Certify your ISMS to ISO 27001 based on IT-Grundschutz

The aim of the document review is to determine certification capability, the maturity of the management system, threats and risks, legal and regulatory aspects, and the site-specific conditions. This is a pure adequacy review of the management system. RSM Certification GmbH must be granted access to documents as part of the document review. Therefore, at least the following information must be provided in advance of the document review:

• Information security policies (A.0)
• Structure analysis (A.1)
• Protection needs assessment (A.2)
• Modelling of the information domain (A.3)
• Result of the IT-Grundschutz check (A.4)
• Risk analysis (A.5)
• Implementation plan (risk treatment plan) (A.6)

In accordance with the audit scheme, the auditor carries out an IT-Grundschutz check. This checks whether the modules used from the valid IT-Grundschutz Compendium match those in the modelling of the information domain.

The IT-Grundschutz Compendium is a collection of a wide range of requirements in so-called "modules" in the field of information security. It represents the structured and comprehensive possible requirements base for your ISMS if this is to be built according to IT-Grundschutz. The Compendium defines the so-called "modules" of the ISMS and their implementation requirements, with which the ISMS is modelled according to your organisation's activity and process environment. These modules cover different topics – for example: ISMS module: Security management; INF module: Infrastructure; NET module: Networks and communication. To implement an ISMS, taking into account the specifications from the Compendium, the organisation must draw on the modules (currently 10) and implement them in accordance with the respective requirements of each module. Figuratively speaking, the IT-Grundschutz Compendium is a kind of toolbox from which your organisation can select the appropriate tool according to its activities and core processes. Which modules are implemented depends, among other things, on the activity and core processes of your organisation. The selected modules of the Compendium form the audit basis for an audit to ISO 27001 based on IT-Grundschutz. The IT-Grundschutz Compendium is updated and published annually by the BSI.

Which standard is better suited to your organisation is a highly individual question and decision that you have to make yourself. To simplify things, however, you can orient yourself by your customer demographics and the demands of your industry. If you operate nationally and internationally, the recognition and acceptance of ISO/IEC 27001:2022 speak more in favour of this standard than of IT-Grundschutz. This is not intended to diminish IT-Grundschutz – however, it is not widely used beyond Germany's borders. If you operate purely nationally, a great deal depends on your industry and possibly also on your customer base. IT-Grundschutz enjoys a high reputation in Germany, although it is also known that meeting the requirements of IT-Grundschutz is generally more extensive than those of an ISO/IEC 27001 certification. This is due solely to the firmly defined requirements of IT-Grundschutz, whereas ISO/IEC 27001 leaves more scope to integrate the process into your existing process landscape. With regard to your customer base, it can be important to know what requirements your customers set. Some place greater emphasis on IT-Grundschutz certification than on ISO/IEC 27001 certification. If in doubt, this requires coordination on your part. The preference may also differ by industry; for example, in the public sector there is more of a need for an IT-Grundschutz certificate.

The first key difference lies in responsibility. The body in charge of the procedure for ISO 27001 based on IT-Grundschutz is the German Federal Office for Information Security (BSI). For ISO/IEC 27001:2022 audits by accredited conformity assessment bodies, DAkkS is the central accreditation body in Germany. Another key difference is the audit basis. Where this is ISO/IEC 27001:2022 in an ISO 27001 audit, for ISO 27001 based on IT-Grundschutz it is the IT-Grundschutz Compendium. IT-Grundschutz also goes deeper in terms of the requirements in information technology. In addition, in its respective modules, the BSI defines specific and more comprehensive requirements for your ISMS compared with ISO/IEC 27001. There are also various differences in the formal requirements. The BSI has its own prerequisites that must be met for audit team leaders. Audit team leaders certified by the BSI who carry out ISO 27001 audits based on IT-Grundschutz are listed on the BSI website. Auditors permitted to carry out ISO/IEC 27001 audits through RSM Certification GmbH are not automatically permitted to carry out IT-Grundschutz audits, and vice versa. The ISO 27001 audit based on IT-Grundschutz must also be officially applied for at the BSI, including a declaration of independence from the auditor(s). The applying organisation then receives an ID, which must be used in future communication with the BSI. For certification to ISO/IEC 27001:2022, no application to DAkkS is required; commissioning the certification body is sufficient to begin the certification process. The two procedures therefore differ fundamentally.