BSI IT-Grundschutz

Get certified and keep it running

evoila guides German organizations through BSI IT-Grundschutz from gap analysis to certification, with the engineering depth to make the controls real.

Start your IT-Grundschutz journey


A standard that rewards experience

For public-sector organizations, KRITIS operators and many German enterprises, BSI IT-Grundschutz is the expected standard for information security. It is thorough and methodical, which is exactly why it becomes difficult for teams trying to handle it alone.

evoila has delivered IT-Grundschutz projects in demanding environments and brings both the BSI methodology and the technical capability to implement the measures properly. We help you scope the right information network, model the environment correctly and close the gaps in a way that stands up in certification.

We can also support ISO 27001 certification on the basis of IT-Grundschutz.

Business benefits:

  • A structured path through IT-Grundschutz, from scoping to certification
  • Controls that are technically implemented, not just documented
  • Deep fit for public sector, KRITIS and German enterprise requirements

IT-Grundschutz projects that stall usually fail in the same two places

Scoping that was never right, and documentation that looks complete until an auditor reviews it. Both can be avoided with the right experience on the project from the beginning.

The Challenge

What needs to be right from the start

IT-Grundschutz is comprehensive by design. The Grundschutz-Kompendium covers a broad set of modules, and modeling an information network correctly, selecting the right building blocks and producing audit-ready documentation takes method, experience and time.
Public-sector and KRITIS organizations often have to comply, but rarely have spare capacity with deep Grundschutz experience. The typical consequences are easy to recognize.

Scoping and modeling take time

If the information network boundaries are wrong from the start, the result is often months of rework. Correct scoping is the single most important starting point in any IT-Grundschutz project.

Documentation can pass the first review and fail the audit

Documentation that looks complete internally often does not survive external certification review. Audit-ready means more than thorough. It means structured, traceable and defensible.

Technical controls need more than a concept

Many projects define safeguards that are never properly implemented in the real environment. A concept without implementation leaves the actual risk in place.

Compliance obligations are non-negotiable

For KRITIS operators and many public-sector organizations, IT-Grundschutz is not optional. Delays or gaps create direct regulatory exposure.

The good news:
IT-Grundschutz rewards experience.

Organizations that bring the right method and engineering depth in from the start typically reach certification more efficiently and avoid unnecessary detours.

Our Solution

Full support from concept to certificate


evoila supports the full IT-Grundschutz lifecycle and adapts the depth to your goal, whether that is a structured security concept or full certification.
We bring both the BSI methodology and the engineering capability to implement the measures. That is where many consultancies stop. Because evoila also builds and operates the platforms underneath, our security concepts reflect systems that actually exist, and the safeguards we specify are ones we can help you implement. Our services include:

Structure analysis and scoping

Defining the information network and getting the boundaries right from the start.

Modeling with the Grundschutz-Kompendium

Selecting and applying the right building blocks for your environment.

Gap analysis and risk treatment

Comparing target and actual state, then defining the measures that close the gap.

Implementation support

Putting technical and organizational safeguards in place with our security engineering teams.

Certification path

Preparing for and supporting ISO 27001 certification on the basis of IT-Grundschutz.

Grundschutz-ready platforms

Designing and securing private cloud and infrastructure environments to meet Grundschutz requirements.

Tech-Deep-Dive

The IT-Grundschutz process in practice

evoila follows the BSI methodology and keeps it grounded in the real environment.

Standards and method

We work along the BSI 200-x standards: 200-1 for the management system, 200-2 for the IT-Grundschutz methodology and 200-3 for risk analysis. Depending on your protection needs, we apply the basic, standard or core safeguard approach so the effort matches the requirement.

Modeling

Using the Grundschutz-Kompendium, we model your information network with the appropriate building blocks, covering infrastructure, networks, applications and operations. Correct modeling at this stage is what keeps the whole project efficient.

Risk treatment

Where protection needs are high or there is no matching module, we carry out a risk analysis in line with BSI Standard 200-3 and define supplementary safeguards.

Implementation and platforms

This is a key differentiator. We do not stop at the concept. Our engineering teams implement the technical safeguards and can build private cloud and platform environments that are Grundschutz-ready by design.

