IT-Grundschutz-Kompendium · Edition 2025, transitioning to Grundschutz++

IT-Grundschutz

NIS2 says what you must achieve, never how you demonstrate it. Germany answers with IT-Grundschutz. If you operate there, this is what your regulator reads.

Implementation routes

Modules

111

Member states using it

Reviewed 2026-07-25. Verify against the scheme owner before relying on this for a certification decision.

This framework is not compliance

IT-Grundschutz is formally binding only on the federal administration. The NIS2UmsuCG does not make it mandatory for private entities. It is, however, the benchmark German auditors and insurers apply in practice, which makes it the de facto reference even where no law requires it — and the reason a German implementation plan that ignores it tends to be re-done.

We put that first because it is the most expensive misunderstanding about any national framework. ISO/IEC 27001 is fully accepted, and IT-Grundschutz offers its own certification route "ISO 27001 on the basis of IT-Grundschutz".

Implementation routes

3 routes, chosen by scope and depth

Basis-Absicherung

Breadth before depth: the essential safeguards across the whole estate. Typically three to six months in a mid-sized company.

First step for an organisation with no ISMS

Kern-Absicherung

Depth before breadth: the most critical business processes first, with a full risk analysis under BSI-Standard 200-3.

Organisations with a small number of critical assets

Standard-Absicherung

The full implementation, and the basis for ISO 27001 certification on the basis of IT-Grundschutz. Typically nine to eighteen months.

A complete ISMS, and the route to certification

What it is built on

IT-Grundschutz does not invent its own taxonomy. It sits on BSI-Standards 200-1 (management), 200-2 (methodology), 200-3 (risk analysis) and 200-4 (business continuity).

The Kompendium carries 111 modules — Bausteine — across ten layers, counted in the BSI XML edition itself. Unlike CyFun it is not organised as assurance levels but as three implementation routes, chosen by how much of the organisation you secure and how deeply.

Where it is heading

Grundschutz++ is the modernised variant being introduced across 2025 and 2026: leaner, more explicitly risk-based, and machine-readable via OSCAL.
Organisations whose ISMS is built on the 2024 or 2025 edition can keep that structure through a transition period running to approximately 2029.

Mapping

How it covers the ten NIS2 measures

Article 21(2) is the article of NIS2 — Directive (EU) 2022/2555 — that lists the ten risk-management measures every entity in scope owes, lettered (a) to (j). Those ten letters are the first column of each table on this page, and the keys every mapping we publish hangs off. The ten measures, one by one.

Basis

The Kompendium groups its 111 modules into ten layers: five process layers (ISMS, ORP, CON, OPS, DER) and five system layers (APP, SYS, IND, NET, INF). Each measure is mapped to the layers that carry the relevant modules.

Limit of this mapping

Layer level, not module. Module identifiers change between editions of the Kompendium, so a module-level map would go stale; scope with this, then take the module list from the edition you are working to. The IND layer is mapped to continuity, maintenance and asset control because NIS2 covers OT-heavy sectors — energy, water, manufacturing — where industrial systems carry those outcomes and general IT modules do not reach them.

Mapped at the level of

IT-Grundschutz layer

Units in the framework

Units carrying article 21(2)

Each of the ten risk-management measures of article 21(2), mapped to the IT-Grundschutz layer units of IT-Grundschutz
NIS2 art. 21(2) Directive (EU) 2022/2555	Measure	IT-Grundschutz — IT-Grundschutz layer
(a)	Risk analysis and security policies	ISMS CON ORP
(b)	Incident handling	DER OPS
(c)	Business continuity	CON OPS INF IND
(d)	Supply chain security	ORP OPS
(e)	Security in acquisition, development and maintenance	CON APP OPS IND
(f)	Assessing the effectiveness of the measures	ISMS DER
(g)	Basic cyber hygiene and cybersecurity training	ORP CON
(h)	Cryptography and encryption	CON NET
(i)	Human resources security, access control and asset management	ORP CON SYS APP IND
(j)	Multi-factor authentication and secured communications	NET SYS APP

10 IT-Grundschutz layer units, in full

ISMS — Sicherheitsmanagement — security management
ORP — Organisation und Personal — organisation and personnel
CON — Konzepte und Vorgehensweisen — concepts and procedures
OPS — Betrieb — operations
DER — Detektion und Reaktion — detection and response
APP — Anwendungen — applications
SYS — IT-Systeme — IT systems
IND — Industrielle IT — industrial IT and OT
NET — Netze und Kommunikation — networks and communication
INF — Infrastruktur — physical infrastructure

The chain continues

What you already have, for the same measure

Nobody in scope starts from nothing. IT-Grundschutz is what your supervisor reads; ISO 27001 and NIST 800-53 are what most organisations already run. Read a row across and you have the whole path, from the article to the control you can point at today.

The ten measures of article 21(2), each mapped to IT-Grundschutz and to the enterprise frameworks an organisation is likely to already operate
NIS2 art. 21(2) Directive (EU) 2022/2555	IT-Grundschutz	ISO 27001 ISO/IEC 27001:2022 Annex A control	NIST 800-53 NIST SP 800-53 Rev. 5 control family
(a) Risk analysis	ISMS CON ORP	5.1 5.2 5.3 5.4 5.7 5.31 5.35 5.36	RA PL PM
(b) Incident handling	DER OPS	5.5 5.6 5.7 5.24 5.25 5.26 5.27 5.28 6.8 8.15 8.16	IR AU SI
(c) Continuity	CON OPS INF IND	5.29 5.30 7.5 7.11 7.12 8.13 8.14	CP PE
(d) Supply chain	ORP OPS	5.19 5.20 5.21 5.22 5.23	SR SA
(e) Secure development	CON APP OPS IND	5.8 8.8 8.9 8.25 8.26 8.27 8.28 8.29 8.30 8.31 8.32 8.33 8.34	SA CM MA RA SI
(f) Effectiveness	ISMS DER	5.33 5.35 5.36 8.16	CA PM
(g) Hygiene and training	ORP CON	5.37 6.3 8.7	AT SI CM
(h) Cryptography	CON NET	8.24	SC
(i) HR, access, assets	ORP CON SYS APP IND	5.9 5.10 5.11 5.12 5.13 5.15 5.16 5.17 5.18 6.1 6.2 6.4 6.5 6.6 6.7 7.1 7.2 7.3 7.4 7.6 7.7 7.8 7.9 7.10 7.13 7.14 8.1 8.2 8.3 8.4 8.10 8.11 8.12 8.18 8.19	PS AC IA CM MP PE
(j) MFA and comms	NET SYS APP	5.14 8.5 8.6 8.17 8.20 8.21 8.22 8.23	IA AC SC

A crosswalk is not an equivalence

Holding the controls in a row does not discharge the measure. Each framework words its requirement differently, and each mapping has a stated limit:

ISO 27001 — Mapping a control does not make it applicable: applicability comes from your risk assessment and your Statement of Applicability. Note also that the risk-assessment obligation of article 21(2)(a) is carried by clause 6.1 of the standard, not by Annex A — a control-only reading misses it.
NIST 800-53 — Family level, not control. A family contains controls of very different scope, and which of them apply depends on the baseline and tailoring you operate — so a family match is a starting point for scoping, never evidence that a measure is met.

Use a row to find the evidence you already hold, then read the requirement itself.

Measure catalogue

2124 Anforderungen, and the level each one enters at

A mapping says which of the ten measures a framework serves. A catalogue says which Anforderung, at which level. Here are all 2124, as Bundesamt für Sicherheit in der Informationstechnik (BSI) publishes them.

Anforderungen

2124

Layers

Bausteine

111

What this page does not reproduce, and why

This site is commercial. The layer and module index below is a cited structural reference; reproducing 2,124 requirement titles in full would not be quotation, and would need the BSI to say yes first.

Withheld here, and only here:

the wording of each Anforderung

Where to read something equivalent. E-ITS, the Estonian standard derived from IT-Grundschutz, publishes a module with this code under CC BY-SA 4.0. Its requirements are numbered differently and worded in Estonian: read it as a sibling, never as a translation.

BSI terms of use: commercial use of IT-Grundschutz content requires the prior consent of the BSI. Quotation with source attribution is permitted. Read the terms. Consent to publish the rest is theirs to give: poststelle@bsi.bund.de.

BSI, IT-Grundschutz-Kompendium Edition 2023, DocBook XML edition

Get the official documents from https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/it-grundschutz-kompendium_node.html — the framework and everything published with it belong to its owner, and that publication is the version that binds.

Requirement titles are in German, as published. Translating them would put a paraphrase where a supervisor reads an exact wording.
H requirements are not a tier everyone climbs: they apply where the protection need is elevated, which each organisation determines for itself.
The BSI publishes no crosswalk to article 21(2). The letters shown on the page are our own thematic mapping, at layer level.

What each level adds

Depth here is one thing: how many more Anforderungen the next level pulls in. Each level contains everything below it, which is checked on every extraction.

IT-Grundschutz levels: Anforderungen added, cumulative total
Level	Adds	Cumulative
Basis (B)	+652	652
Standard (S)	+1014	1666
Erhöhter Schutzbedarf (H)	+458	2124

What these levels are, and are not

These are the three requirement levels the BSI writes into every Anforderung title: Basis (B), Standard (S) and erhöhter Schutzbedarf (H). They are not the three Vorgehensweisen — Basis-, Kern- and Standard-Absicherung — listed higher up this page, which say how far across the organisation you take the method rather than how deep each requirement goes.

The catalogue, Anforderung by Anforderung

10 layers, 111 bausteine, 2124 Anforderungen. Each row carries the level at which it becomes due.

ISMS — Sicherheitsmanagement · 17 Anforderungen

Sicherheitsmanagement (ISMS.1)

Also published freely as E-ITS version 2024 ISMS.1

IT-Grundschutz Anforderungen in ISMS.1, Sicherheitsmanagement
Anforderung	Level
ISMS.1.A1	Basis (B)
ISMS.1.A2	Basis (B)
ISMS.1.A3	Basis (B)
ISMS.1.A4	Basis (B)
ISMS.1.A5	Basis (B)
ISMS.1.A6	Basis (B)
ISMS.1.A7	Basis (B)
ISMS.1.A8	Basis (B)
ISMS.1.A9	Basis (B)
ISMS.1.A10	Standard (S)
ISMS.1.A11	Standard (S)
ISMS.1.A12	Standard (S)
ISMS.1.A13	Standard (S)
ISMS.1.A14	Standard (S)
ISMS.1.A15	Standard (S)
ISMS.1.A16	Erhöhter Schutzbedarf (H)
ISMS.1.A17	Erhöhter Schutzbedarf (H)

ORP — Organisation und Personal · 76 Anforderungen

Organisation (ORP.1)

Also published freely as E-ITS version 2024 ORP.1

IT-Grundschutz Anforderungen in ORP.1, Organisation
Anforderung	Level
ORP.1.A1	Basis (B)
ORP.1.A2	Basis (B)
ORP.1.A3	Basis (B)
ORP.1.A4	Basis (B)
ORP.1.A5	Basis (B)
ORP.1.A6	Standard (S)
ORP.1.A7	Standard (S)
ORP.1.A8	Standard (S)
ORP.1.A9	Standard (S)
ORP.1.A10	Standard (S)
ORP.1.A11	Standard (S)
ORP.1.A12	Standard (S)
ORP.1.A13	Standard (S)
ORP.1.A14	Erhöhter Schutzbedarf (H)
ORP.1.A15	Basis (B)
ORP.1.A16	Standard (S)
ORP.1.A17	Erhöhter Schutzbedarf (H)

Personal (ORP.2)

Also published freely as E-ITS version 2024 ORP.2

IT-Grundschutz Anforderungen in ORP.2, Personal
Anforderung	Level
ORP.2.A1	Basis (B)
ORP.2.A2	Basis (B)
ORP.2.A3	Basis (B)
ORP.2.A4	Basis (B)
ORP.2.A5	Basis (B)
ORP.2.A6	Standard (S)
ORP.2.A7	Standard (S)
ORP.2.A8	Standard (S)
ORP.2.A9	Standard (S)
ORP.2.A10	Standard (S)
ORP.2.A11	Erhöhter Schutzbedarf (H)
ORP.2.A12	Erhöhter Schutzbedarf (H)
ORP.2.A13	Erhöhter Schutzbedarf (H)
ORP.2.A14	Basis (B)
ORP.2.A15	Basis (B)

Sensibilisierung und Schulung zur Informationssicherheit (ORP.3)

Also published freely as E-ITS version 2024 ORP.3

IT-Grundschutz Anforderungen in ORP.3, Sensibilisierung und Schulung zur Informationssicherheit
Anforderung	Level
ORP.3.A1	Basis (B)
ORP.3.A2	Basis (B)
ORP.3.A3	Basis (B)
ORP.3.A4	Standard (S)
ORP.3.A5	Standard (S)
ORP.3.A6	Standard (S)
ORP.3.A7	Standard (S)
ORP.3.A8	Standard (S)
ORP.3.A9	Erhöhter Schutzbedarf (H)

Identitäts- und Berechtigungsmanagement (ORP.4)

Also published freely as E-ITS version 2024 ORP.4

IT-Grundschutz Anforderungen in ORP.4, Identitäts- und Berechtigungsmanagement
Anforderung	Level
ORP.4.A1	Basis (B)
ORP.4.A2	Basis (B)
ORP.4.A3	Basis (B)
ORP.4.A4	Basis (B)
ORP.4.A5	Basis (B)
ORP.4.A6	Basis (B)
ORP.4.A7	Basis (B)
ORP.4.A8	Basis (B)
ORP.4.A9	Basis (B)
ORP.4.A10	Standard (S)
ORP.4.A11	Standard (S)
ORP.4.A12	Standard (S)
ORP.4.A13	Standard (S)
ORP.4.A14	Standard (S)
ORP.4.A15	Standard (S)
ORP.4.A16	Standard (S)
ORP.4.A17	Standard (S)
ORP.4.A18	Standard (S)
ORP.4.A19	Standard (S)
ORP.4.A20	Erhöhter Schutzbedarf (H)
ORP.4.A21	Erhöhter Schutzbedarf (H)
ORP.4.A22	Basis (B)
ORP.4.A23	Basis (B)
ORP.4.A24	Erhöhter Schutzbedarf (H)

Compliance Management (Anforderungsmanagement) (ORP.5)

Also published freely as E-ITS version 2024 ORP.5

IT-Grundschutz Anforderungen in ORP.5, Compliance Management (Anforderungsmanagement)
Anforderung	Level
ORP.5.A1	Basis (B)
ORP.5.A2	Basis (B)
ORP.5.A3	Basis (B)
ORP.5.A4	Standard (S)
ORP.5.A5	Standard (S)
ORP.5.A6	Standard (S)
ORP.5.A7	Standard (S)
ORP.5.A8	Standard (S)
ORP.5.A9	Erhöhter Schutzbedarf (H)
ORP.5.A10	Erhöhter Schutzbedarf (H)
ORP.5.A11	Erhöhter Schutzbedarf (H)

CON — Konzepte und Vorgehensweisen · 135 Anforderungen

Kryptokonzept (CON.1)

Also published freely as E-ITS version 2024 CON.1

IT-Grundschutz Anforderungen in CON.1, Kryptokonzept
Anforderung	Level
CON.1.A1	Basis (B)
CON.1.A2	Basis (B)
CON.1.A3	Standard (S)
CON.1.A4	Basis (B)
CON.1.A5	Standard (S)
CON.1.A6	Standard (S)
CON.1.A7	Standard (S)
CON.1.A8	Standard (S)
CON.1.A9	Standard (S)
CON.1.A10	Standard (S)
CON.1.A11	Erhöhter Schutzbedarf (H)
CON.1.A12	Erhöhter Schutzbedarf (H)
CON.1.A13	Erhöhter Schutzbedarf (H)
CON.1.A14	Erhöhter Schutzbedarf (H)
CON.1.A15	Standard (S)
CON.1.A16	Erhöhter Schutzbedarf (H)
CON.1.A17	Erhöhter Schutzbedarf (H)
CON.1.A18	Erhöhter Schutzbedarf (H)
CON.1.A19	Standard (S)
CON.1.A20	Erhöhter Schutzbedarf (H)

