How can ManageEngine support organisations in implementing IT-Grundschutz?
With ManageEngine Log360 (SIEM), public authorities and private organisations can start aligning with the technical modules of the IT-Grundschutz-Kompendium. See the key modules and how our solution helps in the table below.
ISMSISMS. Sicherheitsmanagement (Security management)
| Clause | Functionality | Explanation |
|---|---|---|
| ISMS.1 Sicherheitsmanagement. Operators shall establish and maintain a functioning information security management system, monitoring the security process, reviewing policies, and reporting to the management level. | Log360 - IT compliance management, 150+ audit-ready report templates, compliance dashboards, real-time violation alerting, security and risk posture management. | Log360 partially supports this clause by giving management continuous visibility of the security posture through prebuilt audit templates and dashboards, and by alerting the responsible roles when a policy or control deviation occurs, which operationalises the ongoing oversight the security process demands. Establishing the ISMS scope, policy, leadership, and the continuous review cycle remains an organisational programme the operator runs; Log360 provides the monitoring evidence, not the management system itself. |
ORPORP. Organisation und Personal (Organisation and personnel)
| Clause | Functionality | Explanation |
|---|---|---|
| ORP.4 Identitäts- und Berechtigungsmanagement. Identities and access rights shall be administered over their whole life cycle, authentication appropriate to the protection need including strong or multi-factor authentication shall be enforced, and granted access shall be reviewed regularly. | Log360 - logon and logoff auditing, privileged user monitoring, PUMA reports, account lockout analysis, real-time alerting. | Log360 partially supports this clause by recording logon activity and privileged-account use, providing the evidence base for the regular access review the module obliges organisations to conduct. Because the record is independent of the systems being reviewed, it shows which entitlements were actually exercised rather than only which were granted. Administering identities and access rights, and enforcing strong or multi-factor authentication, lie outside Log360. |
| ORP.5 Compliance Management. The legal, contractual, and regulatory requirements applicable to the organisation shall be identified, kept current, and verified. | Log360 - integrated compliance management, prebuilt report packs for ISO 27001, GDPR, PCI DSS, SOX, HIPAA, FISMA and GLBA, custom compliance report builder, scheduled report generation. | Log360 partially supports this clause by producing the technical evidence that a named requirement is being met, using prebuilt report packs mapped to recognised regimes and a builder for regimes with no prebuilt pack, scheduled and exported so the compliance manager holds a dated artefact per requirement. Identifying which laws, contracts, and standards apply, and maintaining that register, is a legal and organisational task. |
CONCON. Konzepte und Vorgehensweisen (Concepts and approaches)
| Clause | Functionality | Explanation |
|---|---|---|
| CON.2 Datenschutz. Personal data shall be protected, including knowing where such data resides and controlling access to it. | Log360 - sensitive data discovery, data classification, file access auditing, data leak prevention, permissions analyzer, eDiscovery. | Log360 partially supports this clause by locating personal data across servers, endpoints, and cloud repositories, tagging it by sensitivity so proportionate protection is applied, and recording who accesses it. Data leak prevention blocks unauthorised exfiltration through endpoint, email, and USB channels. Lawful-basis records, processing registers, data subject request handling, and privacy notices are legal deliverables the Data Protection Officer maintains. |
| CON.6 Löschen und Vernichten. Data and media shall be deleted and destroyed securely so that information cannot be reconstructed after disposal. | Log360 - file activity and deletion auditing, real-time alerts on mass deletion, ROT data analysis, tamper-proof log archive. | Log360 partially supports this clause by recording deletion events with the actor, object, and timestamp and retaining them in a tamper-proof archive, which supplies the accountable evidence that a required disposal actually occurred. Secure erasure itself, including cryptographic wiping, degaussing, and physical destruction of media, requires dedicated tools and physical processes. |
