ISO 27001 and BSI IT-Grundschutz: Organising information security

In short: Two sets of rules with which organisations plan, implement and review information security systematically; both work with a management system and risks.

In more detail: Security does not arise from a single tool but from regulated responsibility, processes and constant improvement. An ISMS (information security management system) defines what is protected, which risks exist and which measures apply. ISO/IEC 27001 and the BSI IT-Grundschutz are the best-known paths there.

In Depth

ISO/IEC 27001

The international standard describes the requirements for an ISMS. Core steps following the PDCA cycle (plan, do, check, act): define scope, carry out risk analysis, select suitable measures from Annex A (controls, for example access control, cryptography, supplier relationships), implement, carry out internal audits and management review. Companies can have themselves certified by independent bodies, which creates trust with customers.

BSI IT-Grundschutz

The Federal Office for Information Security offers an approach with standards (200-1 to 200-4) and the IT-Grundschutz Compendium with modules for typical areas (servers, networks, cloud, smartphones, applications). Each module has requirements (MUST, SHOULD) and threats. You create a structure analysis, determine the protection requirement (normal, high, very high) and implement the modules. Certification under ISO 27001 on the basis of IT-Grundschutz is possible.

Connection with law and practice

Laws such as NIS2, the BSI Act and the GDPR require appropriate security measures; standards help to prove this. Large customers demand evidence from service providers. For small businesses full certification would usually be oversized; the basic ideas (inventory, risks, access rights, backups, updates, emergency plan, training) are useful anyway.

Typical building blocks in everyday life

• Inventory: which devices, data and services exist?
• Roles and responsible persons (for example information security officers).
• Access rights by the principle of least privilege, password rules, multi-factor.
• Updates and patch management.
• Backups and emergency plan, practise restoring.
• Training of employees against phishing.
• Reporting channels for incidents.

See also: Protection goals of information security, BSI Act, Principle of least privilege, Quality management and PDCA