Datenschutz (CON.2)

Also published freely as E-ITS version 2024 CON.2

IT-Grundschutz Anforderungen in CON.2, Datenschutz
Anforderung	Level
CON.2.A1	Basis (B)

Datensicherungskonzept (CON.3)

Also published freely as E-ITS version 2024 CON.3

IT-Grundschutz Anforderungen in CON.3, Datensicherungskonzept
Anforderung	Level
CON.3.A1	Basis (B)
CON.3.A2	Basis (B)
CON.3.A3	Basis (B)
CON.3.A4	Basis (B)
CON.3.A5	Basis (B)
CON.3.A6	Standard (S)
CON.3.A7	Standard (S)
CON.3.A8	Standard (S)
CON.3.A9	Standard (S)
CON.3.A10	Standard (S)
CON.3.A11	Standard (S)
CON.3.A12	Basis (B)
CON.3.A13	Erhöhter Schutzbedarf (H)
CON.3.A14	Basis (B)
CON.3.A15	Basis (B)

Löschen und Vernichten (CON.6)

Also published freely as E-ITS version 2024 CON.6

IT-Grundschutz Anforderungen in CON.6, Löschen und Vernichten
Anforderung	Level
CON.6.A1	Basis (B)
CON.6.A2	Basis (B)
CON.6.A3	Standard (S)
CON.6.A4	Standard (S)
CON.6.A5	Standard (S)
CON.6.A6	Standard (S)
CON.6.A7	Standard (S)
CON.6.A8	Standard (S)
CON.6.A9	Standard (S)
CON.6.A10	Erhöhter Schutzbedarf (H)
CON.6.A11	Basis (B)
CON.6.A12	Basis (B)
CON.6.A13	Standard (S)
CON.6.A14	Erhöhter Schutzbedarf (H)

Informationssicherheit auf Auslandsreisen (CON.7)

Also published freely as E-ITS version 2024 CON.7

IT-Grundschutz Anforderungen in CON.7, Informationssicherheit auf Auslandsreisen
Anforderung	Level
CON.7.A1	Basis (B)
CON.7.A2	Basis (B)
CON.7.A3	Basis (B)
CON.7.A4	Basis (B)
CON.7.A5	Basis (B)
CON.7.A6	Basis (B)
CON.7.A7	Basis (B)
CON.7.A8	Basis (B)
CON.7.A9	Basis (B)
CON.7.A10	Basis (B)
CON.7.A11	Standard (S)
CON.7.A12	Basis (B)
CON.7.A13	Standard (S)
CON.7.A14	Standard (S)
CON.7.A15	Erhöhter Schutzbedarf (H)
CON.7.A16	Erhöhter Schutzbedarf (H)
CON.7.A17	Erhöhter Schutzbedarf (H)
CON.7.A18	Erhöhter Schutzbedarf (H)

Software-Entwicklung (CON.8)

Also published freely as E-ITS version 2024 CON.8

IT-Grundschutz Anforderungen in CON.8, Software-Entwicklung
Anforderung	Level
CON.8.A1	Standard (S)
CON.8.A2	Basis (B)
CON.8.A3	Basis (B)
CON.8.A4	Basis (B)
CON.8.A5	Basis (B)
CON.8.A6	Basis (B)
CON.8.A7	Basis (B)
CON.8.A8	Basis (B)
CON.8.A9	Basis (B)
CON.8.A10	Basis (B)
CON.8.A11	Standard (S)
CON.8.A12	Standard (S)
CON.8.A13	Standard (S)
CON.8.A14	Standard (S)
CON.8.A15	Standard (S)
CON.8.A16	Standard (S)
CON.8.A17	Erhöhter Schutzbedarf (H)
CON.8.A18	Erhöhter Schutzbedarf (H)
CON.8.A19	Erhöhter Schutzbedarf (H)
CON.8.A20	Basis (B)
CON.8.A21	Standard (S)
CON.8.A22	Standard (S)

Informationsaustausch (CON.9)

Also published freely as E-ITS version 2024 CON.9

IT-Grundschutz Anforderungen in CON.9, Informationsaustausch
Anforderung	Level
CON.9.A1	Basis (B)
CON.9.A2	Basis (B)
CON.9.A3	Basis (B)
CON.9.A4	Standard (S)
CON.9.A5	Standard (S)
CON.9.A6	Standard (S)
CON.9.A7	Standard (S)
CON.9.A8	Standard (S)
CON.9.A9	Erhöhter Schutzbedarf (H)

Entwicklung von Webanwendungen (CON.10)

Also published freely as E-ITS version 2024 CON.10

IT-Grundschutz Anforderungen in CON.10, Entwicklung von Webanwendungen
Anforderung	Level
CON.10.A1	Basis (B)
CON.10.A2	Basis (B)
CON.10.A3	Basis (B)
CON.10.A4	Basis (B)
CON.10.A5	Basis (B)
CON.10.A6	Basis (B)
CON.10.A7	Basis (B)
CON.10.A8	Basis (B)
CON.10.A9	Basis (B)
CON.10.A10	Basis (B)
CON.10.A11	Standard (S)
CON.10.A12	Standard (S)
CON.10.A13	Standard (S)
CON.10.A14	Standard (S)
CON.10.A15	Standard (S)
CON.10.A16	Standard (S)
CON.10.A17	Erhöhter Schutzbedarf (H)
CON.10.A18	Erhöhter Schutzbedarf (H)

Geheimschutz VS-NUR FÜR DEN DIENSTGEBRAUCH (VS-NfD) (CON.11.1)

IT-Grundschutz Anforderungen in CON.11.1, Geheimschutz VS-NUR FÜR DEN DIENSTGEBRAUCH (VS-NfD)
Anforderung	Level
CON.11.1.A1	Basis (B)
CON.11.1.A2	Basis (B)
CON.11.1.A3	Basis (B)
CON.11.1.A4	Basis (B)
CON.11.1.A5	Basis (B)
CON.11.1.A6	Basis (B)
CON.11.1.A7	Basis (B)
CON.11.1.A8	Basis (B)
CON.11.1.A9	Basis (B)
CON.11.1.A10	Basis (B)
CON.11.1.A11	Basis (B)
CON.11.1.A12	Basis (B)
CON.11.1.A13	Basis (B)
CON.11.1.A14	Basis (B)
CON.11.1.A15	Basis (B)
CON.11.1.A16	Basis (B)
CON.11.1.A17	Basis (B)
CON.11.1.A18	Basis (B)

OPS — Betrieb · 274 Anforderungen

Allgemeiner IT-Betrieb (OPS.1.1.1)

Also published freely as E-ITS version 2024 OPS.1.1.1

IT-Grundschutz Anforderungen in OPS.1.1.1, Allgemeiner IT-Betrieb
Anforderung	Level
OPS.1.1.1.A1	Basis (B)
OPS.1.1.1.A2	Basis (B)
OPS.1.1.1.A3	Standard (S)
OPS.1.1.1.A4	Standard (S)
OPS.1.1.1.A5	Standard (S)
OPS.1.1.1.A6	Standard (S)
OPS.1.1.1.A7	Standard (S)
OPS.1.1.1.A8	Standard (S)
OPS.1.1.1.A9	Standard (S)
OPS.1.1.1.A10	Standard (S)
OPS.1.1.1.A11	Standard (S)
OPS.1.1.1.A12	Standard (S)
OPS.1.1.1.A13	Standard (S)
OPS.1.1.1.A14	Standard (S)
OPS.1.1.1.A15	Standard (S)
OPS.1.1.1.A16	Standard (S)
OPS.1.1.1.A17	Standard (S)
OPS.1.1.1.A18	Standard (S)
OPS.1.1.1.A19	Standard (S)
OPS.1.1.1.A20	Standard (S)
OPS.1.1.1.A21	Erhöhter Schutzbedarf (H)
OPS.1.1.1.A22	Erhöhter Schutzbedarf (H)
OPS.1.1.1.A23	Erhöhter Schutzbedarf (H)
OPS.1.1.1.A24	Erhöhter Schutzbedarf (H)
OPS.1.1.1.A25	Erhöhter Schutzbedarf (H)
OPS.1.1.1.A26	Erhöhter Schutzbedarf (H)

Ordnungsgemäße IT-Administration (OPS.1.1.2)

Also published freely as E-ITS version 2024 OPS.1.1.2

IT-Grundschutz Anforderungen in OPS.1.1.2, Ordnungsgemäße IT-Administration
Anforderung	Level
OPS.1.1.2.A1	Basis (B)
OPS.1.1.2.A2	Basis (B)
OPS.1.1.2.A3	Basis (B)
OPS.1.1.2.A4	Basis (B)
OPS.1.1.2.A5	Basis (B)
OPS.1.1.2.A6	Basis (B)
OPS.1.1.2.A7	Standard (S)
OPS.1.1.2.A8	Standard (S)
OPS.1.1.2.A9	Standard (S)
OPS.1.1.2.A10	Standard (S)
OPS.1.1.2.A11	Standard (S)
OPS.1.1.2.A12	Standard (S)
OPS.1.1.2.A13	Standard (S)
OPS.1.1.2.A14	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A15	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A16	Standard (S)
OPS.1.1.2.A17	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A18	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A19	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A20	Standard (S)
OPS.1.1.2.A21	Basis (B)
OPS.1.1.2.A22	Basis (B)
OPS.1.1.2.A23	Standard (S)
OPS.1.1.2.A24	Standard (S)
OPS.1.1.2.A25	Standard (S)
OPS.1.1.2.A26	Standard (S)
OPS.1.1.2.A27	Standard (S)
OPS.1.1.2.A28	Standard (S)
OPS.1.1.2.A29	Erhöhter Schutzbedarf (H)
OPS.1.1.2.A30	Erhöhter Schutzbedarf (H)

Patch- und Änderungsmanagement (OPS.1.1.3)

Also published freely as E-ITS version 2024 OPS.1.1.3

IT-Grundschutz Anforderungen in OPS.1.1.3, Patch- und Änderungsmanagement
Anforderung	Level
OPS.1.1.3.A1	Basis (B)
OPS.1.1.3.A2	Basis (B)
OPS.1.1.3.A3	Basis (B)
OPS.1.1.3.A4	Standard (S)
OPS.1.1.3.A5	Standard (S)
OPS.1.1.3.A6	Standard (S)
OPS.1.1.3.A7	Standard (S)
OPS.1.1.3.A8	Standard (S)
OPS.1.1.3.A9	Standard (S)
OPS.1.1.3.A10	Standard (S)
OPS.1.1.3.A11	Standard (S)
OPS.1.1.3.A12	Erhöhter Schutzbedarf (H)
OPS.1.1.3.A13	Erhöhter Schutzbedarf (H)
OPS.1.1.3.A14	Erhöhter Schutzbedarf (H)
OPS.1.1.3.A15	Basis (B)
OPS.1.1.3.A16	Basis (B)

Schutz vor Schadprogrammen (OPS.1.1.4)

Also published freely as E-ITS version 2024 OPS.1.1.4

IT-Grundschutz Anforderungen in OPS.1.1.4, Schutz vor Schadprogrammen
Anforderung	Level
OPS.1.1.4.A1	Basis (B)
OPS.1.1.4.A2	Basis (B)
OPS.1.1.4.A3	Basis (B)
OPS.1.1.4.A4	Basis (B)
OPS.1.1.4.A5	Basis (B)
OPS.1.1.4.A6	Basis (B)
OPS.1.1.4.A7	Basis (B)
OPS.1.1.4.A8	Standard (S)
OPS.1.1.4.A9	Standard (S)
OPS.1.1.4.A10	Erhöhter Schutzbedarf (H)
OPS.1.1.4.A11	Erhöhter Schutzbedarf (H)
OPS.1.1.4.A12	Erhöhter Schutzbedarf (H)
OPS.1.1.4.A13	Erhöhter Schutzbedarf (H)
OPS.1.1.4.A14	Erhöhter Schutzbedarf (H)
OPS.1.1.4.A15	Erhöhter Schutzbedarf (H)

Protokollierung (OPS.1.1.5)

Also published freely as E-ITS version 2024 OPS.1.1.5

IT-Grundschutz Anforderungen in OPS.1.1.5, Protokollierung
Anforderung	Level
OPS.1.1.5.A1	Basis (B)
OPS.1.1.5.A2	Basis (B)
OPS.1.1.5.A3	Basis (B)
OPS.1.1.5.A4	Basis (B)
OPS.1.1.5.A5	Basis (B)
OPS.1.1.5.A6	Standard (S)
OPS.1.1.5.A7	Standard (S)
OPS.1.1.5.A8	Standard (S)
OPS.1.1.5.A9	Standard (S)
OPS.1.1.5.A10	Standard (S)
OPS.1.1.5.A11	Erhöhter Schutzbedarf (H)
OPS.1.1.5.A12	Erhöhter Schutzbedarf (H)
OPS.1.1.5.A13	Erhöhter Schutzbedarf (H)

Software-Tests und -Freigaben (OPS.1.1.6)

Also published freely as E-ITS version 2024 OPS.1.1.6

IT-Grundschutz Anforderungen in OPS.1.1.6, Software-Tests und -Freigaben
Anforderung	Level
OPS.1.1.6.A1	Basis (B)
OPS.1.1.6.A2	Basis (B)
OPS.1.1.6.A3	Basis (B)
OPS.1.1.6.A4	Basis (B)
OPS.1.1.6.A5	Basis (B)
OPS.1.1.6.A6	Standard (S)
OPS.1.1.6.A7	Standard (S)
OPS.1.1.6.A8	Standard (S)
OPS.1.1.6.A9	Standard (S)
OPS.1.1.6.A10	Standard (S)
OPS.1.1.6.A11	Basis (B)
OPS.1.1.6.A12	Standard (S)
OPS.1.1.6.A13	Standard (S)
OPS.1.1.6.A14	Erhöhter Schutzbedarf (H)
OPS.1.1.6.A15	Standard (S)
OPS.1.1.6.A16	Erhöhter Schutzbedarf (H)

Systemmanagement (OPS.1.1.7)

Also published freely as E-ITS version 2024 OPS.1.1.7

IT-Grundschutz Anforderungen in OPS.1.1.7, Systemmanagement
Anforderung	Level
OPS.1.1.7.A1	Basis (B)
OPS.1.1.7.A2	Basis (B)
OPS.1.1.7.A3	Basis (B)
OPS.1.1.7.A4	Basis (B)
OPS.1.1.7.A5	Basis (B)
OPS.1.1.7.A6	Basis (B)
OPS.1.1.7.A7	Standard (S)
OPS.1.1.7.A8	Standard (S)
OPS.1.1.7.A9	Standard (S)
OPS.1.1.7.A10	Standard (S)
OPS.1.1.7.A11	Standard (S)
OPS.1.1.7.A12	Standard (S)
OPS.1.1.7.A13	Standard (S)
OPS.1.1.7.A14	Standard (S)
OPS.1.1.7.A15	Standard (S)
OPS.1.1.7.A16	Standard (S)
OPS.1.1.7.A17	Standard (S)
OPS.1.1.7.A18	Standard (S)
OPS.1.1.7.A19	Standard (S)
OPS.1.1.7.A20	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A21	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A22	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A23	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A24	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A25	Erhöhter Schutzbedarf (H)
OPS.1.1.7.A26	Erhöhter Schutzbedarf (H)

Archivierung (OPS.1.2.2)