| CON.7 Informationssicherheit auf Auslandsreisen. Access to organisational systems and data shall be restricted and protected while personnel are travelling, with safeguards against access from high-risk locations. | Log360 - logon location reporting, UEBA anomaly detection, dynamic peer grouping, risk scoring, real-time alerting. | Log360 partially supports this clause by reporting on logon locations and flagging authentication from unexpected geographies as an anomaly, so a credential compromised while its owner is travelling surfaces quickly and the user's risk score rises as the deviation widens. Restricting where access may originate, traveller briefings, restrictions on which devices and data may be taken, and physical device protection lie outside Log360. |
| CON.9 Informationsaustausch. The exchange of information with external parties shall be governed: what may be shared and by which channel shall be defined, information in transit protected, and the exchange recorded. | Log360 - data leak prevention for email, USB and cloud channels, email attachment inspection, cloud app discovery, shadow-IT monitoring, web content filtering, mail traffic and external domain reports. | Log360 partially supports this clause by enforcing the channel rules an exchange policy sets: attachment inspection and DLP policies block restricted content leaving by email or removable media, CASB-based discovery surfaces unsanctioned cloud services being used to move information out, and mail traffic reporting records what moved to external domains. Non-disclosure agreements, data-sharing contracts, and rules for postal or verbal exchange are organisational. |
OPSOPS. Betrieb (Operations)
| Clause | Functionality | Explanation |
|---|---|---|
| OPS.1.1.2 Ordnungsgemäße IT-Administration. IT systems shall be administered accountably, with administrative rights restricted and privileged administrative activity monitored. | Log360 - privileged user activity monitoring, Active Directory change auditing with old and new values, real-time change alerts, PUMA reports. | Log360 partially supports this clause by tracking privileged sessions and flagging anomalous administrator behaviour, and by auditing changes to directory objects with who-did-what detail that supports accountable administration. Restricting administrative rights and routing sensitive actions through approval lie outside Log360, as do credential vaulting, just-in-time elevation, and session recording. |
| OPS.1.1.3 Patch- und Änderungsmanagement. Changes to systems shall be tracked and controlled, and unauthorised or unmanaged changes detected. | Log360 - Active Directory and Group Policy change auditing, file integrity monitoring, real-time correlation, change audit reports with old and new values, alerting on unauthorised modification. | Log360 partially supports this clause by auditing changes to directory objects, group policy settings, system files, and monitored configurations and alerting when a change occurs outside an approved window or by an unexpected actor, which distinguishes a scheduled deployment from an unmanaged one. Patch distribution, vulnerability remediation, and release testing require an endpoint management product such as Endpoint Central. |
| OPS.1.1.4 Schutz vor Schadprogrammen. Malware, including ransomware, shall be detected on systems and data stores and responded to. | Log360 - threat intelligence with STIX/TAXII feeds, real-time correlation, MITRE ATT&CK-mapped detections, UEBA anomaly detection, ransomware response with automated device isolation, file integrity monitoring, SOAR playbooks. | Log360 partially supports this clause by matching activity against continually updated malicious IP, URL, and domain feeds and by flagging through UEBA the mass file rename, encryption, and access bursts that characterise ransomware before a signature exists, then isolating the affected device automatically. Log360 is not an anti-malware engine; signature scanning, file quarantine, and endpoint protection agents remain the job of a dedicated AV or EDR product. |
| OPS.1.1.5 Protokollierung. Log data recording security-relevant events shall be collected centrally, protected against alteration, and retained for a defined period. | Log360 - centralised log collection from 750+ sources, agentless and agent-based collection, built-in syslog server, universal log parser, tamper-proof secured log archival, configurable retention, advanced log search. | Log360 supports this clause by collecting logs from servers, network devices, applications, endpoints, and cloud platforms into a single store, protecting the archive against alteration, and retaining it for a configurable period. The search engine keeps the retained data usable for the evaluation the module expects rather than merely stored. |
| OPS.1.2.2 Archivierung. Data shall be archived over the long term, remaining readable and unaltered, and all access to the archive shall be logged. | Log360 - secured log archival with tamper-proofing, configurable archive retention, re-indexing of archived data for search, file access auditing, ROT data analysis. | Log360 partially supports this clause by archiving log data for defined retention periods in a tamper-proof form that can be re-indexed on demand, so archived material remains searchable rather than merely stored, and by auditing access to archived file data. Business document archiving, format migration for long-term readability, and legally compliant records management need a dedicated archiving system. |
