A Grundschutz check is not an audit

"We had an audit in spring." Ask further, and it was often an IT-Grundschutz check: the information security officer went through the departments with the modules, talked to the responsible staff and entered a status for each requirement. That is a lot of work and very useful. It is not an audit.

BSI Standard 200-2 knows three ways of looking at a security concept. They differ in who reviews, what is reviewed against and what happens afterwards.

Grundschutz check: the target/actual comparison

The standard describes the check as follows (our translation):

"The IT-Grundschutz check is an organisational instrument that provides a quick overview of the existing level of security."

Interviews establish how far the requirements of the modelled modules are fulfilled. The result is a catalogue in which every relevant requirement gets one of four statuses: yes, partially, no or not required. "Not required" comes with a reservation the standard states explicitly: only with a justification, and not possible for basic requirements. Why the line is drawn exactly there was the topic of the previous part: for MUST requirements, no risk acceptance is possible.

Who reviews: usually the organisation's own security management, together with the responsible staff. Against what: the requirements of the Kompendium. The consequence: open and partially fulfilled requirements become the implementation plan. The check is a stocktake, not an assessment from outside.

IS audit: the regular review

The check says what has been implemented. Whether it works is a second question. For that, the standard names the information security audit (IS-Revision) (our translation):

"Only through regular review of the established security measures and of the information security process can statements be made about their effective implementation, currency, completeness and appropriateness, and thus about the current state of information security."

Methodologically, the standard recommends the same procedure as for the check, worked out in the BSI guideline for IS audits. The difference lies in the role: an IS audit reviews security management; it is not part of it. Whoever wrote the concept should not audit it themselves. The outcome of an IS audit is findings addressed to management, not just entries in a list.

Audit: the independent assessment

An audit in the sense of certification goes one step further. The standard describes certification as a method for having the achievement of security objectives and the implementation of measures (our translation)

"reviewed by qualified independent bodies"

It delivers traceable, repeatable and comparable audit results. What is reviewed is not only whether requirements are fulfilled, but whether the management system holds up: whether there are objectives, audits, management reviews and corrections. The outcome is a certificate or a list of nonconformities with deadlines. The internal audit under ISO 27001 clause 9.2 sits in between: planned by the organisation itself, but with objective and impartial auditors. What an audit programme for it looks like was covered in An audit date is not yet an audit programme.

Three questions to keep them apart

• Who reviewed? The organisation's own security management (check), an internal function independent of it (IS audit, internal audit) or an external, qualified body (certification audit)?
• Against what? Against the requirements of the modules, against the effectiveness of the measures or against the standard as a whole?
• With what consequence? An implementation plan, findings to management or a certificate with conditions?

All three have their place, and the check is often the basis of the other two. But the report to management should not say "audit" when a check is meant. Otherwise management believes in an independent confirmation that never happened.

Sources

BSI Standard 200-2, IT-Grundschutz Methodology, chapters 6.3, 7.7, 8.4, 10.1.3 and 10.1.4 (German). ISO/IEC 27001:2022, clause 9.2 (in substance, text of the standard protected by copyright).

In the next part: certification, accreditation, attestation. Who certifies whom, and who certifies the certifiers.

The previous part: A requirement is not a measure.