Also published freely as E-ITS version 2024 OPS.1.2.2

IT-Grundschutz Anforderungen in OPS.1.2.2, Archivierung
Anforderung	Level
OPS.1.2.2.A1	Basis (B)
OPS.1.2.2.A2	Basis (B)
OPS.1.2.2.A3	Basis (B)
OPS.1.2.2.A4	Basis (B)
OPS.1.2.2.A5	Basis (B)
OPS.1.2.2.A6	Basis (B)
OPS.1.2.2.A7	Basis (B)
OPS.1.2.2.A8	Basis (B)
OPS.1.2.2.A9	Basis (B)
OPS.1.2.2.A10	Standard (S)
OPS.1.2.2.A11	Standard (S)
OPS.1.2.2.A12	Standard (S)
OPS.1.2.2.A13	Standard (S)
OPS.1.2.2.A14	Standard (S)
OPS.1.2.2.A15	Standard (S)
OPS.1.2.2.A16	Standard (S)
OPS.1.2.2.A17	Standard (S)
OPS.1.2.2.A18	Standard (S)
OPS.1.2.2.A19	Standard (S)
OPS.1.2.2.A20	Erhöhter Schutzbedarf (H)
OPS.1.2.2.A21	Erhöhter Schutzbedarf (H)

Telearbeit (OPS.1.2.4)

Also published freely as E-ITS version 2024 OPS.1.2.4

IT-Grundschutz Anforderungen in OPS.1.2.4, Telearbeit
Anforderung	Level
OPS.1.2.4.A1	Basis (B)
OPS.1.2.4.A2	Basis (B)
OPS.1.2.4.A3	Basis (B)
OPS.1.2.4.A4	Basis (B)
OPS.1.2.4.A5	Basis (B)
OPS.1.2.4.A6	Standard (S)
OPS.1.2.4.A7	Standard (S)
OPS.1.2.4.A8	Standard (S)
OPS.1.2.4.A9	Standard (S)
OPS.1.2.4.A10	Standard (S)

Fernwartung (OPS.1.2.5)

Also published freely as E-ITS version 2024 OPS.1.2.5

IT-Grundschutz Anforderungen in OPS.1.2.5, Fernwartung
Anforderung	Level
OPS.1.2.5.A1	Basis (B)
OPS.1.2.5.A2	Basis (B)
OPS.1.2.5.A3	Basis (B)
OPS.1.2.5.A4	Basis (B)
OPS.1.2.5.A5	Standard (S)
OPS.1.2.5.A6	Standard (S)
OPS.1.2.5.A7	Standard (S)
OPS.1.2.5.A8	Standard (S)
OPS.1.2.5.A9	Standard (S)
OPS.1.2.5.A10	Standard (S)
OPS.1.2.5.A11	Standard (S)
OPS.1.2.5.A12	Standard (S)
OPS.1.2.5.A13	Standard (S)
OPS.1.2.5.A14	Erhöhter Schutzbedarf (H)
OPS.1.2.5.A15	Standard (S)
OPS.1.2.5.A16	Standard (S)
OPS.1.2.5.A17	Standard (S)
OPS.1.2.5.A18	Standard (S)
OPS.1.2.5.A19	Standard (S)
OPS.1.2.5.A20	Standard (S)
OPS.1.2.5.A21	Standard (S)
OPS.1.2.5.A22	Erhöhter Schutzbedarf (H)
OPS.1.2.5.A23	Erhöhter Schutzbedarf (H)
OPS.1.2.5.A24	Standard (S)
OPS.1.2.5.A25	Standard (S)

NTP-Zeitsynchronisation (OPS.1.2.6)

Also published freely as E-ITS version 2024 OPS.1.2.6

IT-Grundschutz Anforderungen in OPS.1.2.6, NTP-Zeitsynchronisation
Anforderung	Level
OPS.1.2.6.A1	Basis (B)
OPS.1.2.6.A2	Basis (B)
OPS.1.2.6.A3	Basis (B)
OPS.1.2.6.A4	Basis (B)
OPS.1.2.6.A5	Standard (S)
OPS.1.2.6.A6	Standard (S)
OPS.1.2.6.A7	Standard (S)
OPS.1.2.6.A8	Standard (S)
OPS.1.2.6.A9	Erhöhter Schutzbedarf (H)
OPS.1.2.6.A10	Erhöhter Schutzbedarf (H)
OPS.1.2.6.A11	Erhöhter Schutzbedarf (H)
OPS.1.2.6.A12	Erhöhter Schutzbedarf (H)

Cloud-Nutzung (OPS.2.2)

Also published freely as E-ITS version 2024 OPS.2.2

IT-Grundschutz Anforderungen in OPS.2.2, Cloud-Nutzung
Anforderung	Level
OPS.2.2.A1	Basis (B)
OPS.2.2.A2	Basis (B)
OPS.2.2.A3	Basis (B)
OPS.2.2.A4	Basis (B)
OPS.2.2.A5	Standard (S)
OPS.2.2.A6	Standard (S)
OPS.2.2.A7	Standard (S)
OPS.2.2.A8	Standard (S)
OPS.2.2.A9	Standard (S)
OPS.2.2.A10	Standard (S)
OPS.2.2.A11	Standard (S)
OPS.2.2.A12	Standard (S)
OPS.2.2.A13	Standard (S)
OPS.2.2.A14	Standard (S)
OPS.2.2.A15	Erhöhter Schutzbedarf (H)
OPS.2.2.A16	Erhöhter Schutzbedarf (H)
OPS.2.2.A17	Erhöhter Schutzbedarf (H)
OPS.2.2.A18	Erhöhter Schutzbedarf (H)
OPS.2.2.A19	Erhöhter Schutzbedarf (H)

Nutzung von Outsourcing (OPS.2.3)

Also published freely as E-ITS version 2024 OPS.2.3

IT-Grundschutz Anforderungen in OPS.2.3, Nutzung von Outsourcing
Anforderung	Level
OPS.2.3.A1	Basis (B)
OPS.2.3.A2	Basis (B)
OPS.2.3.A3	Basis (B)
OPS.2.3.A4	Basis (B)
OPS.2.3.A5	Basis (B)
OPS.2.3.A6	Basis (B)
OPS.2.3.A7	Basis (B)
OPS.2.3.A8	Standard (S)
OPS.2.3.A9	Standard (S)
OPS.2.3.A10	Standard (S)
OPS.2.3.A11	Standard (S)
OPS.2.3.A12	Standard (S)
OPS.2.3.A13	Standard (S)
OPS.2.3.A14	Standard (S)
OPS.2.3.A15	Standard (S)
OPS.2.3.A16	Standard (S)
OPS.2.3.A17	Standard (S)
OPS.2.3.A18	Standard (S)
OPS.2.3.A19	Standard (S)
OPS.2.3.A20	Standard (S)
OPS.2.3.A21	Erhöhter Schutzbedarf (H)
OPS.2.3.A23	Erhöhter Schutzbedarf (H)
OPS.2.3.A24	Erhöhter Schutzbedarf (H)
OPS.2.3.A25	Erhöhter Schutzbedarf (H)

Anbieten von Outsourcing (OPS.3.2)

Also published freely as E-ITS version 2024 OPS.3.2

IT-Grundschutz Anforderungen in OPS.3.2, Anbieten von Outsourcing
Anforderung	Level
OPS.3.2.A1	Basis (B)
OPS.3.2.A2	Basis (B)
OPS.3.2.A3	Basis (B)
OPS.3.2.A4	Basis (B)
OPS.3.2.A5	Basis (B)
OPS.3.2.A6	Basis (B)
OPS.3.2.A7	Standard (S)
OPS.3.2.A8	Standard (S)
OPS.3.2.A9	Standard (S)
OPS.3.2.A10	Standard (S)
OPS.3.2.A11	Standard (S)
OPS.3.2.A12	Standard (S)
OPS.3.2.A13	Standard (S)
OPS.3.2.A14	Standard (S)
OPS.3.2.A15	Standard (S)
OPS.3.2.A16	Standard (S)
OPS.3.2.A17	Standard (S)
OPS.3.2.A18	Standard (S)
OPS.3.2.A19	Erhöhter Schutzbedarf (H)
OPS.3.2.A20	Erhöhter Schutzbedarf (H)
OPS.3.2.A21	Erhöhter Schutzbedarf (H)

DER — Detektion und Reaktion · 132 Anforderungen

Detektion von sicherheitsrelevanten Ereignissen (DER.1)

Also published freely as E-ITS version 2024 DER.1

IT-Grundschutz Anforderungen in DER.1, Detektion von sicherheitsrelevanten Ereignissen
Anforderung	Level
DER.1.A1	Basis (B)
DER.1.A2	Basis (B)
DER.1.A3	Basis (B)
DER.1.A4	Basis (B)
DER.1.A5	Basis (B)
DER.1.A6	Standard (S)
DER.1.A7	Standard (S)
DER.1.A8	Standard (S)
DER.1.A9	Standard (S)
DER.1.A10	Standard (S)
DER.1.A11	Standard (S)
DER.1.A12	Standard (S)
DER.1.A13	Standard (S)
DER.1.A14	Erhöhter Schutzbedarf (H)
DER.1.A15	Erhöhter Schutzbedarf (H)
DER.1.A16	Erhöhter Schutzbedarf (H)
DER.1.A17	Erhöhter Schutzbedarf (H)
DER.1.A18	Erhöhter Schutzbedarf (H)

Behandlung von Sicherheitsvorfällen (DER.2.1)

Also published freely as E-ITS version 2024 DER.2.1

IT-Grundschutz Anforderungen in DER.2.1, Behandlung von Sicherheitsvorfällen
Anforderung	Level
DER.2.1.A1	Basis (B)
DER.2.1.A2	Basis (B)
DER.2.1.A3	Basis (B)
DER.2.1.A4	Basis (B)
DER.2.1.A5	Basis (B)
DER.2.1.A6	Basis (B)
DER.2.1.A7	Standard (S)
DER.2.1.A8	Standard (S)
DER.2.1.A9	Standard (S)
DER.2.1.A10	Standard (S)
DER.2.1.A11	Standard (S)
DER.2.1.A12	Standard (S)
DER.2.1.A13	Standard (S)
DER.2.1.A14	Standard (S)
DER.2.1.A15	Standard (S)
DER.2.1.A16	Standard (S)
DER.2.1.A17	Standard (S)
DER.2.1.A18	Standard (S)
DER.2.1.A19	Erhöhter Schutzbedarf (H)
DER.2.1.A20	Erhöhter Schutzbedarf (H)
DER.2.1.A21	Erhöhter Schutzbedarf (H)
DER.2.1.A22	Erhöhter Schutzbedarf (H)

Vorsorge für die IT-Forensik (DER.2.2)

Also published freely as E-ITS version 2024 DER.2.2

IT-Grundschutz Anforderungen in DER.2.2, Vorsorge für die IT-Forensik
Anforderung	Level
DER.2.2.A1	Basis (B)
DER.2.2.A2	Basis (B)
DER.2.2.A3	Basis (B)
DER.2.2.A4	Standard (S)
DER.2.2.A5	Standard (S)
DER.2.2.A6	Standard (S)
DER.2.2.A7	Standard (S)
DER.2.2.A8	Standard (S)
DER.2.2.A9	Standard (S)
DER.2.2.A10	Standard (S)
DER.2.2.A11	Standard (S)
DER.2.2.A12	Standard (S)
DER.2.2.A13	Erhöhter Schutzbedarf (H)
DER.2.2.A14	Erhöhter Schutzbedarf (H)
DER.2.2.A15	Erhöhter Schutzbedarf (H)

Bereinigung weitreichender Sicherheitsvorfälle (DER.2.3)

Also published freely as E-ITS version 2024 DER.2.3

IT-Grundschutz Anforderungen in DER.2.3, Bereinigung weitreichender Sicherheitsvorfälle
Anforderung	Level
DER.2.3.A1	Basis (B)
DER.2.3.A2	Basis (B)
DER.2.3.A3	Basis (B)
DER.2.3.A4	Basis (B)
DER.2.3.A5	Basis (B)
DER.2.3.A6	Basis (B)
DER.2.3.A7	Standard (S)
DER.2.3.A8	Standard (S)
DER.2.3.A9	Erhöhter Schutzbedarf (H)
DER.2.3.A10	Erhöhter Schutzbedarf (H)

Audits und Revisionen (DER.3.1)

Also published freely as E-ITS version 2024 DER.3.1

IT-Grundschutz Anforderungen in DER.3.1, Audits und Revisionen
Anforderung	Level
DER.3.1.A1	Basis (B)
DER.3.1.A2	Basis (B)
DER.3.1.A3	Basis (B)
DER.3.1.A4	Basis (B)
DER.3.1.A5	Standard (S)
DER.3.1.A6	Standard (S)
DER.3.1.A7	Standard (S)
DER.3.1.A8	Standard (S)
DER.3.1.A9	Standard (S)
DER.3.1.A10	Standard (S)
DER.3.1.A11	Standard (S)
DER.3.1.A12	Standard (S)
DER.3.1.A13	Standard (S)
DER.3.1.A14	Standard (S)
DER.3.1.A15	Standard (S)
DER.3.1.A16	Standard (S)
DER.3.1.A17	Standard (S)
DER.3.1.A18	Standard (S)
DER.3.1.A19	Standard (S)
DER.3.1.A20	Standard (S)
DER.3.1.A21	Standard (S)
DER.3.1.A22	Standard (S)
DER.3.1.A23	Standard (S)
DER.3.1.A24	Standard (S)
DER.3.1.A25	Standard (S)
DER.3.1.A26	Standard (S)
DER.3.1.A27	Standard (S)
DER.3.1.A28	Erhöhter Schutzbedarf (H)

Revisionen auf Basis des Leitfadens IS-Revision (DER.3.2)

Also published freely as E-ITS version 2024 DER.3.2

IT-Grundschutz Anforderungen in DER.3.2, Revisionen auf Basis des Leitfadens IS-Revision
Anforderung	Level
DER.3.2.A1	Basis (B)
DER.3.2.A2	Basis (B)
DER.3.2.A3	Basis (B)
DER.3.2.A4	Basis (B)
DER.3.2.A5	Basis (B)
DER.3.2.A6	Basis (B)
DER.3.2.A7	Basis (B)
DER.3.2.A8	Basis (B)
DER.3.2.A9	Standard (S)
DER.3.2.A10	Standard (S)
DER.3.2.A11	Standard (S)
DER.3.2.A12	Standard (S)
DER.3.2.A13	Standard (S)
DER.3.2.A14	Standard (S)
DER.3.2.A15	Standard (S)
DER.3.2.A16	Standard (S)
DER.3.2.A17	Standard (S)
DER.3.2.A18	Standard (S)
DER.3.2.A19	Standard (S)
DER.3.2.A20	Standard (S)
DER.3.2.A21	Standard (S)
DER.3.2.A22	Standard (S)
DER.3.2.A23	Erhöhter Schutzbedarf (H)

Notfallmanagement (DER.4)

Also published freely as E-ITS version 2024 DER.4

IT-Grundschutz Anforderungen in DER.4, Notfallmanagement
Anforderung	Level
DER.4.A1	Standard (S)
DER.4.A2	Standard (S)
DER.4.A3	Erhöhter Schutzbedarf (H)
DER.4.A4	Erhöhter Schutzbedarf (H)
DER.4.A5	Erhöhter Schutzbedarf (H)
DER.4.A6	Erhöhter Schutzbedarf (H)
DER.4.A7	Erhöhter Schutzbedarf (H)
DER.4.A8	Erhöhter Schutzbedarf (H)
DER.4.A9	Erhöhter Schutzbedarf (H)
DER.4.A10	Erhöhter Schutzbedarf (H)
DER.4.A11	Erhöhter Schutzbedarf (H)
DER.4.A12	Erhöhter Schutzbedarf (H)
DER.4.A13	Erhöhter Schutzbedarf (H)
DER.4.A14	Erhöhter Schutzbedarf (H)
DER.4.A15	Erhöhter Schutzbedarf (H)
DER.4.A16	Erhöhter Schutzbedarf (H)

APP — Anwendungen · 374 Anforderungen

Office-Produkte (APP.1.1)