| OPS.1.2.4 Telearbeit. Rules shall be defined for working away from the office, the connection to the organisation's network secured, teleworkers authenticated appropriately, and the data they handle protected. | Log360 - remote logon auditing, workstation monitoring, cloud and VPN access monitoring, data leak prevention, file activity monitoring. | Log360 partially supports this clause by recording remote logon events and endpoint file activity so the organisation retains visibility over work performed off premises, and by applying data leak prevention policies on the remote endpoint. Authenticating teleworkers, VPN provisioning, home network requirements, device hardening, and the teleworking agreement itself sit outside Log360. |
| OPS.1.2.5 Fernwartung. Remote access used for maintenance shall be controlled with strong authentication and the logging of remote sessions. | Log360 - remote logon auditing, remote desktop session monitoring, real-time alerting on anomalous remote access, privileged user monitoring. | Log360 partially supports this clause by auditing remote logon events and remote desktop sessions and alerting on access outside expected windows, so a maintenance connection from an unexpected address surfaces as an alert rather than being found later in the log. Strong authentication for maintenance access, live supervision, session recording, and command-level control lie outside Log360. |
| OPS.2.2 Cloud-Nutzung. Cloud services shall be used securely, with cloud access, configuration, and data movement monitored. | Log360 - cloud security monitoring for AWS, Azure, GCP and Salesforce, IAM activity reporting, security group and configuration change auditing, integrated CASB, shadow-IT monitoring, cloud app discovery, upload and download tracking. | Log360 supports this clause by auditing cloud logons and configuration changes across the major public cloud platforms and Microsoft 365, and by discovering unsanctioned applications and recording upload and download activity through its CASB capability, which is how the data-movement monitoring obligation is met in practice. |
DERDER. Detektion und Reaktion (Detection and response)
| Clause | Functionality | Explanation |
|---|---|---|
| DER.1 Detektion von sicherheitsrelevanten Ereignissen. Events that may indicate a security incident shall be detected systematically across systems and networks. | Log360 - real-time correlation engine, 2000+ MITRE ATT&CK-mapped detections, Vigil IQ TDIR engine, UEBA anomaly detection with risk scoring, dynamic peer grouping, threat intelligence matching, ML-enhanced adaptive alert thresholds. | Log360 supports this clause by evaluating collected events against correlation rules mapped to MITRE ATT&CK techniques and raising an alert when a chain of individually unremarkable events matches an attack pattern. Its UEBA layer baselines normal behaviour per user and entity and flags time, count, and pattern anomalies that rules alone would miss, while adaptive thresholds keep the alert volume proportionate so detection remains usable. |
| DER.2.1 Behandlung von Sicherheitsvorfällen. Security incidents shall be responded to, contained, and resolved through a structured process with accountability for resolution. | Log360 - incident management console, SOAR playbooks, automated containment actions, workflow profiles, ITSM integrations, incident timelines. | Log360 partially supports this clause by tracking each incident from detection to closure with an assigned owner, automating first-response containment through SOAR playbooks, and routing the incident into the operator's service management tool so the resolution record is auditable. The incident handling process itself, escalation criteria, crisis communication, and regulatory notification decisions must be defined by the operator. |
| DER.2.2 Vorsorge für die IT-Forensik. Provision shall be made for forensic investigation, preserving tamper-evident evidence and enabling event timelines to be reconstructed. | Log360 - tamper-proof log archive, forensic analysis, log search with boolean, wildcard and range queries, incident timelines, Incident Workbench with process hunting trees, AI-generated attack timelines, eDiscovery. | Log360 partially supports this clause by preserving an immutable, searchable record of events as the tamper-evident evidence base, and by assembling users, processes, and external threat sources into one analytical view with process lineage so the course of an incident can be reconstructed. Disk imaging, memory capture, write-blocking, and the physical chain-of-custody documentation forensic proceedings require lie outside Log360. |
