BSI Standards 200-1 to 200-4: Overview, Status and Checklist

What are the BSI standards 200-1 to 200-4?

The BSI standards 200-1 to 200-4 are recommendations from the German Federal Office for Information Security (BSI) for building information security in companies and public authorities. 200-1 describes the requirements for an information security management system (ISMS), 200-2 the IT-Grundschutz methodology, 200-3 risk analysis and 200-4 business continuity management. Together with the IT-Grundschutz Compendium, they form IT-Grundschutz, which is compatible with ISO 27001.

The BSI is Germany’s central cybersecurity authority. Standards 200-1 to 200-3 were published in 2017 and replaced the old BSI standards 100-1 to 100-3. BSI standard 200-4 followed in 2023 and replaces standard 100-4 on emergency management. All standards are available free of charge on the BSI overview page for the standards (in German).

How do BSI standards 200-1 to 200-4 differ?

Each standard covers its own building block: the management system (200-1), the methodology (200-2), risk management (200-3) and business continuity management (200-4). With standard 300-1, the BSI has also published the methodology for Grundschutz++.

What does BSI standard 200-1 cover?

BSI standard 200-1 defines what an information security management system (ISMS) must achieve. It describes how management takes responsibility, sets a security policy, appoints roles such as the information security officer and continuously steers and improves the security process. 200-1 does not contain specific technical measures – these can be found in the IT-Grundschutz Compendium.

According to the BSI, the standard remains compatible with ISO/IEC 27001 and also takes into account the recommendations of other ISO standards such as ISO 27002.

What does BSI standard 200-2 cover?

BSI standard 200-2 describes step by step how to build an ISMS according to IT-Grundschutz in practice: from the structure analysis and the determination of protection requirements to modelling with the Compendium’s modules and the IT-Grundschutz check. To make it easier for smaller organisations to get started, the standard offers three approaches:

• Basic protection: a quick start with fundamental measures for the entire organisation.
• Core protection: protecting particularly critical business processes and assets (“crown jewels”).
• Standard protection: full protection of all areas according to IT-Grundschutz – a prerequisite for ISO 27001 certification based on IT-Grundschutz.

What does BSI standard 200-3 cover?

BSI standard 200-3 bundles the risk-related work steps for implementing IT-Grundschutz. The requirements of the IT-Grundschutz Compendium cover normal protection requirements. For areas with high or very high protection requirements, unusual deployment scenarios or systems for which there is no suitable module, BSI standard 200-3 describes a supplementary risk analysis. You identify threats, assess likelihood and impact and decide how to handle each risk: avoid, reduce, transfer or consciously accept it. If you already work with risk management according to ISO 31000, you will find many familiar elements here. For how a risk assessment works in general, see our article How to conduct a security risk assessment.

What does BSI standard 200-4 cover?

BSI standard 200-4 describes how to build a business continuity management system (BCMS). The goal is to keep time-critical business processes running or restore them quickly in emergencies and crises – for example after a ransomware attack, a fire or the failure of a service provider. This includes a business impact analysis, emergency plans, recovery strategies and regular exercises.

The standard replaces the former BSI standard 100-4 “Emergency management”. According to the BSI, its catalogue of requirements contains a mapping to ISO 22301:2019.

What is the IT-Grundschutz Compendium?

The IT-Grundschutz Compendium supplements the BSI standards with specific requirements. It is divided into modules, for example on organisation, personnel, networks, servers, clients or cloud usage. Each module describes typical threats and the requirements to address them – for example access controls, backups, encryption or network segmentation. According to the BSI, the current version is the 2023 edition, available since 1 February 2023.

What is Grundschutz++ (BSI standard 300-1)?

According to the BSI, Grundschutz++ is a new development of Grundschutz for building an information security management system (ISMS). The BSI published the methodology on 26 October 2026 as BSI standard 300-1. It is process-oriented, based on the PDCA cycle, and the requirements are available in machine-readable form.

According to the BSI, an ISMS implemented according to Grundschutz++ can be certified from 2027 and is compatible with ISO/IEC 27001. Under the milestone plan on the BSI Grundschutz++ page (as of October 2026), applications for ISO 27001 certification based on Grundschutz++ can be submitted from 1 January 2027. According to the milestone plan, certification under the existing IT-Grundschutz ends on 30 November 2031.

Do standards 200-1 to 200-4 and the Compendium still apply?

According to the BSI, the existing IT-Grundschutz remains applicable during the multi-year transition period. The BSI says the digital rule set of Grundschutz++ replaces the IT-Grundschutz Compendium, although an update of the Compendium is still planned. On its Grundschutz++ pages, the BSI does not state that standard 300-1 replaces standards 200-1 to 200-4. Before you switch, check the BSI’s current guidance.

BSI standards, ISO 27001 and NIS2: how do they relate?

• ISO 27001: The BSI standards are compatible with the international standard. The BSI even offers its own certification, “ISO 27001 based on IT-Grundschutz”. Many companies, however, opt for a classic ISO 27001 certification because it is better known internationally and more flexible. Find out what certification costs in our article on ISO 27001 costs.
• NIS2: With the implementation of the NIS2 directive in Germany, significantly more companies fall under the supervision of the BSI. They must implement risk management measures, report security incidents and prepare for emergencies. The BSI standards – especially 200-2, 200-3 and 200-4 – can serve as a template for this. Find out more in our article on NIS2 and ISO 27001. For an overview of the obligations, see our page on NIS2 compliance, and for the differences to DORA, our comparison of NIS2 and DORA.

If you need to serve several frameworks at once, these articles can help: multi-framework compliance without duplicate work, compliance in mid-sized companies, ISO 27001 vs. GDPR and Statement of Applicability (SoA).

How do you implement the BSI standards in your company?

You implement them step by step: from management involvement through structure analysis and risk analysis to emergency preparedness. This checklist of ten steps gives you the order.

1. Involve management: Define responsibility and budget for information security and adopt a security policy (200-1).
2. Appoint roles: Designate an information security officer and clarify responsibilities.
3. Define the scope: Decide which locations, processes and systems the ISMS covers.
4. Choose an approach: Start with basic or core protection and set standard protection as the goal (200-2).
5. Structure analysis and protection requirements: Record business processes, applications, IT systems and rooms and determine their protection requirements.
6. Model and check: Assign suitable modules from the IT-Grundschutz Compendium and check the implementation status in the IT-Grundschutz check.
7. Analyse risks: Carry out a risk analysis according to 200-3 for areas with high protection requirements and define measures.
8. Build emergency preparedness: Implement a business impact analysis, emergency plans and exercises according to 200-4.
9. Train employees: Regularly raise awareness of phishing, password security and reporting channels.
10. Improve continuously: Plan internal audits, management reviews and adjustments to new threats.

Conclusion: the BSI standards as a roadmap for information security

The BSI standards 200-1 to 200-4 offer companies a free, proven roadmap for information security: from the management system and practical protection to risk analysis and emergency preparedness. They are compatible with ISO 27001 and can serve as a template for measures that NIS2 also requires. With BSI standard 300-1, the BSI has also published the methodology for Grundschutz++; the existing IT-Grundschutz remains applicable during the transition period. If you start step by step with basic or core protection, you can quickly reach a solid level of security even with limited resources. Find out whether certification is also worthwhile for your company in our article ISO 27001: Which companies benefit from certification?

With heyData, you build your ISMS in a structured way: with ready-made policies, guided risk analysis and experts who support you all the way to ISO 27001 certification.

Take the first step: Book a free demo now