IT-Grundschutz Software
for your ISMS

IT-Grundschutz is the methodology of the German Federal Office for Information Security (BSI) for setting up and running an information security management system (ISMS). It consists of the BSI standards — 200-1 for the management system, 200-2 for the methodology, 200-3 for risk analysis — and the IT-Grundschutz Compendium, whose modules describe, in ten layers, the requirements and the elementary threats for each topic.

IT-Grundschutz software is ISMS software that maps the methodology of the BSI in one data model: information domain, target objects, protection needs, modules, requirements, risks, measures and evidence are linked to each other. Instead of keeping spreadsheets and documents consistent by hand, you maintain every object once, and reports such as the reference documents are generated from the data.

A suitable choice is an IT-Grundschutz tool that brings the IT-Grundschutz Compendium along as a catalogue and maps every step of the methodology according to BSI-Standard 200-2. Complaica is such a tool: structure analysis, protection needs determination, modelling, IT-Grundschutz Check, risk analysis and implementation planning work on one data set, as SaaS or On-Premises.

All steps according to BSI-Standard 200-2: defining the information domain (Informationsverbund), the structure analysis (Strukturanalyse), the protection needs determination (Schutzbedarfsfeststellung), modelling (Modellierung) with the modules (Bausteine) of the Compendium, the IT-Grundschutz Check, the risk analysis (Risikoanalyse) according to BSI-Standard 200-3, implementation planning (Realisierungsplanung), and maintenance, audit and continual improvement. Every step works on the results of the previous one, in one data set.

Yes. Complaica implements the BSI standards 200-1 (Information Security Management Systems), 200-2 (IT-Grundschutz Methodology) and 200-3 (Risk Analysis based on IT-Grundschutz). The steps of the methodology and the risk analysis are mapped as workflows in the software, and the IT-Grundschutz Compendium is included as a catalogue.

Yes. BSI-Standard 200-2 knows three approaches: Basic Protection is the entry into an ISMS, Core Protection first looks at a small, particularly important part of the information domain, and Standard Protection implements a complete security process. In Complaica, basic requirements, standard requirements and requirements for increased protection needs can be evaluated separately, so you can begin with one approach and extend later.

Target objects — business processes, applications, IT systems, networks, rooms — are recorded or imported from asset management, CMDBs and Microsoft Azure, combined into groups and linked along their dependencies. Dependency graph and dependency matrix show the structure of the information domain; the structure analysis is available as reference document A.1.

Protection needs are determined per target object for confidentiality, integrity and availability — normal, high or very high. Along the dependencies they are inherited by the maximum principle; the origin of every rating can be displayed.

In modelling, the matching modules of the IT-Grundschutz Compendium are assigned to the target objects. In the IT-Grundschutz Check, the target/actual comparison, you assess the implementation status of every requirement, justify it and store evidence. The status cumulates from the individual target object up to the information domain, and open requirements go into the implementation plan.

Yes. For target objects with high or very high protection needs, and for those that cannot be modelled adequately with the modules, threats are identified — from the elementary threats of the Compendium or from your own catalogues — and assessed in a configurable risk matrix. For every risk, the treatment option and measures are set; the residual risk can be tracked over time.

Yes. Structure analysis (A.1), protection needs determination (A.2), modelling (A.3), result of the IT-Grundschutz Check (A.4), risk analysis (A.5) and implementation plan (A.6) are generated as reports from the current data set — at the initial audit and before every surveillance audit, without rewriting the documents.

Yes. The IT-Grundschutz Compendium is included as a catalogue with its modules, requirements and elementary threats. When the BSI publishes a new edition or corrections, the catalogue is updated and provided as an update; existing assessments, measures and evidence are preserved.

Grundschutz++ is the BSI’s redevelopment of Grundschutz: a fully process-oriented framework whose requirements are available in a machine-readable format and can therefore be evaluated by tools. The Grundschutz++ user catalogue replaces the IT-Grundschutz Compendium.

Yes. Complaica is one of the first tools with support for BSI Grundschutz++. The requirements of Grundschutz++ are carried as a catalogue and assessed on the same data set as IT-Grundschutz.

The migration takes place on the existing data set: information domain, target objects, protection needs, risks, measures and evidence stay in place, and the requirements of Grundschutz++ are assessed on the same objects. During the transition both frameworks can be run in parallel. On request, our consultants accompany the migration.

According to the BSI’s milestone plan (as of September 2026), certification applications for ISO 27001 on the basis of Grundschutz++ can be submitted from 1 January 2027; the certifiability of IT-Grundschutz ends on 30 November 2031. The BSI adjusts the plan continuously — the version on the BSI’s website is the authoritative one.

ISO/IEC 27001 describes what an ISMS must achieve and leaves the design to the organisation. IT-Grundschutz adds a concrete methodology to that and, with the modules of the Compendium, detailed requirements. The two can be combined: Standard Protection is compatible with ISO 27001 certification, and the certificate is then called “ISO 27001 on the basis of IT-Grundschutz”. In Complaica both run on the same data set.

Yes. Complaica imports and exports data from and to Excel, over the REST API and from other ISMS tools; migrating your data is free and accompanied by our specialists. So you evaluate the tool on your own data set rather than on demo data.

Yes. ISO 27001, NIS2, TISAX, GDPR, ISO 22301 and further standards are assessed on the same model and use the same target objects, risks, measures and evidence. What is documented for IT-Grundschutz counts for the other standards too.

Yes, both. The SaaS variant is hosted in Germany; On-Premises you run Complaica in your own infrastructure. The licence costs the same either way.

Evidence sits on the object it proves, and the reference documents are generated from the current data set. Dashboards show the state before the audit, and external auditors can be given targeted access. Because the same data set keeps running, surveillance audits and recertification are prepared out of ongoing operation. The certification itself is performed by the BSI on the basis of the audit by a certified auditor.