsoft-copilot-flex-routing","Copilot and other AI assistants are handy. What to check in settings and data processing – and which open alternatives exist.",1792720368536]