| DER.2.3 Bereinigung weitreichender Sicherheitsvorfälle. All affected systems and accounts shall be identified, the attacker's persistence removed, trustworthy operation restored, and the clean-up verified. | Log360 - attack surface analyzer, detection of 25+ AD attacks including Kerberoasting, DCSync and pass-the-hash, privileged user monitoring, UEBA risk scoring, correlation engine. | Log360 partially supports this clause by identifying which accounts, systems, and directory objects the attacker touched, including the AD-specific techniques used to establish persistence, so the scope of the clean-up is evidence-based rather than assumed, and by re-running the same detections afterwards to verify it. Restoring the directory, resetting credentials in bulk, and rebuilding affected systems require other tools. |
| DER.3.1 Audits und Revisionen. Regular audits and reviews shall verify that the defined security safeguards are implemented, effective, and being followed. | Log360 - 150+ audit-ready report templates, 250+ built-in AD audit reports, custom compliance report builder, advanced log search, scheduled report generation. | Log360 partially supports this clause by supplying compliance report templates and searchable logs as the audit evidence the module obliges organisations to produce, and by allowing the retained data to be searched directly where no template covers a particular question. Audit planning, auditor independence, sampling methodology, and the findings report are process activities the operator conducts. |
APPAPP. Anwendungen (Applications)
| Clause | Functionality | Explanation |
|---|---|---|
| APP.2.1 Allgemeiner Verzeichnisdienst. The directory service shall be operated securely: its structure planned, administration and replication secured, the configuration hardened, and access to directory data audited. | Log360 - real-time directory change auditing, permission change auditing, AD security score, security and risk posture management, real-time change alerts. | Log360 partially supports this clause by auditing every change to directory objects, permissions, and policies in real time with the actor and the previous and new values, which is the access-audit requirement the module sets, and by scoring the directory's overall hardening state so drift is visible between reviews. Securing directory administration, directory recovery, structure planning, and replication topology design lie outside Log360. |
| APP.2.2 Active Directory / NET. The directory service and the network devices shall be operated securely, with changes audited and traffic monitored for anomalies. | Log360 - real-time auditing of GPOs, OUs, ACLs and privileged group memberships, network device log analysis for firewalls, routers and switches, event correlation, real-time alerting. | Log360 supports this clause by auditing changes to the directory that governs access in real time, and by ingesting firewall, router, and switch logs and correlating network events to surface the traffic anomalies the modules require operators to monitor. Domain controller hardening, trust design, and network device configuration remain administrative tasks on the systems themselves. |
| APP.3.2 Webserver. Web servers shall be hardened, protected against attack, and their access logged and evaluated. | Log360 - IIS and Apache web server log analysis, web server security error reports, configuration change auditing, attack detection from web server logs, real-time correlation. | Log360 partially supports this clause by ingesting IIS and Apache logs and reporting on security errors, configuration changes, and access patterns, and by correlating web server events with network and authentication logs to expose attacks the server's own log would not make apparent. Web server hardening, TLS configuration, module reduction, and patching are administrative tasks on the server itself. |
| APP.3.3 Fileserver. Access to shares shall be controlled, accesses and changes monitored, storage managed, and the data held on file servers protected. | Log360 - file server auditing across Windows and NAS devices, file access auditing, file integrity monitoring, permissions analyzer, ROT data analysis, disk space analysis, ransomware response. | Log360 partially supports this clause by recording who accessed or changed which file, when and from where across Windows and NAS file servers, flagging permission hygiene problems such as broken inheritance and excessive access, and isolating a device exhibiting ransomware behaviour before the share is encrypted. Setting, modifying, and revoking file and share permissions lies outside Log360. |