Also published freely as E-ITS version 2024 APP.1.1

IT-Grundschutz Anforderungen in APP.1.1, Office-Produkte
Anforderung	Level
APP.1.1.A1	Basis (B)
APP.1.1.A2	Basis (B)
APP.1.1.A3	Basis (B)
APP.1.1.A4	Basis (B)
APP.1.1.A5	Standard (S)
APP.1.1.A6	Standard (S)
APP.1.1.A7	Standard (S)
APP.1.1.A8	Standard (S)
APP.1.1.A9	Standard (S)
APP.1.1.A10	Standard (S)
APP.1.1.A11	Standard (S)
APP.1.1.A12	Standard (S)
APP.1.1.A13	Standard (S)
APP.1.1.A14	Standard (S)
APP.1.1.A15	Erhöhter Schutzbedarf (H)
APP.1.1.A16	Erhöhter Schutzbedarf (H)
APP.1.1.A17	Basis (B)

Webbrowser (APP.1.2)

Also published freely as E-ITS version 2024 APP.1.2

IT-Grundschutz Anforderungen in APP.1.2, Webbrowser
Anforderung	Level
APP.1.2.A1	Basis (B)
APP.1.2.A2	Basis (B)
APP.1.2.A3	Basis (B)
APP.1.2.A4	Basis (B)
APP.1.2.A5	Standard (S)
APP.1.2.A6	Basis (B)
APP.1.2.A7	Standard (S)
APP.1.2.A8	Standard (S)
APP.1.2.A9	Erhöhter Schutzbedarf (H)
APP.1.2.A10	Erhöhter Schutzbedarf (H)
APP.1.2.A11	Erhöhter Schutzbedarf (H)
APP.1.2.A12	Erhöhter Schutzbedarf (H)
APP.1.2.A13	Basis (B)

Mobile Anwendungen (Apps) (APP.1.4)

Also published freely as E-ITS version 2024 APP.1.4

IT-Grundschutz Anforderungen in APP.1.4, Mobile Anwendungen (Apps)
Anforderung	Level
APP.1.4.A1	Basis (B)
APP.1.4.A2	Basis (B)
APP.1.4.A3	Standard (S)
APP.1.4.A4	Basis (B)
APP.1.4.A5	Basis (B)
APP.1.4.A6	Basis (B)
APP.1.4.A7	Basis (B)
APP.1.4.A8	Basis (B)
APP.1.4.A9	Standard (S)
APP.1.4.A10	Standard (S)
APP.1.4.A11	Standard (S)
APP.1.4.A12	Standard (S)
APP.1.4.A13	Erhöhter Schutzbedarf (H)
APP.1.4.A14	Erhöhter Schutzbedarf (H)
APP.1.4.A15	Erhöhter Schutzbedarf (H)
APP.1.4.A16	Erhöhter Schutzbedarf (H)

Allgemeiner Verzeichnisdienst (APP.2.1)

Also published freely as E-ITS version 2024 APP.2.1

IT-Grundschutz Anforderungen in APP.2.1, Allgemeiner Verzeichnisdienst
Anforderung	Level
APP.2.1.A1	Basis (B)
APP.2.1.A2	Basis (B)
APP.2.1.A3	Basis (B)
APP.2.1.A4	Basis (B)
APP.2.1.A5	Basis (B)
APP.2.1.A6	Basis (B)
APP.2.1.A7	Standard (S)
APP.2.1.A8	Standard (S)
APP.2.1.A9	Standard (S)
APP.2.1.A10	Standard (S)
APP.2.1.A11	Standard (S)
APP.2.1.A12	Standard (S)
APP.2.1.A13	Standard (S)
APP.2.1.A14	Standard (S)
APP.2.1.A15	Standard (S)
APP.2.1.A16	Erhöhter Schutzbedarf (H)
APP.2.1.A17	Basis (B)
APP.2.1.A18	Standard (S)
APP.2.1.A19	Standard (S)
APP.2.1.A20	Erhöhter Schutzbedarf (H)
APP.2.1.A21	Erhöhter Schutzbedarf (H)

Active Directory Domain Services (APP.2.2)

Also published freely as E-ITS version 2024 APP.2.2

IT-Grundschutz Anforderungen in APP.2.2, Active Directory Domain Services
Anforderung	Level
APP.2.2.A1	Basis (B)
APP.2.2.A2	Basis (B)
APP.2.2.A3	Basis (B)
APP.2.2.A4	Basis (B)
APP.2.2.A5	Basis (B)
APP.2.2.A6	Basis (B)
APP.2.2.A7	Basis (B)
APP.2.2.A8	Standard (S)
APP.2.2.A9	Standard (S)
APP.2.2.A10	Standard (S)
APP.2.2.A11	Standard (S)
APP.2.2.A12	Standard (S)
APP.2.2.A13	Erhöhter Schutzbedarf (H)
APP.2.2.A14	Erhöhter Schutzbedarf (H)
APP.2.2.A15	Erhöhter Schutzbedarf (H)
APP.2.2.A16	Basis (B)
APP.2.2.A17	Basis (B)
APP.2.2.A18	Basis (B)
APP.2.2.A19	Erhöhter Schutzbedarf (H)
APP.2.2.A20	Erhöhter Schutzbedarf (H)
APP.2.2.A21	Erhöhter Schutzbedarf (H)
APP.2.2.A22	Erhöhter Schutzbedarf (H)
APP.2.2.A23	Erhöhter Schutzbedarf (H)

OpenLDAP (APP.2.3)

Also published freely as E-ITS version 2024 APP.2.3

IT-Grundschutz Anforderungen in APP.2.3, OpenLDAP
Anforderung	Level
APP.2.3.A1	Basis (B)
APP.2.3.A2	Basis (B)
APP.2.3.A3	Basis (B)
APP.2.3.A4	Basis (B)
APP.2.3.A5	Basis (B)
APP.2.3.A6	Basis (B)
APP.2.3.A7	Standard (S)
APP.2.3.A8	Standard (S)
APP.2.3.A9	Standard (S)
APP.2.3.A10	Standard (S)
APP.2.3.A11	Standard (S)
APP.2.3.A12	Standard (S)
APP.2.3.A13	Standard (S)

Webanwendungen und Webservices (APP.3.1)

Also published freely as E-ITS version 2024 APP.3.1

IT-Grundschutz Anforderungen in APP.3.1, Webanwendungen und Webservices
Anforderung	Level
APP.3.1.A1	Basis (B)
APP.3.1.A2	Basis (B)
APP.3.1.A3	Basis (B)
APP.3.1.A4	Basis (B)
APP.3.1.A5	Basis (B)
APP.3.1.A6	Basis (B)
APP.3.1.A7	Basis (B)
APP.3.1.A8	Standard (S)
APP.3.1.A9	Standard (S)
APP.3.1.A10	Standard (S)
APP.3.1.A11	Standard (S)
APP.3.1.A12	Standard (S)
APP.3.1.A13	Standard (S)
APP.3.1.A14	Basis (B)
APP.3.1.A15	Standard (S)
APP.3.1.A16	Basis (B)
APP.3.1.A17	Standard (S)
APP.3.1.A18	Standard (S)
APP.3.1.A19	Basis (B)
APP.3.1.A20	Erhöhter Schutzbedarf (H)
APP.3.1.A21	Standard (S)
APP.3.1.A22	Standard (S)
APP.3.1.A23	Standard (S)
APP.3.1.A24	Erhöhter Schutzbedarf (H)
APP.3.1.A25	Erhöhter Schutzbedarf (H)

Webserver (APP.3.2)

Also published freely as E-ITS version 2024 APP.3.2

IT-Grundschutz Anforderungen in APP.3.2, Webserver
Anforderung	Level
APP.3.2.A1	Basis (B)
APP.3.2.A2	Basis (B)
APP.3.2.A3	Basis (B)
APP.3.2.A4	Basis (B)
APP.3.2.A5	Basis (B)
APP.3.2.A6	Basis (B)
APP.3.2.A7	Basis (B)
APP.3.2.A8	Standard (S)
APP.3.2.A9	Standard (S)
APP.3.2.A10	Standard (S)
APP.3.2.A11	Basis (B)
APP.3.2.A12	Standard (S)
APP.3.2.A13	Standard (S)
APP.3.2.A14	Standard (S)
APP.3.2.A15	Erhöhter Schutzbedarf (H)
APP.3.2.A16	Standard (S)
APP.3.2.A17	Erhöhter Schutzbedarf (H)
APP.3.2.A18	Erhöhter Schutzbedarf (H)
APP.3.2.A19	Erhöhter Schutzbedarf (H)
APP.3.2.A20	Standard (S)

Fileserver (APP.3.3)

Also published freely as E-ITS version 2024 APP.3.3

IT-Grundschutz Anforderungen in APP.3.3, Fileserver
Anforderung	Level
APP.3.3.A1	Basis (B)
APP.3.3.A2	Basis (B)
APP.3.3.A3	Basis (B)
APP.3.3.A4	Basis (B)
APP.3.3.A5	Basis (B)
APP.3.3.A6	Standard (S)
APP.3.3.A7	Standard (S)
APP.3.3.A8	Standard (S)
APP.3.3.A9	Standard (S)
APP.3.3.A10	Standard (S)
APP.3.3.A11	Standard (S)
APP.3.3.A12	Erhöhter Schutzbedarf (H)
APP.3.3.A13	Erhöhter Schutzbedarf (H)
APP.3.3.A14	Standard (S)
APP.3.3.A15	Basis (B)

Samba (APP.3.4)

Also published freely as E-ITS version 2024 APP.3.4

IT-Grundschutz Anforderungen in APP.3.4, Samba
Anforderung	Level
APP.3.4.A1	Basis (B)
APP.3.4.A2	Basis (B)
APP.3.4.A3	Standard (S)
APP.3.4.A4	Standard (S)
APP.3.4.A5	Standard (S)
APP.3.4.A6	Standard (S)
APP.3.4.A7	Standard (S)
APP.3.4.A8	Standard (S)
APP.3.4.A9	Standard (S)
APP.3.4.A10	Standard (S)
APP.3.4.A11	Standard (S)
APP.3.4.A12	Standard (S)
APP.3.4.A13	Standard (S)
APP.3.4.A14	Standard (S)
APP.3.4.A15	Erhöhter Schutzbedarf (H)

DNS-Server (APP.3.6)

Also published freely as E-ITS version 2024 APP.3.6

IT-Grundschutz Anforderungen in APP.3.6, DNS-Server
Anforderung	Level
APP.3.6.A1	Basis (B)
APP.3.6.A2	Basis (B)
APP.3.6.A3	Basis (B)
APP.3.6.A4	Basis (B)
APP.3.6.A5	Basis (B)
APP.3.6.A6	Basis (B)
APP.3.6.A7	Basis (B)
APP.3.6.A8	Basis (B)
APP.3.6.A9	Basis (B)
APP.3.6.A10	Standard (S)
APP.3.6.A11	Standard (S)
APP.3.6.A12	Standard (S)
APP.3.6.A13	Standard (S)
APP.3.6.A14	Standard (S)
APP.3.6.A15	Standard (S)
APP.3.6.A16	Standard (S)
APP.3.6.A17	Standard (S)
APP.3.6.A18	Standard (S)
APP.3.6.A19	Standard (S)
APP.3.6.A20	Erhöhter Schutzbedarf (H)
APP.3.6.A21	Erhöhter Schutzbedarf (H)
APP.3.6.A22	Erhöhter Schutzbedarf (H)

SAP-ERP-System (APP.4.2)

IT-Grundschutz Anforderungen in APP.4.2, SAP-ERP-System
Anforderung	Level
APP.4.2.A1	Basis (B)
APP.4.2.A2	Basis (B)
APP.4.2.A3	Basis (B)
APP.4.2.A4	Basis (B)
APP.4.2.A5	Basis (B)
APP.4.2.A6	Basis (B)
APP.4.2.A7	Basis (B)
APP.4.2.A8	Basis (B)
APP.4.2.A9	Basis (B)
APP.4.2.A10	Basis (B)
APP.4.2.A11	Standard (S)
APP.4.2.A12	Standard (S)
APP.4.2.A13	Standard (S)
APP.4.2.A14	Standard (S)
APP.4.2.A15	Standard (S)
APP.4.2.A16	Standard (S)
APP.4.2.A17	Standard (S)
APP.4.2.A18	Standard (S)
APP.4.2.A19	Standard (S)
APP.4.2.A20	Standard (S)
APP.4.2.A21	Standard (S)
APP.4.2.A22	Standard (S)
APP.4.2.A23	Standard (S)
APP.4.2.A24	Standard (S)
APP.4.2.A25	Standard (S)
APP.4.2.A26	Standard (S)
APP.4.2.A27	Standard (S)
APP.4.2.A28	Standard (S)
APP.4.2.A29	Standard (S)
APP.4.2.A30	Standard (S)
APP.4.2.A31	Standard (S)
APP.4.2.A32	Erhöhter Schutzbedarf (H)

Relationale Datenbanken (APP.4.3)

Also published freely as E-ITS version 2024 APP.4.3

IT-Grundschutz Anforderungen in APP.4.3, Relationale Datenbanken
Anforderung	Level
APP.4.3.A1	Basis (B)
APP.4.3.A2	Basis (B)
APP.4.3.A3	Basis (B)
APP.4.3.A4	Basis (B)
APP.4.3.A5	Basis (B)
APP.4.3.A6	Basis (B)
APP.4.3.A7	Basis (B)
APP.4.3.A8	Basis (B)
APP.4.3.A9	Basis (B)
APP.4.3.A10	Standard (S)
APP.4.3.A11	Standard (S)
APP.4.3.A12	Standard (S)
APP.4.3.A13	Standard (S)
APP.4.3.A14	Standard (S)
APP.4.3.A15	Standard (S)
APP.4.3.A16	Standard (S)
APP.4.3.A17	Standard (S)
APP.4.3.A18	Standard (S)
APP.4.3.A19	Standard (S)
APP.4.3.A20	Standard (S)
APP.4.3.A21	Erhöhter Schutzbedarf (H)
APP.4.3.A22	Erhöhter Schutzbedarf (H)
APP.4.3.A23	Erhöhter Schutzbedarf (H)
APP.4.3.A24	Erhöhter Schutzbedarf (H)
APP.4.3.A25	Erhöhter Schutzbedarf (H)

Kubernetes (APP.4.4)

Also published freely as E-ITS version 2024 APP.4.4

IT-Grundschutz Anforderungen in APP.4.4, Kubernetes
Anforderung	Level
APP.4.4.A1	Basis (B)
APP.4.4.A2	Basis (B)
APP.4.4.A3	Basis (B)
APP.4.4.A4	Basis (B)
APP.4.4.A5	Basis (B)
APP.4.4.A6	Standard (S)
APP.4.4.A7	Standard (S)
APP.4.4.A8	Standard (S)
APP.4.4.A9	Standard (S)
APP.4.4.A10	Standard (S)
APP.4.4.A11	Standard (S)
APP.4.4.A12	Standard (S)
APP.4.4.A13	Erhöhter Schutzbedarf (H)
APP.4.4.A14	Erhöhter Schutzbedarf (H)
APP.4.4.A15	Erhöhter Schutzbedarf (H)
APP.4.4.A16	Erhöhter Schutzbedarf (H)
APP.4.4.A17	Erhöhter Schutzbedarf (H)
APP.4.4.A18	Erhöhter Schutzbedarf (H)
APP.4.4.A19	Erhöhter Schutzbedarf (H)
APP.4.4.A20	Erhöhter Schutzbedarf (H)
APP.4.4.A21	Erhöhter Schutzbedarf (H)

SAP ABAP-Programmierung (APP.4.6)

