german-it-security

German IT Security Compliance Reference

Code-level checks for BSI IT-Grundschutz, KRITIS, and NIS2UmsuCG. Complements `sovereign-cloud-data-residency.md` (BSI C5, BDSG/DSGVO) and `compliance-checklists.md` (GDPR, SOC 2). Not a full compliance audit — catches the most common violations in pull requests.

---

BSI IT-Grundschutz

Germany's comprehensive IT security methodology. The BSI Kompendium contains 113 modules across 10 subject areas. Achieving Standard-Absicherung qualifies for ISO 27001 certification via BSI.

Module Categories

| Code | Domain | Examples | |------|--------|----------| | ISMS | Security Management | ISMS.1 Security Management | | ORP | Organization & Personnel | ORP.1 Organization, ORP.4 Identity Management | | CON | Concepts & Procedures | CON.1 Cryptography, CON.3 Backup | | OPS | Operations | OPS.1.1.3 Patch Management, OPS.1.2.5 Remote Maintenance | | DER | Detection & Response | DER.1 Detection, DER.2.1 Incident Management | | APP | Applications | APP.1.1 Office Products, APP.5.3 Email | | SYS | IT Systems | SYS.1.1 General Server, SYS.2.1 General Client | | IND | Industrial IT | IND.1 Process Control & Automation | | NET | Networks & Communication | NET.1.1 Network Architecture, NET.3.2 Firewall | | INF | Infrastructure | INF.1 General Building, INF.2 Data Center |

Protection Levels

| Level | Name | Description | |-------|------|-------------| | Basis | Basis-Absicherung | Minimum baseline. Attestation only. | | Standard | Standard-Absicherung | Base + standard controls. Qualifies for ISO 27001 via BSI. | | Core | Kern-Absicherung | Highest security for critical "crown jewel" assets. |

BSI Standards

| Standard | Topic | |----------|-------| | BSI 200-1 | ISMS construction | | BSI 200-2 | IT-Grundschutz methodology | | BSI 200-3 | Risk analysis | | BSI 200-4 | Business continuity management |

Certification Phases

Strukturanalyse > Schutzbedarfsfeststellung > Modellierung > IT-Grundschutz-Check > Risikoanalyse > Umsetzung

Grundschutz vs BSI C5

C5 is already covered in `sovereign-cloud-data-residency.md`. Key differences:

| Dimension | IT-Grundschutz | BSI C5 | |-----------|---------------|--------| | Scope | All institutional IT | Cloud services only | | Type | Certification framework | Audit standard (attestation) | | Focus | Organization's own info protection | Cloud provider offerings | | Output | ISO 27001 certificate (via BSI) | C5 Type 1/2 attestation | | Relationship | Foundation framework | Built on Grundschutz + ISO 27001 + CSA CCM |

Grundschutz++ (2026 Evolution)

Published April 1, 2026. Mandatory ~2028. Available on GitHub: `BSI-Bund/Stand-der-Technik-Bibliothek`.

| Dimension | Classic Grundschutz | Grundschutz++ | |-----------|-------------------|---------------| | Format | Static PDF | Machine-readable JSON (OSCAL 1.1.3) | | Requirements | 6,567 sub-requirements | 985 consolidated (85% reduction) | | Modules | 113 modules | 19 process practices | | Release cycle | Annual | Agile/continuous via GitHub | | Cross-references | Manual | Automated ISO 27001:2022 + NIS2 mappings | | Coverage | Traditional IT | + Cloud, containers, Zero Trust, AI |

Code-Level Checks

| # | Check | Module Ref | |---|-------|------------| | GS-01 | Patch management process documented and automated | OPS.1.1.3 | | GS-02 | Cryptographic algorithms meet BSI TR-02102 standards | CON.1 | | GS-03 | Backup concept with tested restore procedures | CON.3 | | GS-04 | Network segmentation with firewall rules documented | NET.3.2 | | GS-05 | Remote maintenance secured (VPN, MFA, logging) | OPS.1.2.5 | | GS-06 | Incident detection and response procedures implemented | DER.1, DER.2.1 | | GS-07 | Identity management with RBAC and least privilege | ORP.4 | | GS-08 | Server hardening per SYS.1.1 baseline | SYS.1.1 | | GS-09 | Client hardening per SYS.2.1 baseline | SYS.2.1 | | GS-10 | Application security requirements for deployed software | APP.* | | GS-11 | Protection needs classification applied to all assets | ISMS.1 | | GS-12 | Grundschutz++ OSCAL catalog consumption for automated compliance | Grundschutz++ |

---

KRITIS (Critical Infrastructure)

German IT Security Act 2.0 for critical infrastructure operators. Applies to operators exceeding sector-specific thresholds. Retained under NIS2UmsuCG as "critical facilities" with additional obligations.

Sector Classification

| Sector | Threshold | Metric | |--------|-----------|--------| | Energy | 500,000 | People served | | Water | 500,000 | People served | | Food | 500,000 | People served | | IT & Telecom | 500,000 | People served | | Health | 30,000 | Full inpatient cases/year | | Finance | 500,000 | Accounts or transactions | | Transport | 500,000 | Passengers/year or cargo volume | | Government | N/A | Federal administration facilities |

Code-Level Checks

| # | Check | Requirement | |---|-------|-------------| | KR-01 | Attack detection systems (IDS/IPS) with security event correlation | SS8a(1a) BSIG | | KR-02 | Incident reporting to BSI within 24 hours, automated alerting pipeline | SS8b BSIG | | KR-03 | Documentation sufficient for BSI audit at any time | SS8a | | KR-04 | Trusted sources verified, SBOM generated for all deployments | Supply chain | | KR-05 | CVE scanning automated with documented patch timelines | Vulnerability mgmt | | KR-06 | KRITIS systems isolated via network segmentation, micro-segmentation | Network | | KR-07 | Air-gapped or immutable backups, ransomware-resistant | Backup isolation | | KR-08 | Least privilege service accounts, no shared admin credentials | Minimum privilege | | KR-09 | SBOM generation and maintenance for all deployed software | Supply chain security | | KR-10 | Registered security contact with BSI, verified annually | SS8b(3) BSIG | | KR-11 | Biennial security audit per SS8a, results reported to BSI | SS8a(3) BSIG | | KR-12 | KRITIS sector registration and threshold verification completed | SS8d BSIG |

---

NIS2UmsuCG (German