| APP.3.6 DNS-Server. Zone data and the integrity of DNS records shall be protected, changes to them controlled, and those changes logged. | Log360 - DNS and AD schema change auditing, real-time alerting on record changes, change audit reports with old and new values. | Log360 partially supports this clause by auditing changes to DNS records held in Active Directory-integrated zones with the actor and the previous and new values, so unauthorised modification of name resolution is detected immediately rather than at the next review. Recovery of tampered records, DNS server hardening, restriction of zone transfers, DNSSEC, and protection against cache poisoning lie outside Log360, and BIND or other non-Microsoft DNS platforms are not covered. |
| APP.4.3 Relationale Datenbanksysteme. Database access shall be controlled, the configuration hardened, database activity audited, and the data held protected. | Log360 - database activity monitoring, SQL Server DML and DDL auditing, SQL account change auditing, SQL injection detection, Oracle database auditing, MS SQL security and risk posture management against CIS benchmarks, sensitive data discovery. | Log360 partially supports this clause by monitoring database activity at the statement and account level, auditing schema and data manipulation, privileged account changes, and failed access, and by measuring the SQL Server configuration against CIS benchmarks with remedial insights. Database-native access control, encryption at rest, patching, and backup of the database itself remain DBA responsibilities. |
| APP.5.2 Microsoft Exchange und Outlook. Mailbox permissions and delegation shall be controlled, message flow protected, and mailbox access audited. | Log360 - non-owner mailbox logon reports, mailbox permission change auditing, Exchange configuration change reports, OWA logon reports, mail traffic and external domain reports, Exchange server health and DAG monitoring, Exchange Online audit reports, real-time alerting. | Log360 partially supports this clause by auditing the activity the module treats as security-relevant, including non-owner mailbox access, permission and delegation changes, configuration changes, and message flow to external domains, across on-premises Exchange and Exchange Online with real-time alerting. Managing mailbox permissions and delegations, transport rules, anti-spam and anti-malware policy, and Exchange server hardening lie outside Log360. |
| APP.6 Allgemeine Software. Only approved software shall be installed, execution shall be controlled, and unapproved software in use shall be detected. | Log360 - application allow listing, application control policies, software installation event auditing, shadow-IT and cloud app discovery, UEBA detection of unusual software execution. | Log360 partially supports this clause by enforcing application allow listing so only trusted and vetted applications execute on monitored endpoints, auditing installation events, and extending the same visibility to cloud applications adopted outside the approval process. Software procurement requirements, licence management, and a maintained software inventory belong to an endpoint or asset management product such as Endpoint Central. |
SYSSYS. IT-Systeme (IT systems)
| Clause | Functionality | Explanation |
|---|---|---|
| SYS.1.1 Allgemeiner Server. Servers shall be operated securely, logging security-relevant events and monitoring access and changes at the operating-system level. | Log360 - Windows event log and Unix syslog collection, local logon and account management auditing, user rights and local policy auditing, scheduled task and process auditing, PowerShell auditing, file integrity monitoring, removable storage auditing. | Log360 partially supports this clause by collecting operating system logs from Windows and Unix servers and auditing the events the module treats as security-relevant, including local logons, account and rights changes, policy changes, scheduled tasks, and PowerShell activity, with file integrity monitoring detecting unauthorised modification of system files. Server hardening, patch installation, service reduction, and secure baseline configuration are administrative tasks outside Log360. |
| SYS.1.3 Server unter Linux und Unix. Security-relevant events on Linux and Unix servers shall be logged, administrative and privileged activity monitored, and unauthorised changes to the system detected. | Log360 - Unix syslog collection with built-in syslog server, universal log parser, Linux server logon and privileged activity auditing, file integrity monitoring, real-time correlation. | Log360 partially supports this clause by collecting and parsing syslog from Linux and Unix servers and auditing logon activity, privileged command use, and file integrity on those hosts, so the security-relevant events the module identifies are recorded centrally alongside the rest of the estate. Strengthening the authentication path onto the host, kernel and service hardening, sudo policy design, and package management lie outside Log360. |