IT-Grundschutz Anforderungen in APP.4.6, SAP ABAP-Programmierung
Anforderung	Level
APP.4.6.A1	Basis (B)
APP.4.6.A2	Basis (B)
APP.4.6.A3	Basis (B)
APP.4.6.A4	Basis (B)
APP.4.6.A5	Standard (S)
APP.4.6.A6	Standard (S)
APP.4.6.A7	Standard (S)
APP.4.6.A8	Standard (S)
APP.4.6.A9	Standard (S)
APP.4.6.A10	Standard (S)
APP.4.6.A11	Standard (S)
APP.4.6.A12	Standard (S)
APP.4.6.A13	Standard (S)
APP.4.6.A14	Standard (S)
APP.4.6.A15	Standard (S)
APP.4.6.A16	Standard (S)
APP.4.6.A17	Standard (S)
APP.4.6.A18	Standard (S)
APP.4.6.A19	Standard (S)
APP.4.6.A20	Standard (S)
APP.4.6.A21	Standard (S)
APP.4.6.A22	Erhöhter Schutzbedarf (H)

Microsoft Exchange und Outlook (APP.5.2)

Also published freely as E-ITS version 2024 APP.5.2

IT-Grundschutz Anforderungen in APP.5.2, Microsoft Exchange und Outlook
Anforderung	Level
APP.5.2.A1	Basis (B)
APP.5.2.A2	Basis (B)
APP.5.2.A3	Basis (B)
APP.5.2.A4	Basis (B)
APP.5.2.A5	Basis (B)
APP.5.2.A6	Standard (S)
APP.5.2.A7	Standard (S)
APP.5.2.A8	Standard (S)
APP.5.2.A9	Standard (S)
APP.5.2.A10	Standard (S)
APP.5.2.A11	Standard (S)
APP.5.2.A12	Standard (S)
APP.5.2.A13	Standard (S)
APP.5.2.A14	Standard (S)
APP.5.2.A15	Standard (S)
APP.5.2.A16	Standard (S)
APP.5.2.A17	Erhöhter Schutzbedarf (H)
APP.5.2.A18	Erhöhter Schutzbedarf (H)
APP.5.2.A19	Standard (S)

Allgemeiner E-Mail-Client und -Server (APP.5.3)

Also published freely as E-ITS version 2024 APP.5.3

IT-Grundschutz Anforderungen in APP.5.3, Allgemeiner E-Mail-Client und -Server
Anforderung	Level
APP.5.3.A1	Basis (B)
APP.5.3.A2	Basis (B)
APP.5.3.A3	Basis (B)
APP.5.3.A4	Basis (B)
APP.5.3.A5	Standard (S)
APP.5.3.A6	Standard (S)
APP.5.3.A7	Standard (S)
APP.5.3.A8	Standard (S)
APP.5.3.A9	Standard (S)
APP.5.3.A10	Erhöhter Schutzbedarf (H)
APP.5.3.A11	Erhöhter Schutzbedarf (H)
APP.5.3.A12	Erhöhter Schutzbedarf (H)
APP.5.3.A13	Erhöhter Schutzbedarf (H)

Unified Communications und Collaboration (UCC) (APP.5.4)

Also published freely as E-ITS version 2024 APP.5.4

IT-Grundschutz Anforderungen in APP.5.4, Unified Communications und Collaboration (UCC)
Anforderung	Level
APP.5.4.A1	Basis (B)
APP.5.4.A2	Basis (B)
APP.5.4.A3	Basis (B)
APP.5.4.A4	Basis (B)
APP.5.4.A5	Basis (B)
APP.5.4.A6	Basis (B)
APP.5.4.A7	Basis (B)
APP.5.4.A8	Standard (S)
APP.5.4.A9	Standard (S)
APP.5.4.A10	Standard (S)
APP.5.4.A11	Erhöhter Schutzbedarf (H)
APP.5.4.A12	Erhöhter Schutzbedarf (H)
APP.5.4.A13	Erhöhter Schutzbedarf (H)
APP.5.4.A14	Erhöhter Schutzbedarf (H)
APP.5.4.A15	Erhöhter Schutzbedarf (H)
APP.5.4.A16	Erhöhter Schutzbedarf (H)
APP.5.4.A17	Erhöhter Schutzbedarf (H)
APP.5.4.A18	Erhöhter Schutzbedarf (H)

Allgemeine Software (APP.6)

Also published freely as E-ITS version 2024 APP.6

IT-Grundschutz Anforderungen in APP.6, Allgemeine Software
Anforderung	Level
APP.6.A1	Basis (B)
APP.6.A2	Basis (B)
APP.6.A3	Basis (B)
APP.6.A4	Basis (B)
APP.6.A5	Basis (B)
APP.6.A6	Standard (S)
APP.6.A7	Standard (S)
APP.6.A8	Standard (S)
APP.6.A9	Standard (S)
APP.6.A10	Standard (S)
APP.6.A11	Standard (S)
APP.6.A12	Standard (S)
APP.6.A13	Standard (S)
APP.6.A14	Erhöhter Schutzbedarf (H)

Entwicklung von Individualsoftware (APP.7)

Also published freely as E-ITS version 2024 APP.7

IT-Grundschutz Anforderungen in APP.7, Entwicklung von Individualsoftware
Anforderung	Level
APP.7.A1	Basis (B)
APP.7.A2	Basis (B)
APP.7.A3	Basis (B)
APP.7.A4	Basis (B)
APP.7.A5	Standard (S)
APP.7.A6	Standard (S)
APP.7.A7	Standard (S)
APP.7.A8	Standard (S)
APP.7.A9	Erhöhter Schutzbedarf (H)
APP.7.A10	Erhöhter Schutzbedarf (H)

SYS — IT-Systeme · 561 Anforderungen

Allgemeiner Server (SYS.1.1)

Also published freely as E-ITS version 2024 SYS.1.1

IT-Grundschutz Anforderungen in SYS.1.1, Allgemeiner Server
Anforderung	Level
SYS.1.1.A1	Basis (B)
SYS.1.1.A2	Basis (B)
SYS.1.1.A3	Basis (B)
SYS.1.1.A4	Basis (B)
SYS.1.1.A5	Basis (B)
SYS.1.1.A6	Basis (B)
SYS.1.1.A7	Basis (B)
SYS.1.1.A8	Basis (B)
SYS.1.1.A9	Basis (B)
SYS.1.1.A10	Basis (B)
SYS.1.1.A11	Standard (S)
SYS.1.1.A12	Standard (S)
SYS.1.1.A13	Standard (S)
SYS.1.1.A14	Standard (S)
SYS.1.1.A15	Standard (S)
SYS.1.1.A16	Standard (S)
SYS.1.1.A17	Standard (S)
SYS.1.1.A18	Standard (S)
SYS.1.1.A19	Standard (S)
SYS.1.1.A20	Standard (S)
SYS.1.1.A21	Standard (S)
SYS.1.1.A22	Standard (S)
SYS.1.1.A23	Standard (S)
SYS.1.1.A24	Standard (S)
SYS.1.1.A25	Standard (S)
SYS.1.1.A26	Erhöhter Schutzbedarf (H)
SYS.1.1.A27	Erhöhter Schutzbedarf (H)
SYS.1.1.A28	Erhöhter Schutzbedarf (H)
SYS.1.1.A29	Erhöhter Schutzbedarf (H)
SYS.1.1.A30	Erhöhter Schutzbedarf (H)
SYS.1.1.A31	Erhöhter Schutzbedarf (H)
SYS.1.1.A32	Erhöhter Schutzbedarf (H)
SYS.1.1.A33	Erhöhter Schutzbedarf (H)
SYS.1.1.A34	Erhöhter Schutzbedarf (H)
SYS.1.1.A35	Standard (S)
SYS.1.1.A36	Erhöhter Schutzbedarf (H)
SYS.1.1.A37	Standard (S)
SYS.1.1.A38	Erhöhter Schutzbedarf (H)
SYS.1.1.A39	Standard (S)

Windows Server 2012 (SYS.1.2.2)

Also published freely as E-ITS version 2024 SYS.1.2.2

IT-Grundschutz Anforderungen in SYS.1.2.2, Windows Server 2012
Anforderung	Level
SYS.1.2.2.A1	Basis (B)
SYS.1.2.2.A2	Basis (B)
SYS.1.2.2.A3	Basis (B)
SYS.1.2.2.A4	Standard (S)
SYS.1.2.2.A5	Standard (S)
SYS.1.2.2.A6	Standard (S)
SYS.1.2.2.A7	Standard (S)
SYS.1.2.2.A8	Standard (S)
SYS.1.2.2.A9	Standard (S)
SYS.1.2.2.A10	Erhöhter Schutzbedarf (H)
SYS.1.2.2.A11	Erhöhter Schutzbedarf (H)
SYS.1.2.2.A12	Erhöhter Schutzbedarf (H)
SYS.1.2.2.A13	Erhöhter Schutzbedarf (H)
SYS.1.2.2.A14	Erhöhter Schutzbedarf (H)

Windows Server (SYS.1.2.3)

Also published freely as E-ITS version 2024 SYS.1.2.3

IT-Grundschutz Anforderungen in SYS.1.2.3, Windows Server
Anforderung	Level
SYS.1.2.3.A1	Basis (B)
SYS.1.2.3.A2	Basis (B)
SYS.1.2.3.A3	Basis (B)
SYS.1.2.3.A4	Standard (S)
SYS.1.2.3.A5	Standard (S)
SYS.1.2.3.A6	Standard (S)
SYS.1.2.3.A7	Erhöhter Schutzbedarf (H)
SYS.1.2.3.A8	Erhöhter Schutzbedarf (H)

Server unter Linux und Unix (SYS.1.3)

Also published freely as E-ITS version 2024 SYS.1.3

IT-Grundschutz Anforderungen in SYS.1.3, Server unter Linux und Unix
Anforderung	Level
SYS.1.3.A1	Basis (B)
SYS.1.3.A2	Basis (B)
SYS.1.3.A3	Basis (B)
SYS.1.3.A4	Basis (B)
SYS.1.3.A5	Basis (B)
SYS.1.3.A6	Standard (S)
SYS.1.3.A7	Standard (S)
SYS.1.3.A8	Standard (S)
SYS.1.3.A9	Standard (S)
SYS.1.3.A10	Standard (S)
SYS.1.3.A11	Standard (S)
SYS.1.3.A12	Standard (S)
SYS.1.3.A13	Erhöhter Schutzbedarf (H)
SYS.1.3.A14	Erhöhter Schutzbedarf (H)
SYS.1.3.A15	Erhöhter Schutzbedarf (H)
SYS.1.3.A16	Erhöhter Schutzbedarf (H)
SYS.1.3.A17	Erhöhter Schutzbedarf (H)

Virtualisierung (SYS.1.5)

Also published freely as E-ITS version 2024 SYS.1.5

IT-Grundschutz Anforderungen in SYS.1.5, Virtualisierung
Anforderung	Level
SYS.1.5.A1	Basis (B)
SYS.1.5.A2	Basis (B)
SYS.1.5.A3	Basis (B)
SYS.1.5.A4	Basis (B)
SYS.1.5.A5	Basis (B)
SYS.1.5.A6	Basis (B)
SYS.1.5.A7	Basis (B)
SYS.1.5.A8	Standard (S)
SYS.1.5.A9	Standard (S)
SYS.1.5.A10	Standard (S)
SYS.1.5.A11	Standard (S)
SYS.1.5.A12	Standard (S)
SYS.1.5.A13	Standard (S)
SYS.1.5.A14	Standard (S)
SYS.1.5.A15	Standard (S)
SYS.1.5.A16	Standard (S)
SYS.1.5.A17	Standard (S)
SYS.1.5.A18	Standard (S)
SYS.1.5.A19	Standard (S)
SYS.1.5.A20	Erhöhter Schutzbedarf (H)
SYS.1.5.A21	Erhöhter Schutzbedarf (H)
SYS.1.5.A22	Erhöhter Schutzbedarf (H)
SYS.1.5.A23	Erhöhter Schutzbedarf (H)
SYS.1.5.A24	Erhöhter Schutzbedarf (H)
SYS.1.5.A25	Erhöhter Schutzbedarf (H)
SYS.1.5.A26	Erhöhter Schutzbedarf (H)
SYS.1.5.A27	Erhöhter Schutzbedarf (H)
SYS.1.5.A28	Erhöhter Schutzbedarf (H)

Containerisierung (SYS.1.6)

Also published freely as E-ITS version 2024 SYS.1.6

IT-Grundschutz Anforderungen in SYS.1.6, Containerisierung
Anforderung	Level
SYS.1.6.A1	Basis (B)
SYS.1.6.A2	Basis (B)
SYS.1.6.A3	Basis (B)
SYS.1.6.A4	Basis (B)
SYS.1.6.A5	Basis (B)
SYS.1.6.A6	Basis (B)
SYS.1.6.A7	Basis (B)
SYS.1.6.A8	Basis (B)
SYS.1.6.A9	Standard (S)
SYS.1.6.A10	Standard (S)
SYS.1.6.A11	Standard (S)
SYS.1.6.A12	Standard (S)
SYS.1.6.A13	Standard (S)
SYS.1.6.A14	Standard (S)
SYS.1.6.A15	Standard (S)
SYS.1.6.A16	Standard (S)
SYS.1.6.A17	Standard (S)
SYS.1.6.A18	Standard (S)
SYS.1.6.A19	Standard (S)
SYS.1.6.A20	Standard (S)
SYS.1.6.A21	Erhöhter Schutzbedarf (H)
SYS.1.6.A22	Erhöhter Schutzbedarf (H)
SYS.1.6.A23	Erhöhter Schutzbedarf (H)
SYS.1.6.A24	Erhöhter Schutzbedarf (H)
SYS.1.6.A25	Erhöhter Schutzbedarf (H)
SYS.1.6.A26	Erhöhter Schutzbedarf (H)

IBM Z (SYS.1.7)

IT-Grundschutz Anforderungen in SYS.1.7, IBM Z
Anforderung	Level
SYS.1.7.A1	Basis (B)
SYS.1.7.A2	Basis (B)
SYS.1.7.A3	Basis (B)
SYS.1.7.A4	Basis (B)
SYS.1.7.A5	Basis (B)
SYS.1.7.A6	Basis (B)
SYS.1.7.A7	Basis (B)
SYS.1.7.A8	Basis (B)
SYS.1.7.A9	Basis (B)
SYS.1.7.A10	Basis (B)
SYS.1.7.A11	Basis (B)
SYS.1.7.A12	Standard (S)
SYS.1.7.A13	Standard (S)
SYS.1.7.A14	Standard (S)
SYS.1.7.A15	Standard (S)
SYS.1.7.A16	Standard (S)
SYS.1.7.A17	Standard (S)
SYS.1.7.A18	Standard (S)
SYS.1.7.A19	Standard (S)
SYS.1.7.A20	Standard (S)
SYS.1.7.A21	Standard (S)
SYS.1.7.A22	Standard (S)
SYS.1.7.A23	Standard (S)
SYS.1.7.A24	Standard (S)
SYS.1.7.A25	Standard (S)
SYS.1.7.A26	Standard (S)
SYS.1.7.A27	Standard (S)
SYS.1.7.A28	Standard (S)
SYS.1.7.A29	Standard (S)
SYS.1.7.A30	Standard (S)
SYS.1.7.A31	Standard (S)
SYS.1.7.A32	Erhöhter Schutzbedarf (H)
SYS.1.7.A33	Erhöhter Schutzbedarf (H)
SYS.1.7.A34	Erhöhter Schutzbedarf (H)
SYS.1.7.A35	Erhöhter Schutzbedarf (H)
SYS.1.7.A36	Erhöhter Schutzbedarf (H)
SYS.1.7.A37	Erhöhter Schutzbedarf (H)
SYS.1.7.A38	Erhöhter Schutzbedarf (H)

Speicherlösungen (SYS.1.8)

