BSI Standards 200-1 to 200-4: Overview and Checklist for Companies

What are the BSI standards 200-1 to 200-4?

The BSI standards 200-1 to 200-4 are recommendations from the German Federal Office for Information Security (BSI) for building information security in companies and public authorities. 200-1 describes the requirements for an information security management system (ISMS), 200-2 the IT-Grundschutz methodology, 200-3 risk analysis and 200-4 business continuity management. Together with the IT-Grundschutz Compendium, they form IT-Grundschutz, which is compatible with ISO 27001.

The BSI is Germany’s central cybersecurity authority. Standards 200-1 to 200-3 were published in 2017 and replaced the old BSI standards 100-1 to 100-3. BSI standard 200-4 followed in 2023 and replaces standard 100-4 on emergency management. All standards are available free of charge on the BSI website.

The four BSI standards at a glance

BSI standard 200-1: Information security management systems

BSI standard 200-1 defines what an information security management system (ISMS) must achieve. It describes how management takes responsibility, sets a security policy, appoints roles such as the information security officer and continuously steers and improves the security process. 200-1 does not contain specific technical measures – these can be found in the IT-Grundschutz Compendium.

The standard is fully compatible with ISO/IEC 27001. If you build an ISMS according to 200-1, you also meet the management requirements of the international standard.

BSI standard 200-2: IT-Grundschutz methodology

BSI standard 200-2 describes step by step how to build an ISMS according to IT-Grundschutz in practice: from the structure analysis and the determination of protection requirements to modelling with the Compendium’s modules and the IT-Grundschutz check. To make it easier for smaller organisations to get started, the standard offers three approaches:

• Basic protection: a quick start with fundamental measures for the entire organisation.
• Core protection: protecting particularly critical business processes and assets (“crown jewels”).
• Standard protection: full protection of all areas according to IT-Grundschutz – a prerequisite for ISO 27001 certification based on IT-Grundschutz.

BSI standard 200-3: Risk analysis based on IT-Grundschutz

The requirements of the IT-Grundschutz Compendium cover normal protection requirements. For areas with high or very high protection requirements, unusual deployment scenarios or systems for which there is no suitable module, BSI standard 200-3 describes a supplementary risk analysis. You identify threats, assess likelihood and impact and decide how to handle each risk: avoid, reduce, transfer or consciously accept it. If you already work with risk management according to ISO 31000, you will find many familiar elements here.

BSI standard 200-4: Business continuity management

BSI standard 200-4 describes how to build a business continuity management system (BCMS). The goal is to keep time-critical business processes running or restore them quickly in emergencies and crises – for example after a ransomware attack, a fire or the failure of a service provider. This includes a business impact analysis, emergency plans, recovery strategies and regular exercises.

The standard replaces the former BSI standard 100-4 “Emergency management” and is aligned with ISO 22301. To get started, it offers a tiered approach from a reactive BCMS to a full standard BCMS.

What is the IT-Grundschutz Compendium?

The IT-Grundschutz Compendium supplements the BSI standards with specific requirements. It is divided into modules, for example on organisation, personnel, networks, servers, clients or cloud usage. Each module describes typical threats and the requirements to address them – for example access controls, backups, encryption or network segmentation. The BSI is currently modernising IT-Grundschutz under the name “Grundschutz++”, but the standards 200-1 to 200-4 remain the methodological basis.

BSI standards, ISO 27001 and NIS2: how do they relate?

• ISO 27001: The BSI standards are compatible with the international standard. The BSI even offers its own certification, “ISO 27001 based on IT-Grundschutz”. Many companies, however, opt for a classic ISO 27001 certification because it is better known internationally and more flexible. Find out what certification costs in our article on ISO 27001 costs.
• NIS2: With the implementation of the NIS2 directive in Germany, significantly more companies fall under the supervision of the BSI. They must implement risk management measures, report security incidents and prepare for emergencies. The BSI standards – especially 200-2, 200-3 and 200-4 – provide a proven template for this. Find out more in our article on NIS2 and ISO 27001.

Checklist: How to implement the BSI standards in your company

1. Involve management: Define responsibility and budget for information security and adopt a security policy (200-1).
2. Appoint roles: Designate an information security officer and clarify responsibilities.
3. Define the scope: Decide which locations, processes and systems the ISMS covers.
4. Choose an approach: Start with basic or core protection and set standard protection as the goal (200-2).
5. Structure analysis and protection requirements: Record business processes, applications, IT systems and rooms and determine their protection requirements.
6. Model and check: Assign suitable modules from the IT-Grundschutz Compendium and check the implementation status in the IT-Grundschutz check.
7. Analyse risks: Carry out a risk analysis according to 200-3 for areas with high protection requirements and define measures.
8. Build emergency preparedness: Implement a business impact analysis, emergency plans and exercises according to 200-4.
9. Train employees: Regularly raise awareness of phishing, password security and reporting channels.
10. Improve continuously: Plan internal audits, management reviews and adjustments to new threats.

Conclusion: the BSI standards as a roadmap for information security

The BSI standards 200-1 to 200-4 offer companies a free, proven roadmap for information security: from the management system and practical protection to risk analysis and emergency preparedness. They are compatible with ISO 27001 and a good basis for meeting the requirements of NIS2. If you start step by step with basic or core protection, you can quickly reach a solid level of security even with limited resources. Find out whether certification is also worthwhile for your company in our article ISO 27001: Which companies benefit from certification?

With heyData, you build your ISMS in a structured way: with ready-made policies, guided risk analysis and experts who support you all the way to ISO 27001 certification.

Take the first step: Book a free demo now