BSI IT-Grundschutz
All 28 isidaten articles on BSI IT-Grundschutz, newest first.
A forgotten server still draws power
Machine room, part 4: almost every server room has a device that nobody needs any more and nobody wants to switch off. It draws power, has to be cooled and occupies rack units. What the Energy Efficiency Act requires, why switching off fails on ownership, and how to find ghost servers without hitting a production server.
Read more
To the ones who say "we do not know" in the crisis exercise
Quiet work, part 3: twenty minutes into the crisis exercise, the head of the crisis team asks whether the backups are affected. Someone at the table says no, because it has always been that way. And then someone else says: "We do not know." Why that sentence makes the exercise a success and where BSI Standard 200-4 calls for it.
Read more
A/B is only redundant when each side carries the load alone
Machine room, part 3: two power rails, two strips per rack, every server with two power supplies. On the plan, that is redundant. Whether it really is depends on three things: the load on each side, where A and B join, and the devices whose second power supply is plugged into the same strip. What IT-Grundschutz says about it and how to check.
Read more
Filed on the intranet is not made known
The IT usage policy is approved, it is on the intranet, and a circular email pointed to it. In an audit, that is not enough. IT-Grundschutz requires new staff to confirm the policy before they use IT, and everyone to confirm it again after major changes. The intranet is the place to read it, not the evidence.
Read more
Drop the forced password change, and you have to detect leaks
Many organisations have dropped the 90-day password change, with the BSI on their side. IT-Grundschutz attaches a condition, though: whoever no longer forces changes by the calendar has to detect when a password is compromised. Where that knowledge can come from, and what has to happen next.
Read more
A Grundschutz check is not an audit
Basic terms, part 7: "We had an audit in spring." Often it was an IT-Grundschutz check that the information security officer carried out with the responsible staff. That is valuable, but something else. BSI Standard 200-2 distinguishes three kinds of review: the check as a target/actual comparison, the IS audit as a regular review of effectiveness, and the audit by independent bodies. Who reviews, against what, and with what consequence.
Read more
To the ones who still report the phishing suspicion at 5:55 pm
Quiet work, part 2: Friday, shortly before closing time, a click on a link that feels wrong. Two options: close the laptop and hope, or call and say you may have clicked something. Why the second is often the earliest detection an organisation gets, where IT-Grundschutz requires it, and why it is so rarely thanked.
Read more
A data centre for the BSI, not for the Energy Efficiency Act
Machine room, part 2: three racks in the basement, forty kilowatts, "we don't have a data centre". For the German Energy Efficiency Act that is true, because it counts kilowatts and starts at 300. IT-Grundschutz counts something else: importance for the organisation's tasks. On that basis, the only central server room is generally to be treated like a data centre. Two definitions, two different answers to the same question.
Read more
Forensics starts before the incident
After an attack, management, insurers and supervisors ask how the attacker got in. Whether there is an answer is often decided in the first hour, usually by a well-meant reboot. The BSI module DER.2.2 therefore makes three things a basic requirement that must be done before the incident: legal clarification, a guide for initial measures and a forensics provider selected in advance.
Read more
A requirement is not a measure
Basic terms, part 6: "Has the measure been implemented?" Someone from IT-Grundschutz means something different by that than someone working to ISO 27001. The BSI Kompendium cleanly separates module, requirement and measure: what is being secured, what must be fulfilled and how it is fulfilled in your organisation. In the German ISO version, however, the control is called "Maßnahme" (measure). The same word, two levels.
Read more
To the ones who test the restore
Quiet work, part 1: a backup that reports green every night says nothing about whether anything can be brought back from it. Only someone who tries knows, on a Tuesday afternoon, without cause and without an audience. Why IT-Grundschutz requires exactly that as a basic requirement, and why hardly anyone notices it anyway.
Read more
A policy is not a guideline
Basic terms, part 5: policy, guideline, security concept and work instruction end up in the same folder in many organisations, often in the same document. BSI Standard 200-1 distinguishes them by purpose, audience and approver. Mix the levels and you get a policy nobody is allowed to change and instructions nobody reads.