| SYS.1.5 Virtualisierung. Administrative access to the virtualisation layer shall be controlled and monitored, and security-relevant events on the hypervisor logged. | Log360 - VMware ESX and ESXi log monitoring, hypervisor administrative logon reporting, configuration change auditing, real-time correlation and alerting. | Log360 partially supports this clause by ingesting hypervisor logs and reporting on administrative logons and configuration changes at the virtualisation layer, and by correlating those events with directory activity to identify which identity made a change to the virtual infrastructure. Guest isolation, hypervisor hardening, management network separation, and virtual switch configuration are platform engineering tasks outside Log360. |
| SYS.1.8 Speicherlösungen. Access to data held on storage systems shall be controlled and monitored, and unauthorised access or modification detected. | Log360 - NAS file server auditing for NetApp, EMC, Nutanix, Synology, Hitachi, Huawei, Amazon FSx, QNAP, Azure, CTERA and Qumulo, file access and permission change auditing, file integrity monitoring, ransomware response, permissions analyzer. | Log360 partially supports this clause by auditing access to data held on network-attached storage from a wide range of vendors, recording reads, modifications, permission changes, and deletions with the acting identity, which delivers the access monitoring and integrity detection the module requires for the data layer. Storage array configuration, management interface hardening, zoning, replication, and firmware maintenance lie outside Log360. |
| SYS.2.1 Allgemeiner Client. Local privileges on clients shall be restricted, security-relevant events logged, and client activity monitored for unauthorised change. | Log360 - workstation auditing including local logon and logoff, local account management, startup and shutdown, system events and file integrity, removable storage auditing, application allow listing. | Log360 partially supports this clause by auditing the client-side events the module treats as security-relevant, so unauthorised change on a client is detected rather than merely prevented, and by restricting which executables may run through application allow listing. Strengthening client authentication, client hardening baselines, removal of local administrator rights, disk encryption, and patch deployment lie outside Log360. |
| SYS.2.2.3 Clients unter Windows 10. Interactive and remote logon shall be secured, privilege elevation controlled, and security-relevant events on the client audited. | Log360 - workstation logon auditing, local account management auditing, file integrity monitoring, removable storage auditing, real-time alerting. | Log360 partially supports this clause by auditing logon activity, local account changes, and file integrity events on Windows clients, so the client's security-relevant record is retained centrally rather than only on the machine itself, where an attacker could clear it. Securing interactive and remote logon, controlling privilege elevation, Windows configuration hardening, update policy, BitLocker, and application control baselines lie outside Log360. |
| SYS.2.3 Clients unter Linux und Unix. Logon to the client shall be secured and security-relevant client events audited. | Log360 - client syslog collection, logon auditing, universal log parser, real-time alerting. | Log360 partially supports this clause by collecting syslog from Linux and Unix clients, so logon and privileged activity on those machines is recorded alongside the rest of the estate rather than remaining local to the device. Securing logon to the client, client hardening, local account policy, disk encryption, and package management lie outside Log360. |
| SYS.2.4 Clients unter macOS. Logon to the client shall be secured and security-relevant client events audited. | Log360 - Mac logon and logoff auditing, workstation activity reporting. | Log360 partially supports this clause by auditing Mac logon and logoff activity, so macOS clients are represented in the central logon record rather than being a blind spot in an otherwise monitored estate. Securing logon to the client, macOS hardening, FileVault, Gatekeeper policy, and update management lie outside Log360. |
| SYS.4.1 Drucker, Kopierer und Multifunktionsgeräte. The use of printing services shall be controlled and logged, and the information printed protected. | Log360 - printer auditing, print job logging with user, document and device detail, data leak prevention policies covering printed content. | Log360 partially supports this clause by auditing print activity, recording which user printed which document on which device, and by extending DLP policies to the print channel so documents classified as sensitive cannot be printed outside approved conditions. Device management interface hardening, protection of spooled data on the device, and network access control for the device itself lie outside Log360. |
