At a glance
- Both frameworks are recognised and meet the requirements of NIS2 – NIS2 does not prescribe certification.
- ISO/IEC 27001 is known internationally, risk-based and leaves a lot of room for design.
- BSI IT-Grundschutz (the German Federal Office for Information Security's baseline protection methodology) is more detailed, provides specific requirements for each module and is widespread in the public sector.
- A certification “ISO 27001 on the basis of IT-Grundschutz” combines both.
The two frameworks compared
| ISO/IEC 27001 | BSI IT-Grundschutz | |
|---|---|---|
| Origin | International standard (current edition 2022) | BSI methodology: standards 200-1, 200-2, 200-3 and the IT-Grundschutz Compendium |
| Approach | Risk-based: you assess risks and select suitable measures from the 93 controls in Annex A | Module-based: predefined requirements exist for typical components; risk analysis only where protection needs are elevated |
| Level of detail | What is to be achieved – the how is up to you | Very specific, including technical detail |
| Getting started | Scope can be chosen freely | Levels: basic, core and standard protection |
| Certification | By accredited certification bodies | “ISO 27001 on the basis of IT-Grundschutz” by the BSI |
| Prevalence | Worldwide, in industry, with clients abroad | Public administration, critical infrastructure (KRITIS), public-sector contractors |
When ISO 27001 fits
- Your clients are international or explicitly require an ISO certificate.
- You want to start lean and extend the scope step by step.
- Your IT is more bespoke than “off the shelf” – predefined modules would be a poor fit.
- You already have other ISO management systems, such as ISO 9001, and want to integrate them.
When IT-Grundschutz fits
- You work for the public sector or are yourself an authority or municipal company.
- You prefer specific requirements to selecting your own measures – this saves conceptual work.
- Auditors or supervisors expect the BSI methodology.
- You want to reach a minimum level quickly with basic protection and build on it later.
And NIS2?
NIS2 requires effective risk management with minimum measures, but no particular standard. Both frameworks cover the requirements. What matters is that the ISMS is actually lived: with clear roles, up-to-date risks, rehearsed emergency plans and evidence that stands up to an audit. How to find out whether NIS2 applies to you is explained in the article NIS2: Is my company in scope?
How we introduce an ISMS
- Scope and objectivesWhich sites, processes and systems are covered? What level is appropriate?
- Current-state assessmentStructure analysis or inventory, protection needs, existing measures and gaps.
- Risks and measuresRisk analysis or IT-Grundschutz check, resulting in a prioritised implementation plan.
- OrganisationRoles, policies, training, emergency and reporting processes – matched to the size of the company.
- Operation and improvementInternal audits, management review, ongoing adjustment – with us as a managed service if you wish.
We have introduced ISMS under both frameworks for clients – and combine them where it saves effort.
Frequently asked questions
How long does it take to set up an ISMS?
That depends on the scope and the starting level. With a clear focus and the backing of senior management, a working ISMS can be achieved within a few months; readiness for certification usually takes longer.
Can we switch from IT-Grundschutz to ISO 27001 later?
Yes. An IT-Grundschutz ISMS largely meets the requirements of ISO 27001; switching or dual certification is possible with manageable effort.
What is CyberFundamentals (CyFun)?
A framework from the Centre for Cybersecurity Belgium with tiered security levels. In Belgium it is recognised as an evidence framework for NIS2 and is a pragmatic starting point – also in combination with ISO 27001.
Note: This article provides a professional overview (as of October 2026) and does not constitute legal advice. For a binding assessment of your company, we are happy to work with your legal advisers.
Related service