Container & Kubernetes Security

Certification

Where certification is required, we prepare the reference documentation and support you through ISO 27001 certification on the basis of IT-Grundschutz.

Technical Advantages

Six reasons why IT-Grundschutz works with evoila

1. Right-sized effort

Basic, standard or core safeguard approaches matched to your actual protection needs.

2. Efficient modeling

Correct building-block selection from the start avoids months of rework later.

3. Implemented, not assumed

Safeguards are put in place by engineers, not left behind as paper specifications.

4. Grundschutz-ready platforms

Private cloud and infrastructure built to meet Grundschutz requirements from the ground up.

5. Audit-ready documentation

Every concept is prepared to withstand certification review, not just internal sign-off.

6. NIS2 and KRITIS alignment

A properly built IT-Grundschutz concept covers much of the evidence needed for NIS2 and KRITIS obligations at the same time.

Your partner of choice

Grundschutz experience with engineering behind it

evoila has delivered IT-Grundschutz projects in demanding German environments, so the method we bring has been tested in real audits, not just described in theory.
The difference is the engineering depth behind the concept. Because we build and operate private cloud and platform infrastructure, we can deliver environments that are Grundschutz-ready and implement the safeguards the concept requires.
We work along the BSI 200-x standards and the Grundschutz-Kompendium, and evoila is itself ISO 27001 certified. For organizations that also face NIS2 requirements, the same work supports those obligations as well.

ISO 27001 certified organization

We hold the certificate ourselves. Our security concepts are built by a team that works under the same standard we help you achieve.

BSI 200-x methodology applied in production

We use BSI Standard 200-1, 200-2 and 200-3 in real projects, not as a theoretical reference but as the method behind the work.

Engineering teams that implement, not just advise

Our security engineers put the safeguards in place. No handover to a separate implementation team, and no accountability gap between concept and reality.

KRITIS and public-sector project track record

We have delivered IT-Grundschutz projects in environments where compliance is mandatory and audits are real. The method we bring has already been tested under those conditions.

Technologies & Partners

How we work and with whom

We work tool-agnostically and align requirements with recognized frameworks such as ISO 27001 and BSI IT-Grundschutz. Technical measures are implemented together with evoila’s security engineering and managed-services teams. Because evoila is ISO 27001 certified, the work is grounded in an audited operating model.


Services & Starter Deals

Start the way that works best for you

1 | IT-Grundschutz Readiness Check

A fixed-scope assessment that clarifies your scope, identifies key gaps and provides a prioritized path towards certification.

2 | IT-Grundschutz Project

End-to-end support from structure analysis and modeling through implementation to certification support – built around your organization, systems and compliance requirements.

IT-Grundschutz does not get easier by waiting

Get the scope right, close the gaps and reach certification with a team that has done it before.

Start your IT-Grundschutz journey

Let’s turn IT-Grundschutz into real security

Tell us where you are today and we will help you define the path to compliance and certification.

Patrick Cosic

Patrick Cosic

Business Unit Lead Security

FAQs

Commonly asked questions about BSI IT-Grundschutz

ISO 27001 is an international standard that defines general requirements for an information security management system. BSI IT-Grundschutz is the BSI methodology that makes those requirements concrete for the German market through structured modules and safeguards. Organizations can achieve ISO 27001 certification on the basis of IT-Grundschutz.

That depends on your environment and regulatory context. For many German public-sector organizations and KRITIS operators, IT-Grundschutz is the more relevant framework. For other organizations, ISO 27001 may be enough. In practice, the two often work together rather than against each other.

That depends on the size, complexity and maturity of your environment. The biggest driver is usually correct scoping and modeling at the beginning. A readiness check helps establish a realistic timeline and avoids rework later in the project.

Yes. evoila does not stop at the concept. Our engineering teams can implement the technical safeguards and help build platforms and infrastructure that meet Grundschutz requirements in practice.

Yes. A properly built IT-Grundschutz concept supports KRITIS obligations directly and provides a strong basis for NIS2 evidence as well. The same work can often satisfy multiple requirements at the same time.