Read more
The deputy is not a loophole
Reporting deadlines keep running while the responsible person is on leave, so every role needs a deputy. IT-Grundschutz draws a line here that regularly gets crossed in practice: deputies are subject to segregation of duties too. Why the deputy is often the very person who filed the request, and what an approval during an absence has to record.
Read more
The server is not the crown jewel
Basic terms, part 4: information domain, target object and asset are treated in everyday practice as the same thing as an inventory. IT-Grundschutz means three different things, and none of them is a device list. Why 3,000 clients can be one target object and the crown jewel is never a system.
Read more
Whoever knows the script is not practising
BSI Standard 200-4 allows the exercise lead to play an inject earlier, later or not at all. That only works if the crisis team cannot see the script. What separates a staff exercise from a read-through, which time the standard wants measured, and what a participant page must therefore never show.
Read more
Page two looks clean
Active Directory answers every search with at most 1,000 objects. Whoever does not page on checks the first 1,000 accounts and takes the rest for clean. Why a hardening report has to say what it did not see, and what that means for score, maturity and the BSI module APP.2.2.
Read more
Core is not the middle
Basic terms, part 3: basic, core and standard safeguarding are drawn as a staircase in almost every presentation. BSI Standard 200-2 describes something else: three approaches for three situations, on two axes. Anyone who takes core safeguarding for the middle step underestimates it.
Read more
Nine dimensions, one number
A risk analysis ends in a number. The matrix, the priority and the measure all follow from it. What it does not say is what kind of damage is meant. Why the maximum principle stays the default and a weighted average is a decision you have to justify.
Read more
How bad is not how fast
Basic terms, part 2: protection needs assessment and business impact analysis both ask about damage, but about different damage. One has no clock, the other lives by it. Why the BSI itself warns against merging them, and what separates normal operation from emergency operation.
Read more
Microsoft is not a cloud service
One line in the supplier directory does not answer the cloud question: Exchange Online, Teams and Entra ID are three services with different data locations and exit routes. Why OPS.2.2 requires a reference object per service, and what a rehearsal date on the exit achieves.
Read more
A threat is not a hazard
Basic Terms, part 1: threat, vulnerability, hazard and risk build on one another in IT-Grundschutz and mean four different things. Plus the term the BSI abolished in 2017 that almost everyone still uses.
Read more
The stopgap becomes a fixture
WiBA looked like an entry aid for small municipalities, to be swapped later for the real thing. The BSI has since decided otherwise: the checklists become a fixture of the successor to the IT-Grundschutz-Kompendium.
Read more
Fine alone, critical together
The severity of a cloud misconfiguration comes from the catalog. But the catalog does not know the resource the check fired on. How we resolved that, and why a single risk factor raises nothing.
Read more
§ 39 is every three years. Critical infrastructure is every day.
Healthcare operators of critical infrastructure must regularly prove their IT security, since the NIS2 implementation act under § 39 BSIG and now only every three years. The longer the interval, the larger the gap between two snapshots. Why the B3S catalog only describes the WHAT, the real work sits in the HOW, and how the audit sprint becomes a continuously measured state.
Read more
Hardening has an expiration date
Anyone can harden once: work through the benchmark, tick it off, done. Then everyday operations arrive, and the configuration drifts, quietly and without bad intent. Why configuration drift is the normal state in the absence of measurement, and how isidaten now checks daily against 28 hardening benchmarks, on Linux directly via OpenSCAP.
Read more
isidaten officially listed by BSI as IT-Grundschutz tool
isidaten is officially recognized and listed by the Federal Office for Information Security (BSI) as an IT-Grundschutz tool.
Read moreisidaten actively shapes the new BSI IT-Grundschutz++
As an officially recognized BSI IT-Grundschutz tool, we are actively engaged in the development of the future IT-Grundschutz++
Read moreisidaten is now an official BSI IT-Grundschutz tool
isidaten has concluded a license agreement with BSI for processing data from the IT-Grundschutz catalogs
Read more