| SYS.4.5 Wechseldatenträger. The removable media that may be used shall be restricted, data written to them protected, and their use logged. | Log360 - USB data theft protection with device block lists, USB monitoring, file copy auditing, removable storage auditing, data leak prevention with automated response, read-only device enforcement. | Log360 supports this clause by controlling which removable devices may be attached through block lists and read-only enforcement and blocking the copying of classified files to them, and by recording every attachment and file copy with the user, device, and file detail the logging obligation requires. |
NETNET. Netze und Kommunikation (Networks and communication)
| Clause | Functionality | Explanation |
|---|---|---|
| NET.1.2 Netzmanagement. Management interfaces and protocols shall be secured, administrative access to network devices controlled, and the network monitored for anomalies. | Log360 - network device log analysis for routers, switches, firewalls, IDS and IPS, built-in syslog server, admin logon and failed logon reporting, configuration and rule change auditing, real-time correlation, automated workflow response. | Log360 partially supports this clause by ingesting syslog from network devices and reporting on administrative logons, failed authentication, and configuration changes, and by correlating device events with the rest of the estate to surface anomalies a single device's log would not reveal. Securing management protocols, out-of-band management design, and device hardening are network engineering tasks. |
| NET.3.1 Router und Switches. Administrative access to routers and switches shall be secured, their services restricted, and device activity logged. | Log360 - router and switch log monitoring, admin logon and logoff auditing including failed logons, configuration change reporting, syslog server with auto-configuration, real-time alerting. | Log360 partially supports this clause by collecting and analysing router and switch logs and reporting administrative access and configuration changes on the devices that form the network perimeter, with alerting on changes made outside authorised processes. Device hardening, service reduction, and secure configuration are performed on the devices themselves. |
| NET.3.2 Firewall. The rule set shall be maintained and controlled, administrative access secured, and firewall events logged and evaluated. | Log360 - firewall auditing, security policy and rule change reporting, allowed and denied traffic analysis, threat intelligence matching against malicious IPs and domains, real-time correlation, automated workflow blocking. | Log360 partially supports this clause by auditing firewall rule and policy changes and reporting which traffic was permitted or denied, which is the evaluation the module requires rather than mere retention, and by matching sources against threat feeds to identify communication with known malicious infrastructure. Rule set design, periodic rule review, and the firewall's own hardening are administrative tasks on the device. |
| NET.3.3 VPN. VPN users shall be authenticated strongly, the conditions under which access is granted restricted, and VPN sessions logged. | Log360 - VPN and remote-access log monitoring, remote logon auditing, alerting on anomalous remote access, UEBA risk scoring. | Log360 partially supports this clause by recording VPN session establishment and alerting on connections that deviate from normal patterns, providing the session logging the module requires. Strong authentication for VPN access, gateway configuration, tunnel and cipher selection, and split-tunnelling policy lie outside Log360. |
Conclusion
Now that you've explored how the IT-Grundschutz-Kompendium converts the demanding task of securing information into something structured and repeatable, and how Log360 helps you operationalise its logging, detection, and response modules, it's time to take the next step.
Whether it's centralized log management, threat detection, incident response, or building a compliance-ready audit trail, we're here to guide you through it. Start a 30-day free trial to experience our solutions in your own environment, or contact us to schedule a one-on-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended to serve as professional, legal, or regulatory advice. Alignment with the BSI IT-Grundschutz-Kompendium depends on your organization's specific environment, processes, and risk profile.
To accurately assess your compliance posture, we strongly recommend engaging a qualified consultant, compliance agency, or referring directly to the official IT-Grundschutz-Kompendium published by the Bundesamt für Sicherheit in der Informationstechnik on bsi.bund.de, together with BSI Standards 200-1, 200-2, and 200-3 and the current edition of the compendium.