Also published freely as E-ITS version 2024 SYS.1.8

IT-Grundschutz Anforderungen in SYS.1.8, Speicherlösungen
Anforderung	Level
SYS.1.8.A1	Basis (B)
SYS.1.8.A2	Basis (B)
SYS.1.8.A3	Basis (B)
SYS.1.8.A4	Basis (B)
SYS.1.8.A5	Basis (B)
SYS.1.8.A6	Standard (S)
SYS.1.8.A7	Standard (S)
SYS.1.8.A8	Standard (S)
SYS.1.8.A9	Standard (S)
SYS.1.8.A10	Standard (S)
SYS.1.8.A11	Standard (S)
SYS.1.8.A12	Standard (S)
SYS.1.8.A13	Standard (S)
SYS.1.8.A14	Standard (S)
SYS.1.8.A15	Standard (S)
SYS.1.8.A16	Standard (S)
SYS.1.8.A17	Standard (S)
SYS.1.8.A18	Standard (S)
SYS.1.8.A19	Standard (S)
SYS.1.8.A20	Standard (S)
SYS.1.8.A21	Erhöhter Schutzbedarf (H)
SYS.1.8.A22	Erhöhter Schutzbedarf (H)
SYS.1.8.A23	Erhöhter Schutzbedarf (H)
SYS.1.8.A24	Erhöhter Schutzbedarf (H)
SYS.1.8.A25	Erhöhter Schutzbedarf (H)
SYS.1.8.A26	Erhöhter Schutzbedarf (H)

Terminalserver (SYS.1.9)

Also published freely as E-ITS version 2024 SYS.1.9

IT-Grundschutz Anforderungen in SYS.1.9, Terminalserver
Anforderung	Level
SYS.1.9.A1	Basis (B)
SYS.1.9.A2	Basis (B)
SYS.1.9.A3	Basis (B)
SYS.1.9.A4	Basis (B)
SYS.1.9.A5	Basis (B)
SYS.1.9.A6	Basis (B)
SYS.1.9.A7	Basis (B)
SYS.1.9.A8	Basis (B)
SYS.1.9.A9	Basis (B)
SYS.1.9.A10	Standard (S)
SYS.1.9.A11	Standard (S)
SYS.1.9.A12	Standard (S)
SYS.1.9.A13	Standard (S)
SYS.1.9.A14	Standard (S)
SYS.1.9.A15	Standard (S)
SYS.1.9.A16	Standard (S)
SYS.1.9.A17	Erhöhter Schutzbedarf (H)
SYS.1.9.A18	Erhöhter Schutzbedarf (H)
SYS.1.9.A19	Erhöhter Schutzbedarf (H)
SYS.1.9.A20	Erhöhter Schutzbedarf (H)
SYS.1.9.A21	Erhöhter Schutzbedarf (H)
SYS.1.9.A22	Erhöhter Schutzbedarf (H)

Allgemeiner Client (SYS.2.1)

Also published freely as E-ITS version 2024 SYS.2.1

IT-Grundschutz Anforderungen in SYS.2.1, Allgemeiner Client
Anforderung	Level
SYS.2.1.A1	Basis (B)
SYS.2.1.A2	Basis (B)
SYS.2.1.A3	Basis (B)
SYS.2.1.A4	Basis (B)
SYS.2.1.A5	Basis (B)
SYS.2.1.A6	Basis (B)
SYS.2.1.A7	Basis (B)
SYS.2.1.A8	Basis (B)
SYS.2.1.A9	Standard (S)
SYS.2.1.A10	Standard (S)
SYS.2.1.A11	Standard (S)
SYS.2.1.A12	Standard (S)
SYS.2.1.A13	Standard (S)
SYS.2.1.A14	Standard (S)
SYS.2.1.A15	Standard (S)
SYS.2.1.A16	Standard (S)
SYS.2.1.A17	Standard (S)
SYS.2.1.A18	Standard (S)
SYS.2.1.A19	Standard (S)
SYS.2.1.A20	Standard (S)
SYS.2.1.A21	Standard (S)
SYS.2.1.A22	Standard (S)
SYS.2.1.A23	Standard (S)
SYS.2.1.A24	Standard (S)
SYS.2.1.A25	Standard (S)
SYS.2.1.A26	Standard (S)
SYS.2.1.A27	Standard (S)
SYS.2.1.A28	Erhöhter Schutzbedarf (H)
SYS.2.1.A29	Erhöhter Schutzbedarf (H)
SYS.2.1.A30	Erhöhter Schutzbedarf (H)
SYS.2.1.A31	Erhöhter Schutzbedarf (H)
SYS.2.1.A32	Erhöhter Schutzbedarf (H)
SYS.2.1.A33	Erhöhter Schutzbedarf (H)
SYS.2.1.A34	Standard (S)
SYS.2.1.A35	Erhöhter Schutzbedarf (H)
SYS.2.1.A36	Erhöhter Schutzbedarf (H)
SYS.2.1.A37	Erhöhter Schutzbedarf (H)
SYS.2.1.A38	Erhöhter Schutzbedarf (H)
SYS.2.1.A39	Erhöhter Schutzbedarf (H)
SYS.2.1.A40	Erhöhter Schutzbedarf (H)
SYS.2.1.A41	Erhöhter Schutzbedarf (H)
SYS.2.1.A42	Basis (B)
SYS.2.1.A43	Standard (S)
SYS.2.1.A44	Standard (S)
SYS.2.1.A45	Erhöhter Schutzbedarf (H)

Clients unter Windows (SYS.2.2.3)

Also published freely as E-ITS version 2024 SYS.2.2.3

IT-Grundschutz Anforderungen in SYS.2.2.3, Clients unter Windows
Anforderung	Level
SYS.2.2.3.A1	Basis (B)
SYS.2.2.3.A2	Basis (B)
SYS.2.2.3.A3	Basis (B)
SYS.2.2.3.A4	Basis (B)
SYS.2.2.3.A5	Basis (B)
SYS.2.2.3.A6	Basis (B)
SYS.2.2.3.A7	Standard (S)
SYS.2.2.3.A8	Standard (S)
SYS.2.2.3.A9	Standard (S)
SYS.2.2.3.A10	Standard (S)
SYS.2.2.3.A11	Standard (S)
SYS.2.2.3.A12	Standard (S)
SYS.2.2.3.A13	Standard (S)
SYS.2.2.3.A14	Standard (S)
SYS.2.2.3.A15	Standard (S)
SYS.2.2.3.A16	Standard (S)
SYS.2.2.3.A17	Standard (S)
SYS.2.2.3.A18	Standard (S)
SYS.2.2.3.A19	Standard (S)
SYS.2.2.3.A20	Standard (S)
SYS.2.2.3.A21	Erhöhter Schutzbedarf (H)
SYS.2.2.3.A22	Erhöhter Schutzbedarf (H)
SYS.2.2.3.A23	Erhöhter Schutzbedarf (H)
SYS.2.2.3.A24	Erhöhter Schutzbedarf (H)
SYS.2.2.3.A25	Erhöhter Schutzbedarf (H)
SYS.2.2.3.A26	Erhöhter Schutzbedarf (H)

Clients unter Linux und Unix (SYS.2.3)

Also published freely as E-ITS version 2024 SYS.2.3

IT-Grundschutz Anforderungen in SYS.2.3, Clients unter Linux und Unix
Anforderung	Level
SYS.2.3.A1	Basis (B)
SYS.2.3.A2	Basis (B)
SYS.2.3.A3	Basis (B)
SYS.2.3.A4	Basis (B)
SYS.2.3.A5	Basis (B)
SYS.2.3.A6	Standard (S)
SYS.2.3.A7	Standard (S)
SYS.2.3.A8	Standard (S)
SYS.2.3.A9	Standard (S)
SYS.2.3.A10	Standard (S)
SYS.2.3.A11	Standard (S)
SYS.2.3.A12	Standard (S)
SYS.2.3.A13	Erhöhter Schutzbedarf (H)
SYS.2.3.A14	Erhöhter Schutzbedarf (H)
SYS.2.3.A15	Erhöhter Schutzbedarf (H)
SYS.2.3.A16	Erhöhter Schutzbedarf (H)
SYS.2.3.A17	Erhöhter Schutzbedarf (H)
SYS.2.3.A18	Erhöhter Schutzbedarf (H)
SYS.2.3.A19	Erhöhter Schutzbedarf (H)
SYS.2.3.A20	Erhöhter Schutzbedarf (H)

Clients unter macOS (SYS.2.4)

Also published freely as E-ITS version 2024 SYS.2.4

IT-Grundschutz Anforderungen in SYS.2.4, Clients unter macOS
Anforderung	Level
SYS.2.4.A1	Basis (B)
SYS.2.4.A2	Basis (B)
SYS.2.4.A3	Basis (B)
SYS.2.4.A4	Standard (S)
SYS.2.4.A5	Standard (S)
SYS.2.4.A6	Standard (S)
SYS.2.4.A7	Standard (S)
SYS.2.4.A8	Standard (S)
SYS.2.4.A9	Standard (S)
SYS.2.4.A10	Standard (S)
SYS.2.4.A11	Standard (S)
SYS.2.4.A12	Erhöhter Schutzbedarf (H)

Client-Virtualisierung (SYS.2.5)

Also published freely as E-ITS version 2024 SYS.2.5

IT-Grundschutz Anforderungen in SYS.2.5, Client-Virtualisierung
Anforderung	Level
SYS.2.5.A1	Basis (B)
SYS.2.5.A2	Basis (B)
SYS.2.5.A3	Basis (B)
SYS.2.5.A4	Standard (S)
SYS.2.5.A5	Standard (S)
SYS.2.5.A6	Standard (S)
SYS.2.5.A7	Standard (S)
SYS.2.5.A8	Standard (S)
SYS.2.5.A9	Standard (S)
SYS.2.5.A10	Standard (S)
SYS.2.5.A11	Standard (S)
SYS.2.5.A12	Standard (S)
SYS.2.5.A13	Erhöhter Schutzbedarf (H)
SYS.2.5.A14	Erhöhter Schutzbedarf (H)
SYS.2.5.A15	Erhöhter Schutzbedarf (H)
SYS.2.5.A16	Erhöhter Schutzbedarf (H)
SYS.2.5.A17	Erhöhter Schutzbedarf (H)
SYS.2.5.A18	Erhöhter Schutzbedarf (H)

Virtual Desktop Infrastructure (SYS.2.6)

IT-Grundschutz Anforderungen in SYS.2.6, Virtual Desktop Infrastructure
Anforderung	Level
SYS.2.6.A1	Basis (B)
SYS.2.6.A2	Basis (B)
SYS.2.6.A3	Standard (S)
SYS.2.6.A4	Standard (S)
SYS.2.6.A5	Standard (S)
SYS.2.6.A6	Standard (S)
SYS.2.6.A7	Standard (S)
SYS.2.6.A8	Standard (S)
SYS.2.6.A9	Standard (S)
SYS.2.6.A10	Standard (S)
SYS.2.6.A11	Standard (S)
SYS.2.6.A12	Standard (S)
SYS.2.6.A13	Erhöhter Schutzbedarf (H)
SYS.2.6.A14	Erhöhter Schutzbedarf (H)
SYS.2.6.A15	Erhöhter Schutzbedarf (H)
SYS.2.6.A16	Erhöhter Schutzbedarf (H)

Laptops (SYS.3.1)

Also published freely as E-ITS version 2024 SYS.3.1

IT-Grundschutz Anforderungen in SYS.3.1, Laptops
Anforderung	Level
SYS.3.1.A1	Basis (B)
SYS.3.1.A2	Basis (B)
SYS.3.1.A3	Basis (B)
SYS.3.1.A4	Basis (B)
SYS.3.1.A5	Basis (B)
SYS.3.1.A6	Standard (S)
SYS.3.1.A7	Standard (S)
SYS.3.1.A8	Standard (S)
SYS.3.1.A9	Basis (B)
SYS.3.1.A10	Standard (S)
SYS.3.1.A11	Standard (S)
SYS.3.1.A12	Standard (S)
SYS.3.1.A13	Standard (S)
SYS.3.1.A14	Standard (S)
SYS.3.1.A15	Standard (S)
SYS.3.1.A16	Erhöhter Schutzbedarf (H)
SYS.3.1.A17	Erhöhter Schutzbedarf (H)
SYS.3.1.A18	Erhöhter Schutzbedarf (H)

Allgemeine Smartphones und Tablets (SYS.3.2.1)

Also published freely as E-ITS version 2024 SYS.3.2.1

IT-Grundschutz Anforderungen in SYS.3.2.1, Allgemeine Smartphones und Tablets
Anforderung	Level
SYS.3.2.1.A1	Basis (B)
SYS.3.2.1.A2	Basis (B)
SYS.3.2.1.A3	Basis (B)
SYS.3.2.1.A4	Basis (B)
SYS.3.2.1.A5	Basis (B)
SYS.3.2.1.A6	Basis (B)
SYS.3.2.1.A7	Basis (B)
SYS.3.2.1.A8	Basis (B)
SYS.3.2.1.A9	Standard (S)
SYS.3.2.1.A10	Standard (S)
SYS.3.2.1.A11	Standard (S)
SYS.3.2.1.A12	Standard (S)
SYS.3.2.1.A13	Standard (S)
SYS.3.2.1.A14	Standard (S)
SYS.3.2.1.A15	Standard (S)
SYS.3.2.1.A16	Standard (S)
SYS.3.2.1.A17	Standard (S)
SYS.3.2.1.A18	Standard (S)
SYS.3.2.1.A19	Standard (S)
SYS.3.2.1.A20	Standard (S)
SYS.3.2.1.A21	Standard (S)
SYS.3.2.1.A22	Standard (S)
SYS.3.2.1.A23	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A24	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A25	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A26	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A27	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A28	Standard (S)
SYS.3.2.1.A29	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A30	Erhöhter Schutzbedarf (H)
SYS.3.2.1.A31	Standard (S)
SYS.3.2.1.A32	Standard (S)
SYS.3.2.1.A33	Standard (S)
SYS.3.2.1.A34	Standard (S)
SYS.3.2.1.A35	Erhöhter Schutzbedarf (H)

Mobile Device Management (MDM) (SYS.3.2.2)

Also published freely as E-ITS version 2024 SYS.3.2.2

IT-Grundschutz Anforderungen in SYS.3.2.2, Mobile Device Management (MDM)
Anforderung	Level
SYS.3.2.2.A1	Basis (B)
SYS.3.2.2.A2	Basis (B)
SYS.3.2.2.A3	Basis (B)
SYS.3.2.2.A4	Basis (B)
SYS.3.2.2.A5	Basis (B)
SYS.3.2.2.A6	Standard (S)
SYS.3.2.2.A7	Standard (S)
SYS.3.2.2.A8	Standard (S)
SYS.3.2.2.A9	Standard (S)
SYS.3.2.2.A10	Standard (S)
SYS.3.2.2.A11	Standard (S)
SYS.3.2.2.A12	Standard (S)
SYS.3.2.2.A13	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A14	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A15	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A16	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A17	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A18	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A19	Erhöhter Schutzbedarf (H)
SYS.3.2.2.A20	Basis (B)
SYS.3.2.2.A21	Standard (S)
SYS.3.2.2.A22	Standard (S)
SYS.3.2.2.A23	Erhöhter Schutzbedarf (H)

iOS (for Enterprise) (SYS.3.2.3)

Also published freely as E-ITS version 2024 SYS.3.2.3

IT-Grundschutz Anforderungen in SYS.3.2.3, iOS (for Enterprise)
Anforderung	Level
SYS.3.2.3.A1	Basis (B)
SYS.3.2.3.A2	Basis (B)
SYS.3.2.3.A3	Basis (B)
SYS.3.2.3.A4	Basis (B)
SYS.3.2.3.A5	Basis (B)
SYS.3.2.3.A6	Basis (B)
SYS.3.2.3.A7	Basis (B)
SYS.3.2.3.A8	Basis (B)
SYS.3.2.3.A9	Standard (S)
SYS.3.2.3.A10	Standard (S)
SYS.3.2.3.A11	Standard (S)
SYS.3.2.3.A12	Standard (S)
SYS.3.2.3.A13	Standard (S)
SYS.3.2.3.A14	Standard (S)
SYS.3.2.3.A15	Standard (S)
SYS.3.2.3.A16	Standard (S)
SYS.3.2.3.A17	Standard (S)
SYS.3.2.3.A18	Standard (S)
SYS.3.2.3.A19	Standard (S)
SYS.3.2.3.A20	Standard (S)
SYS.3.2.3.A21	Standard (S)
SYS.3.2.3.A22	Erhöhter Schutzbedarf (H)
SYS.3.2.3.A23	Erhöhter Schutzbedarf (H)
SYS.3.2.3.A24	Erhöhter Schutzbedarf (H)
SYS.3.2.3.A25	Erhöhter Schutzbedarf (H)
SYS.3.2.3.A26	Erhöhter Schutzbedarf (H)
SYS.3.2.3.A27	Erhöhter Schutzbedarf (H)

