The IT-Grundschutz process is predictable once you know the sequence. Below is the standard path, with references to the specific control areasIT-Grundschutz auditors focus on.
Typical end-to-end timeline: 6 – 18 months.
Step 1 — Scoping
Define exactly what's in scope: product lines, systems, offices, subsidiaries, and third-party processors. Over-scoping is the single biggest cause of IT-Grundschutz cost blowouts; under-scoping risks a scope gap at audit time.
Step 2 — Gap Assessment
Compare your current state against the IT-Grundschutz control set and produce a gap register. Teams typically run this with either an internal lead or a readiness-focused consultant.
Control areas you'll be assessed on
- IT-Grundschutz Compendium process and system modules
- BSI Standard 200-1: Information security management systems
- BSI Standard 200-2: IT-Grundschutz methodology
- BSI Standard 200-3: Risk management
- BSI Standard 200-4: Business continuity management
- Structural analysis, protection needs assessment, and modeling
Step 3 — Remediation
Close the gaps. In practice this is a mix of:
- Technical implementation — MFA, logging, encryption, access reviews, backups, vulnerability management.
- Policy and documentation — information security policy, incident response plan, risk register, data classification, vendor management.
- Process adoption — change tickets with approvals, periodic access reviews, management review meetings, awareness training.
Step 4 — Audit Readiness Review
Many teams run a pre-audit assessment with their chosen auditor (Stage 1 for ISO-family frameworks, readiness assessment for SOC- family). Fix the findings before the formal audit; a nonconformity on the final report is harder to clear.
Step 5 — Formal Audit
BSI certification follows the ISO 27001 cycle: annual surveillance audits with full recertification every 3 years.. Expect interviews, evidence requests, and walk-throughs. Keep an evidence tracker open throughout — you'll be asked to produce everything from HR records to firewall configs.
Step 6 — Ongoing Maintenance
IT-Grundschutz is not a one-off. Plan for annual surveillance audits (or an annual Type II window), periodic management reviews, and evidence collection as a continuous process rather than a sprint before each audit.
Common Pitfalls
- Scope creep during the engagement. Freeze scope at kickoff.
- Policy without practice. Auditors verify behavior, not just documents.
- Last-minute evidence hunts. Evidence should be collected continuously, not scrambled for the audit window.
For cost breakdowns and budget tiers, see the cheapest path to IT-Grundschutz. For when it's worth it, see when and why to pursue IT-Grundschutz.