Your 2026 guide to complying with the BSI IT-Grundschutz Compendium

As German public authorities and the organizations that serve them face rising ransomware, supply chain, and cloud exposure, the IT-Grundschutz Compendium remains the reference standard for demonstrating that information is adequately protected. Issued by the Bundesamt für Sicherheit in der Informationstechnik (BSI), it packages the agency's own risk analysis into 97 modules spanning ten layers — security management, organization and personnel, cross-cutting concepts, operations, and detection and response, alongside the application, system, industrial, network, and infrastructure layers — backed by a catalogue of 47 elementary threats.

The compendium applies to public authorities and private organizations of every size and sector, and each module sorts its requirements into basic, standard, and elevated protection needs so effort scales to sensitivity. Because it aligns with the ISO 27000 family, implementation also opens a route to ISO 27001 certification on the basis of IT-Grundschutz. This guide breaks down the compendium layer by layer, outlines what your organization must implement, and shows how ManageEngine solutions help you operationalize and strengthen compliance.

What you’ll learn

• Understand what IT-Grundschutz covers, who it applies to, and why implementing it also builds the evidence base for ISO 27001 certification.
• Distinguish process modules, which apply across an information domain, from system modules tied to specific objects — and see how basic, standard, and elevated requirements differ.
• Work through the identity and operations modules that carry the most technical weight: ORP.1, ORP.2, and ORP.4 for access governance, CON.2, CON.3, and CON.6 for data protection, backup, and disposal, and OPS.1.1.2 through OPS.2.2 for administration, patching, malware, logging, remote maintenance, and cloud.
• Trace the detection and response layer end to end — DER.1 event detection, DER.2.1 incident handling, DER.2.2 forensic readiness, and DER.3.1 audits and revisions — plus SYS.1.1 and APP.2.2 for server and directory monitoring.
• See how identity governance and security monitoring together satisfy the compendium's technical modules, turning a catalogue of requirements into an auditable, working security capability.