Android (SYS.3.2.4)

Also published freely as E-ITS version 2024 SYS.3.2.4

IT-Grundschutz Anforderungen in SYS.3.2.4, Android
Anforderung	Level
SYS.3.2.4.A1	Basis (B)
SYS.3.2.4.A2	Standard (S)
SYS.3.2.4.A3	Standard (S)
SYS.3.2.4.A4	Standard (S)
SYS.3.2.4.A5	Standard (S)
SYS.3.2.4.A6	Erhöhter Schutzbedarf (H)
SYS.3.2.4.A7	Erhöhter Schutzbedarf (H)

Mobiltelefon (SYS.3.3)

Also published freely as E-ITS version 2024 SYS.3.3

IT-Grundschutz Anforderungen in SYS.3.3, Mobiltelefon
Anforderung	Level
SYS.3.3.A1	Basis (B)
SYS.3.3.A2	Basis (B)
SYS.3.3.A3	Basis (B)
SYS.3.3.A4	Basis (B)
SYS.3.3.A5	Standard (S)
SYS.3.3.A6	Standard (S)
SYS.3.3.A7	Standard (S)
SYS.3.3.A8	Standard (S)
SYS.3.3.A9	Erhöhter Schutzbedarf (H)
SYS.3.3.A10	Standard (S)
SYS.3.3.A11	Standard (S)
SYS.3.3.A12	Standard (S)
SYS.3.3.A13	Erhöhter Schutzbedarf (H)
SYS.3.3.A14	Erhöhter Schutzbedarf (H)
SYS.3.3.A15	Erhöhter Schutzbedarf (H)

Drucker, Kopierer und Multifunktionsgeräte (SYS.4.1)

Also published freely as E-ITS version 2024 SYS.4.1

IT-Grundschutz Anforderungen in SYS.4.1, Drucker, Kopierer und Multifunktionsgeräte
Anforderung	Level
SYS.4.1.A1	Basis (B)
SYS.4.1.A2	Basis (B)
SYS.4.1.A3	Basis (B)
SYS.4.1.A4	Standard (S)
SYS.4.1.A5	Standard (S)
SYS.4.1.A6	Standard (S)
SYS.4.1.A7	Standard (S)
SYS.4.1.A8	Standard (S)
SYS.4.1.A9	Standard (S)
SYS.4.1.A10	Standard (S)
SYS.4.1.A11	Standard (S)
SYS.4.1.A12	Basis (B)
SYS.4.1.A13	Basis (B)
SYS.4.1.A14	Erhöhter Schutzbedarf (H)
SYS.4.1.A15	Standard (S)
SYS.4.1.A16	Erhöhter Schutzbedarf (H)
SYS.4.1.A17	Standard (S)
SYS.4.1.A18	Standard (S)
SYS.4.1.A19	Standard (S)
SYS.4.1.A20	Erhöhter Schutzbedarf (H)
SYS.4.1.A21	Erhöhter Schutzbedarf (H)
SYS.4.1.A22	Basis (B)

Eingebettete Systeme (SYS.4.3)

Also published freely as E-ITS version 2024 SYS.4.3

IT-Grundschutz Anforderungen in SYS.4.3, Eingebettete Systeme
Anforderung	Level
SYS.4.3.A1	Basis (B)
SYS.4.3.A2	Basis (B)
SYS.4.3.A3	Basis (B)
SYS.4.3.A4	Standard (S)
SYS.4.3.A5	Standard (S)
SYS.4.3.A6	Standard (S)
SYS.4.3.A7	Standard (S)
SYS.4.3.A8	Standard (S)
SYS.4.3.A9	Standard (S)
SYS.4.3.A10	Standard (S)
SYS.4.3.A11	Standard (S)
SYS.4.3.A12	Erhöhter Schutzbedarf (H)
SYS.4.3.A13	Erhöhter Schutzbedarf (H)
SYS.4.3.A14	Erhöhter Schutzbedarf (H)
SYS.4.3.A15	Erhöhter Schutzbedarf (H)
SYS.4.3.A16	Erhöhter Schutzbedarf (H)
SYS.4.3.A17	Erhöhter Schutzbedarf (H)
SYS.4.3.A18	Erhöhter Schutzbedarf (H)

Allgemeines IoT-Gerät (SYS.4.4)

Also published freely as E-ITS version 2024 SYS.4.4

IT-Grundschutz Anforderungen in SYS.4.4, Allgemeines IoT-Gerät
Anforderung	Level
SYS.4.4.A1	Basis (B)
SYS.4.4.A2	Basis (B)
SYS.4.4.A3	Basis (B)
SYS.4.4.A4	Basis (B)
SYS.4.4.A5	Basis (B)
SYS.4.4.A6	Standard (S)
SYS.4.4.A7	Standard (S)
SYS.4.4.A8	Standard (S)
SYS.4.4.A9	Standard (S)
SYS.4.4.A10	Standard (S)
SYS.4.4.A11	Standard (S)
SYS.4.4.A12	Standard (S)
SYS.4.4.A13	Standard (S)
SYS.4.4.A14	Standard (S)
SYS.4.4.A15	Standard (S)
SYS.4.4.A16	Standard (S)
SYS.4.4.A17	Standard (S)
SYS.4.4.A18	Standard (S)
SYS.4.4.A19	Standard (S)
SYS.4.4.A20	Standard (S)
SYS.4.4.A21	Erhöhter Schutzbedarf (H)
SYS.4.4.A22	Erhöhter Schutzbedarf (H)
SYS.4.4.A23	Erhöhter Schutzbedarf (H)
SYS.4.4.A24	Erhöhter Schutzbedarf (H)

Wechseldatenträger (SYS.4.5)

Also published freely as E-ITS version 2024 SYS.4.5

IT-Grundschutz Anforderungen in SYS.4.5, Wechseldatenträger
Anforderung	Level
SYS.4.5.A1	Basis (B)
SYS.4.5.A2	Basis (B)
SYS.4.5.A3	Basis (B)
SYS.4.5.A4	Standard (S)
SYS.4.5.A5	Standard (S)
SYS.4.5.A6	Standard (S)
SYS.4.5.A7	Standard (S)
SYS.4.5.A8	Standard (S)
SYS.4.5.A9	Erhöhter Schutzbedarf (H)
SYS.4.5.A10	Basis (B)
SYS.4.5.A11	Erhöhter Schutzbedarf (H)
SYS.4.5.A12	Basis (B)
SYS.4.5.A13	Standard (S)
SYS.4.5.A14	Erhöhter Schutzbedarf (H)
SYS.4.5.A15	Erhöhter Schutzbedarf (H)
SYS.4.5.A16	Erhöhter Schutzbedarf (H)
SYS.4.5.A17	Standard (S)

IND — Industrielle IT · 78 Anforderungen

Prozessleit- und Automatisierungstechnik (IND.1)

Also published freely as E-ITS version 2024 IND.1

IT-Grundschutz Anforderungen in IND.1, Prozessleit- und Automatisierungstechnik
Anforderung	Level
IND.1.A1	Basis (B)
IND.1.A2	Basis (B)
IND.1.A3	Basis (B)
IND.1.A4	Standard (S)
IND.1.A5	Standard (S)
IND.1.A6	Standard (S)
IND.1.A7	Standard (S)
IND.1.A8	Standard (S)
IND.1.A9	Standard (S)
IND.1.A10	Standard (S)
IND.1.A11	Standard (S)
IND.1.A12	Standard (S)
IND.1.A13	Erhöhter Schutzbedarf (H)
IND.1.A14	Erhöhter Schutzbedarf (H)
IND.1.A15	Erhöhter Schutzbedarf (H)
IND.1.A16	Erhöhter Schutzbedarf (H)
IND.1.A17	Erhöhter Schutzbedarf (H)
IND.1.A18	Basis (B)
IND.1.A19	Basis (B)
IND.1.A20	Standard (S)
IND.1.A21	Standard (S)
IND.1.A22	Standard (S)
IND.1.A23	Standard (S)
IND.1.A24	Erhöhter Schutzbedarf (H)

Allgemeine ICS-Komponente (IND.2.1)

Also published freely as E-ITS version 2024 IND.2.1

IT-Grundschutz Anforderungen in IND.2.1, Allgemeine ICS-Komponente
Anforderung	Level
IND.2.1.A1	Basis (B)
IND.2.1.A2	Basis (B)
IND.2.1.A3	Basis (B)
IND.2.1.A4	Basis (B)
IND.2.1.A5	Basis (B)
IND.2.1.A6	Basis (B)
IND.2.1.A7	Standard (S)
IND.2.1.A8	Standard (S)
IND.2.1.A9	Standard (S)
IND.2.1.A10	Standard (S)
IND.2.1.A11	Standard (S)
IND.2.1.A12	Standard (S)
IND.2.1.A13	Standard (S)
IND.2.1.A14	Standard (S)
IND.2.1.A15	Standard (S)
IND.2.1.A16	Standard (S)
IND.2.1.A17	Standard (S)
IND.2.1.A18	Erhöhter Schutzbedarf (H)
IND.2.1.A19	Erhöhter Schutzbedarf (H)
IND.2.1.A20	Erhöhter Schutzbedarf (H)

Speicherprogrammierbare Steuerung (SPS) (IND.2.2)

Also published freely as E-ITS version 2024 IND.2.2

IT-Grundschutz Anforderungen in IND.2.2, Speicherprogrammierbare Steuerung (SPS)
Anforderung	Level
IND.2.2.A1	Standard (S)
IND.2.2.A2	Standard (S)
IND.2.2.A3	Standard (S)

Sensoren und Aktoren (IND.2.3)

Also published freely as E-ITS version 2024 IND.2.3

IT-Grundschutz Anforderungen in IND.2.3, Sensoren und Aktoren
Anforderung	Level
IND.2.3.A1	Basis (B)
IND.2.3.A2	Standard (S)
IND.2.3.A3	Erhöhter Schutzbedarf (H)

Maschine (IND.2.4)

Also published freely as E-ITS version 2024 IND.2.4

IT-Grundschutz Anforderungen in IND.2.4, Maschine
Anforderung	Level
IND.2.4.A1	Basis (B)
IND.2.4.A2	Basis (B)

Safety Instrumented Systems (IND.2.7)

Also published freely as E-ITS version 2024 IND.2.7

IT-Grundschutz Anforderungen in IND.2.7, Safety Instrumented Systems
Anforderung	Level
IND.2.7.A1	Basis (B)
IND.2.7.A2	Basis (B)
IND.2.7.A3	Basis (B)
IND.2.7.A4	Standard (S)
IND.2.7.A5	Standard (S)
IND.2.7.A6	Standard (S)
IND.2.7.A7	Standard (S)
IND.2.7.A8	Standard (S)
IND.2.7.A9	Standard (S)
IND.2.7.A10	Standard (S)
IND.2.7.A11	Standard (S)
IND.2.7.A12	Erhöhter Schutzbedarf (H)

Fernwartung im industriellen Umfeld (IND.3.2)

Also published freely as E-ITS version 2024 IND.3.2

IT-Grundschutz Anforderungen in IND.3.2, Fernwartung im industriellen Umfeld
Anforderung	Level
IND.3.2.A1	Basis (B)
IND.3.2.A2	Basis (B)
IND.3.2.A3	Basis (B)
IND.3.2.A4	Basis (B)
IND.3.2.A5	Basis (B)
IND.3.2.A6	Basis (B)
IND.3.2.A7	Standard (S)
IND.3.2.A8	Standard (S)
IND.3.2.A9	Standard (S)
IND.3.2.A10	Standard (S)
IND.3.2.A11	Standard (S)
IND.3.2.A12	Erhöhter Schutzbedarf (H)
IND.3.2.A13	Erhöhter Schutzbedarf (H)
IND.3.2.A14	Erhöhter Schutzbedarf (H)

NET — Netze und Kommunikation · 246 Anforderungen

Netzarchitektur und -design (NET.1.1)

Also published freely as E-ITS version 2024 NET.1.1

IT-Grundschutz Anforderungen in NET.1.1, Netzarchitektur und -design
Anforderung	Level
NET.1.1.A1	Basis (B)
NET.1.1.A2	Basis (B)
NET.1.1.A3	Basis (B)
NET.1.1.A4	Basis (B)
NET.1.1.A5	Basis (B)
NET.1.1.A6	Basis (B)
NET.1.1.A7	Basis (B)
NET.1.1.A8	Basis (B)
NET.1.1.A9	Basis (B)
NET.1.1.A10	Basis (B)
NET.1.1.A11	Basis (B)
NET.1.1.A12	Basis (B)
NET.1.1.A13	Basis (B)
NET.1.1.A14	Basis (B)
NET.1.1.A15	Basis (B)
NET.1.1.A16	Standard (S)
NET.1.1.A17	Standard (S)
NET.1.1.A18	Standard (S)
NET.1.1.A19	Standard (S)
NET.1.1.A20	Standard (S)
NET.1.1.A21	Standard (S)
NET.1.1.A22	Standard (S)
NET.1.1.A23	Standard (S)
NET.1.1.A24	Standard (S)
NET.1.1.A25	Standard (S)
NET.1.1.A26	Standard (S)
NET.1.1.A27	Standard (S)
NET.1.1.A28	Erhöhter Schutzbedarf (H)
NET.1.1.A29	Erhöhter Schutzbedarf (H)
NET.1.1.A30	Erhöhter Schutzbedarf (H)
NET.1.1.A31	Erhöhter Schutzbedarf (H)
NET.1.1.A32	Erhöhter Schutzbedarf (H)
NET.1.1.A33	Erhöhter Schutzbedarf (H)
NET.1.1.A34	Erhöhter Schutzbedarf (H)
NET.1.1.A35	Erhöhter Schutzbedarf (H)
NET.1.1.A36	Erhöhter Schutzbedarf (H)

Netzmanagement (NET.1.2)

Also published freely as E-ITS version 2024 NET.1.2

IT-Grundschutz Anforderungen in NET.1.2, Netzmanagement
Anforderung	Level
NET.1.2.A1	Basis (B)
NET.1.2.A2	Basis (B)
NET.1.2.A3	Basis (B)
NET.1.2.A4	Basis (B)
NET.1.2.A5	Basis (B)
NET.1.2.A6	Basis (B)
NET.1.2.A7	Basis (B)
NET.1.2.A8	Basis (B)
NET.1.2.A9	Basis (B)
NET.1.2.A10	Basis (B)
NET.1.2.A11	Standard (S)
NET.1.2.A12	Standard (S)
NET.1.2.A13	Standard (S)
NET.1.2.A14	Standard (S)
NET.1.2.A15	Standard (S)
NET.1.2.A16	Standard (S)
NET.1.2.A17	Standard (S)
NET.1.2.A18	Standard (S)
NET.1.2.A19	Standard (S)
NET.1.2.A20	Standard (S)
NET.1.2.A21	Standard (S)
NET.1.2.A22	Standard (S)
NET.1.2.A23	Standard (S)
NET.1.2.A24	Standard (S)
NET.1.2.A25	Standard (S)
NET.1.2.A26	Standard (S)
NET.1.2.A27	Standard (S)
NET.1.2.A28	Standard (S)
NET.1.2.A29	Standard (S)
NET.1.2.A30	Erhöhter Schutzbedarf (H)
NET.1.2.A31	Erhöhter Schutzbedarf (H)
NET.1.2.A32	Erhöhter Schutzbedarf (H)
NET.1.2.A33	Erhöhter Schutzbedarf (H)
NET.1.2.A34	Erhöhter Schutzbedarf (H)
NET.1.2.A35	Erhöhter Schutzbedarf (H)
NET.1.2.A36	Erhöhter Schutzbedarf (H)
NET.1.2.A37	Erhöhter Schutzbedarf (H)
NET.1.2.A38	Erhöhter Schutzbedarf (H)

