Determine which areas are to be secured
IT baseline protection from the BSI – what will be important in 2023
BSI baseline protection, also known as “IT baseline protection”, is a concept and methodology developed by the German Federal Office for Information Security (BSI). This approach aims to ensure information security in organizations, especially with regard to the IT infrastructure.
But what exactly is behind it, how can I get certified and how do I prepare for it? We answer these and other questions in this article.
What is IT baseline protection and what is it good for?
BSI IT-Grundschutz is a voluntary security standard of the German Federal Office for Information Security. Similar to ISO 27001, it is dedicated to setting up an information security management system (ISMS) to manage information security in organizations. It offers specific measures for the protection of IT systems with normal protection requirements. This generally saves companies from having to carry out their own risk analysis and enables them to use the BSI’s standard protection. The aim of the BSI is to provide companies and public institutions with a simple and practical approach to improving cyber security.
It is important to know: IT baseline protection is not mandatory. It is merely an aid to improving information security in companies and the provision of general standard measures.
Also good to know: The topic of data protection as defined by the GDPR is not fully covered by IT baseline protection. The topic is touched on, but reference is then made to the requirements of the German data protection authorities.
This is how IT baseline protection is structured
As part of IT baseline protection, there are various BSI standards that you should familiarize yourself with. These define requirements for a management system and methods for implementation. There are four different standards in total:
- BSI standard 200-1: general requirements, guidelines for creating security processes and security concepts
- BSI Standard 200-2: Test basis for certification, detailed specifications for design, implementation and improvement
- BSI Standard 200-3: Procedure for risk analysis, guidelines for own risk assessments for objects with high protection requirements or for which no suitable basic protection module exists
- BSI Standard 200-4: Business Continuity Management, specifies the requirements of the emergency management module
There is also the IT baseline protection compendium. This contains specific measures for the security of your IT infrastructure. They are divided into 10 subject areas with a total of 113 modules. Companies must decide for themselves which modules are relevant to them. You can find out more here: https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/it-grundschutz-kompendium_node.html
The IT baseline protection profiles are also interesting. These are sample examples for the implementation of IT baseline protection based on various application examples. There is a suitable sample for every company.
How to prepare for certification
Below we have briefly listed everything that needs to be done before certification:
This is how the certification process works
The certification process is basically the same as for ISO 27001. After your company has submitted an application for certification, a remote audit takes place in which the submitted documents are reviewed. These include Information security guidelines, structural analysis, protection needs assessment, modeling, IT baseline protection check, risk analysis and the measures implementation plan.
Finally, a second audit takes place on site. This checks the implementation of the security measures. The Federal Office receives the audit report and, in the best case, issues an ISO certificate based on IT baseline protection. Annual audits are then carried out for monitoring purposes.
Our solution – the BAYOOSOFT Access Manager
Identity and access management plays a crucial role in IT baseline protection. There is even a separate module for this – ORP.4 Identity and Authorization Management. But the topic is also relevant in other modules. It is therefore worth taking a closer look at the secure management of accounts and access rights.
ORP.4 in turn lists various requirements (ORP.4.A1 to ORP.4.A17) that companies must meet with regard to their authorization management. These include, for example, that inactive identifiers are deactivated and that each identifier must be uniquely assigned to a person.
The BAYOOSOFT Access Manager helps you to meet these requirements. And the tool also saves you a lot of time and effort. It standardizes the routine tasks of user and authorization management and supports the provision of IT services such as mailboxes, software distribution or telephony. Not only individual tasks, but entire process chains are optimized, which means that the use of resources and error rates are far lower than with manual processing.
