Skip to content 
IT-Grundschutz
Authorities, municipalities and many companies align their information security with the BSI IT-Grundschutz. For IT decommissioning it is particularly interesting because it expressly regulates the erasure and destruction of data carriers. Here you will learn how IT-Grundschutz is structured, who it applies to and what is currently changing.
In brief
IT-Grundschutz is a methodology of the Federal Office for Information Security (BSI) with which organizations build an information security management system and implement standard measures. It consists of the BSI Standards and a catalog of concrete requirements, until now the IT-Grundschutz Compendium. For IT decommissioning, it determines how data carriers are erased and destroyed in a regulated manner.
Structure and key terms
| Component of the methodology | Contents |
|---|---|
| BSI Standard 200-1 | General requirements for an ISMS, compatible with ISO/IEC 27001 |
| BSI Standard 200-2 | Procedure under IT-Grundschutz with basic, standard and core protection |
| BSI Standard 200-3 | Risk analysis on the basis of IT-Grundschutz |
| BSI Standard 200-4 | Business Continuity Management |
| IT-Grundschutz Compendium | Modules with requirements for typical topics, for example servers, clients, rooms or deletion and destruction |
It begins with the structure analysis: which processes, applications, systems and rooms exist? This is followed by the Protection requirement assessment, that is, the question of how severe damage would be. On this basis the suitable modules are selected and implemented.
Who is IT-Grundschutz relevant for?
For the federal administration, IT-Grundschutz is the authoritative framework. Many federal states, municipalities and public bodies also orient themselves by it. Companies use it voluntarily because it formulates very concrete requirements. Those who need proof can have themselves certified by the BSI to "ISO 27001 on the basis of IT-Grundschutz". For authorities that decommission classified information, further requirements apply, see our guide Decommissioning VS-NfD hardware.
Deletion and destruction in IT-Grundschutz
The Compendium contains, with the Module CON.6 "Deleting and Destroying" its own requirements for decommissioned data carriers. These include a policy on which methods are permissible for which data carriers and which protection requirement, secure storage until erasure, the selection of suitable service providers and documentation. The BSI describes technical details of erasure methods in the guideline TL-03420.
Rule of thumb: IT-Grundschutz does not only ask whether erasure took place, but whether there is a rule for it – and whether compliance with it can be proven.
From IT-Grundschutz to Grundschutz++
The BSI is transferring IT-Grundschutz into a successor model called "Grundschutz++". Requirements are provided there in machine-readable form and are oriented more toward processes and assets than toward modules. The Compendium in the 2023 edition remains applicable for a transition period (as of 10/2026). For ongoing projects, check which version your auditor or client uses as a basis.
Distinction from ISO/IEC 27001
ISO/IEC 27001 is an international standard that describes what an ISMS must achieve but only specifies general measures. IT-Grundschutz is compatible with it and makes the "how" concrete with detailed requirements. Many organizations therefore use ISO/IEC 27001 as the framework and IT-Grundschutz as the catalog of measures.
IT-Grundschutz and Second IT
Second IT is certified to ISO/IEC 27001 and erases data carriers with Blancco, with a digitally signed erasure certificate per device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399 (up to security level H-5 and E-5). In addition there are access control, video surveillance, NDAs, the commitment to data secrecy and VS-NfD-compliant processes – building blocks you can document for your service provider selection. More on Data secrecy and protection of classified information.
Frequently asked questions about IT-Grundschutz
Is IT-Grundschutz mandatory for companies?
For private companies it is generally voluntary. It can become binding through contracts, tenders or industry requirements. For the federal administration it is the authoritative framework.
What does IT-Grundschutz regulate on erasing data carriers?
Module CON.6 "Deletion and Destruction" requires, among other things, a policy on methods per type of data carrier and protection requirement, secure custody until erasure and traceable documentation. The BSI guideline TL-03420 describes concrete technical methods.
What is the difference between IT-Grundschutz and ISO 27001?
ISO/IEC 27001 defines what an ISMS must achieve. IT-Grundschutz additionally describes very concretely how typical systems and processes are to be secured. The two can be combined.
What is the difference between IT-Grundschutz and Grundschutz++?
Grundschutz++ is the BSI's successor model. The requirements there are machine-readable and oriented more toward processes and assets than toward modules. The Compendium in the 2023 edition remains applicable for a transition period (as of 10/2026).
Can you be certified to IT-Grundschutz?
Yes. The BSI certifies to "ISO 27001 on the basis of IT-Grundschutz". The certificate serves as proof that an organization operates an information security management system according to this methodology.
Erasure and destruction with proof – matching your security requirements.
Send us your device list. You will receive your offer in 48 hours on average.