WLAN-Betrieb (NET.2.1)

Also published freely as E-ITS version 2024 NET.2.1

IT-Grundschutz Anforderungen in NET.2.1, WLAN-Betrieb
Anforderung	Level
NET.2.1.A1	Basis (B)
NET.2.1.A2	Basis (B)
NET.2.1.A3	Basis (B)
NET.2.1.A4	Basis (B)
NET.2.1.A5	Basis (B)
NET.2.1.A6	Basis (B)
NET.2.1.A7	Basis (B)
NET.2.1.A8	Basis (B)
NET.2.1.A9	Standard (S)
NET.2.1.A10	Standard (S)
NET.2.1.A11	Standard (S)
NET.2.1.A12	Standard (S)
NET.2.1.A13	Standard (S)
NET.2.1.A14	Standard (S)
NET.2.1.A15	Erhöhter Schutzbedarf (H)
NET.2.1.A16	Erhöhter Schutzbedarf (H)
NET.2.1.A17	Erhöhter Schutzbedarf (H)
NET.2.1.A18	Erhöhter Schutzbedarf (H)

WLAN-Nutzung (NET.2.2)

Also published freely as E-ITS version 2024 NET.2.2

IT-Grundschutz Anforderungen in NET.2.2, WLAN-Nutzung
Anforderung	Level
NET.2.2.A1	Basis (B)
NET.2.2.A2	Basis (B)
NET.2.2.A3	Basis (B)
NET.2.2.A4	Standard (S)

Router und Switches (NET.3.1)

Also published freely as E-ITS version 2024 NET.3.1

IT-Grundschutz Anforderungen in NET.3.1, Router und Switches
Anforderung	Level
NET.3.1.A1	Basis (B)
NET.3.1.A2	Basis (B)
NET.3.1.A3	Basis (B)
NET.3.1.A4	Basis (B)
NET.3.1.A5	Basis (B)
NET.3.1.A6	Basis (B)
NET.3.1.A7	Basis (B)
NET.3.1.A8	Basis (B)
NET.3.1.A9	Basis (B)
NET.3.1.A10	Standard (S)
NET.3.1.A11	Standard (S)
NET.3.1.A12	Standard (S)
NET.3.1.A13	Standard (S)
NET.3.1.A14	Standard (S)
NET.3.1.A15	Standard (S)
NET.3.1.A16	Standard (S)
NET.3.1.A17	Standard (S)
NET.3.1.A18	Standard (S)
NET.3.1.A19	Standard (S)
NET.3.1.A20	Standard (S)
NET.3.1.A21	Standard (S)
NET.3.1.A22	Standard (S)
NET.3.1.A23	Standard (S)
NET.3.1.A24	Erhöhter Schutzbedarf (H)
NET.3.1.A25	Erhöhter Schutzbedarf (H)
NET.3.1.A26	Erhöhter Schutzbedarf (H)
NET.3.1.A27	Erhöhter Schutzbedarf (H)
NET.3.1.A28	Erhöhter Schutzbedarf (H)

Firewall (NET.3.2)

Also published freely as E-ITS version 2024 NET.3.2

IT-Grundschutz Anforderungen in NET.3.2, Firewall
Anforderung	Level
NET.3.2.A1	Basis (B)
NET.3.2.A2	Basis (B)
NET.3.2.A3	Basis (B)
NET.3.2.A4	Basis (B)
NET.3.2.A5	Basis (B)
NET.3.2.A6	Basis (B)
NET.3.2.A7	Basis (B)
NET.3.2.A8	Basis (B)
NET.3.2.A9	Basis (B)
NET.3.2.A10	Basis (B)
NET.3.2.A11	Basis (B)
NET.3.2.A12	Basis (B)
NET.3.2.A13	Basis (B)
NET.3.2.A14	Basis (B)
NET.3.2.A15	Basis (B)
NET.3.2.A16	Standard (S)
NET.3.2.A17	Standard (S)
NET.3.2.A18	Standard (S)
NET.3.2.A19	Standard (S)
NET.3.2.A20	Standard (S)
NET.3.2.A21	Standard (S)
NET.3.2.A22	Standard (S)
NET.3.2.A23	Standard (S)
NET.3.2.A24	Standard (S)
NET.3.2.A25	Erhöhter Schutzbedarf (H)
NET.3.2.A26	Erhöhter Schutzbedarf (H)
NET.3.2.A27	Erhöhter Schutzbedarf (H)
NET.3.2.A28	Erhöhter Schutzbedarf (H)
NET.3.2.A29	Erhöhter Schutzbedarf (H)
NET.3.2.A30	Erhöhter Schutzbedarf (H)
NET.3.2.A31	Erhöhter Schutzbedarf (H)
NET.3.2.A32	Standard (S)

VPN (NET.3.3)

Also published freely as E-ITS version 2024 NET.3.3

IT-Grundschutz Anforderungen in NET.3.3, VPN
Anforderung	Level
NET.3.3.A1	Basis (B)
NET.3.3.A2	Basis (B)
NET.3.3.A3	Basis (B)
NET.3.3.A4	Basis (B)
NET.3.3.A5	Basis (B)
NET.3.3.A6	Standard (S)
NET.3.3.A7	Standard (S)
NET.3.3.A8	Standard (S)
NET.3.3.A9	Standard (S)
NET.3.3.A10	Standard (S)
NET.3.3.A11	Standard (S)
NET.3.3.A12	Standard (S)
NET.3.3.A13	Standard (S)

Network Access Control (NET.3.4)

Also published freely as E-ITS version 2024 NET.3.4

IT-Grundschutz Anforderungen in NET.3.4, Network Access Control
Anforderung	Level
NET.3.4.A1	Basis (B)
NET.3.4.A2	Standard (S)
NET.3.4.A3	Standard (S)
NET.3.4.A4	Standard (S)
NET.3.4.A5	Standard (S)
NET.3.4.A6	Standard (S)
NET.3.4.A7	Standard (S)
NET.3.4.A8	Standard (S)
NET.3.4.A9	Standard (S)
NET.3.4.A10	Standard (S)
NET.3.4.A11	Standard (S)
NET.3.4.A12	Standard (S)
NET.3.4.A13	Standard (S)
NET.3.4.A14	Standard (S)
NET.3.4.A15	Standard (S)
NET.3.4.A16	Standard (S)
NET.3.4.A17	Standard (S)
NET.3.4.A18	Standard (S)
NET.3.4.A19	Standard (S)
NET.3.4.A20	Erhöhter Schutzbedarf (H)
NET.3.4.A21	Erhöhter Schutzbedarf (H)
NET.3.4.A22	Erhöhter Schutzbedarf (H)
NET.3.4.A23	Erhöhter Schutzbedarf (H)
NET.3.4.A24	Erhöhter Schutzbedarf (H)
NET.3.4.A25	Erhöhter Schutzbedarf (H)
NET.3.4.A26	Erhöhter Schutzbedarf (H)
NET.3.4.A27	Erhöhter Schutzbedarf (H)

TK-Anlagen (NET.4.1)

Also published freely as E-ITS version 2024 NET.4.1

IT-Grundschutz Anforderungen in NET.4.1, TK-Anlagen
Anforderung	Level
NET.4.1.A1	Basis (B)
NET.4.1.A2	Basis (B)
NET.4.1.A3	Basis (B)
NET.4.1.A4	Basis (B)
NET.4.1.A5	Basis (B)
NET.4.1.A6	Standard (S)
NET.4.1.A7	Standard (S)
NET.4.1.A8	Standard (S)
NET.4.1.A9	Standard (S)
NET.4.1.A10	Standard (S)
NET.4.1.A11	Standard (S)
NET.4.1.A12	Standard (S)
NET.4.1.A13	Standard (S)
NET.4.1.A14	Standard (S)
NET.4.1.A15	Standard (S)
NET.4.1.A16	Standard (S)
NET.4.1.A17	Standard (S)
NET.4.1.A18	Erhöhter Schutzbedarf (H)
NET.4.1.A19	Erhöhter Schutzbedarf (H)

VoIP (NET.4.2)

Also published freely as E-ITS version 2024 NET.4.2

IT-Grundschutz Anforderungen in NET.4.2, VoIP
Anforderung	Level
NET.4.2.A1	Basis (B)
NET.4.2.A2	Basis (B)
NET.4.2.A3	Basis (B)
NET.4.2.A4	Basis (B)
NET.4.2.A5	Basis (B)
NET.4.2.A6	Basis (B)
NET.4.2.A7	Standard (S)
NET.4.2.A8	Standard (S)
NET.4.2.A9	Standard (S)
NET.4.2.A10	Standard (S)
NET.4.2.A11	Standard (S)
NET.4.2.A12	Standard (S)
NET.4.2.A13	Standard (S)
NET.4.2.A14	Erhöhter Schutzbedarf (H)
NET.4.2.A15	Erhöhter Schutzbedarf (H)
NET.4.2.A16	Erhöhter Schutzbedarf (H)

Faxgeräte und Faxserver (NET.4.3)

IT-Grundschutz Anforderungen in NET.4.3, Faxgeräte und Faxserver
Anforderung	Level
NET.4.3.A1	Basis (B)
NET.4.3.A2	Basis (B)
NET.4.3.A3	Basis (B)
NET.4.3.A4	Standard (S)
NET.4.3.A5	Standard (S)
NET.4.3.A6	Standard (S)
NET.4.3.A7	Standard (S)
NET.4.3.A8	Standard (S)
NET.4.3.A9	Standard (S)
NET.4.3.A10	Standard (S)
NET.4.3.A11	Erhöhter Schutzbedarf (H)
NET.4.3.A12	Erhöhter Schutzbedarf (H)
NET.4.3.A13	Erhöhter Schutzbedarf (H)
NET.4.3.A14	Erhöhter Schutzbedarf (H)
NET.4.3.A15	Erhöhter Schutzbedarf (H)

INF — Infrastruktur · 231 Anforderungen

Allgemeines Gebäude (INF.1)

Also published freely as E-ITS version 2024 INF.1

IT-Grundschutz Anforderungen in INF.1, Allgemeines Gebäude
Anforderung	Level
INF.1.A1	Basis (B)
INF.1.A2	Basis (B)
INF.1.A3	Basis (B)
INF.1.A4	Basis (B)
INF.1.A5	Basis (B)
INF.1.A6	Basis (B)
INF.1.A7	Basis (B)
INF.1.A8	Basis (B)
INF.1.A9	Standard (S)
INF.1.A10	Basis (B)
INF.1.A11	Standard (S)
INF.1.A12	Standard (S)
INF.1.A13	Standard (S)
INF.1.A14	Standard (S)
INF.1.A15	Standard (S)
INF.1.A16	Standard (S)
INF.1.A17	Standard (S)
INF.1.A18	Standard (S)
INF.1.A19	Standard (S)
INF.1.A20	Standard (S)
INF.1.A21	Erhöhter Schutzbedarf (H)
INF.1.A22	Erhöhter Schutzbedarf (H)
INF.1.A23	Erhöhter Schutzbedarf (H)
INF.1.A24	Erhöhter Schutzbedarf (H)
INF.1.A25	Erhöhter Schutzbedarf (H)
INF.1.A26	Erhöhter Schutzbedarf (H)
INF.1.A27	Standard (S)
INF.1.A28	Erhöhter Schutzbedarf (H)
INF.1.A29	Erhöhter Schutzbedarf (H)
INF.1.A30	Erhöhter Schutzbedarf (H)
INF.1.A31	Erhöhter Schutzbedarf (H)
INF.1.A32	Erhöhter Schutzbedarf (H)
INF.1.A33	Erhöhter Schutzbedarf (H)
INF.1.A34	Erhöhter Schutzbedarf (H)
INF.1.A35	Erhöhter Schutzbedarf (H)
INF.1.A36	Standard (S)

Rechenzentrum sowie Serverraum (INF.2)

Also published freely as E-ITS version 2024 INF.2

IT-Grundschutz Anforderungen in INF.2, Rechenzentrum sowie Serverraum
Anforderung	Level
INF.2.A1	Basis (B)
INF.2.A2	Basis (B)
INF.2.A3	Basis (B)
INF.2.A4	Basis (B)
INF.2.A5	Basis (B)
INF.2.A6	Basis (B)
INF.2.A7	Basis (B)
INF.2.A8	Basis (B)
INF.2.A9	Basis (B)
INF.2.A10	Basis (B)
INF.2.A11	Basis (B)
INF.2.A12	Standard (S)
INF.2.A13	Standard (S)
INF.2.A14	Standard (S)
INF.2.A15	Standard (S)
INF.2.A16	Standard (S)
INF.2.A17	Basis (B)
INF.2.A18	Standard (S)
INF.2.A19	Standard (S)
INF.2.A20	Standard (S)
INF.2.A21	Erhöhter Schutzbedarf (H)
INF.2.A22	Erhöhter Schutzbedarf (H)
INF.2.A23	Erhöhter Schutzbedarf (H)
INF.2.A24	Erhöhter Schutzbedarf (H)
INF.2.A25	Erhöhter Schutzbedarf (H)
INF.2.A26	Erhöhter Schutzbedarf (H)
INF.2.A27	Erhöhter Schutzbedarf (H)
INF.2.A28	Erhöhter Schutzbedarf (H)
INF.2.A29	Basis (B)
INF.2.A30	Standard (S)

Raum sowie Schrank für technische Infrastruktur (INF.5)

Also published freely as E-ITS version 2024 INF.5

IT-Grundschutz Anforderungen in INF.5, Raum sowie Schrank für technische Infrastruktur
Anforderung	Level
INF.5.A1	Basis (B)
INF.5.A2	Basis (B)
INF.5.A3	Basis (B)
INF.5.A4	Basis (B)
INF.5.A5	Basis (B)
INF.5.A6	Basis (B)
INF.5.A7	Basis (B)
INF.5.A8	Standard (S)
INF.5.A9	Basis (B)
INF.5.A10	Standard (S)
INF.5.A11	Standard (S)
INF.5.A12	Standard (S)
INF.5.A13	Standard (S)
INF.5.A14	Standard (S)
INF.5.A15	Standard (S)
INF.5.A16	Standard (S)
INF.5.A17	Standard (S)
INF.5.A18	Erhöhter Schutzbedarf (H)
INF.5.A19	Erhöhter Schutzbedarf (H)
INF.5.A20	Erhöhter Schutzbedarf (H)
INF.5.A21	Erhöhter Schutzbedarf (H)
INF.5.A22	Erhöhter Schutzbedarf (H)
INF.5.A23	Erhöhter Schutzbedarf (H)
INF.5.A24	Erhöhter Schutzbedarf (H)
INF.5.A25	Erhöhter Schutzbedarf (H)
INF.5.A26	Erhöhter Schutzbedarf (H)

Datenträgerarchiv (INF.6)

Also published freely as E-ITS version 2024 INF.6

IT-Grundschutz Anforderungen in INF.6, Datenträgerarchiv
Anforderung	Level
INF.6.A1	Basis (B)
INF.6.A2	Basis (B)
INF.6.A3	Basis (B)
INF.6.A4	Basis (B)
INF.6.A5	Standard (S)
INF.6.A6	Standard (S)
INF.6.A7	Standard (S)
INF.6.A8	Standard (S)
INF.6.A9	Erhöhter Schutzbedarf (H)

Büroarbeitsplatz (INF.7)

Also published freely as E-ITS version 2024 INF.7

IT-Grundschutz Anforderungen in INF.7, Büroarbeitsplatz
Anforderung	Level
INF.7.A1	Basis (B)
INF.7.A2	Basis (B)
INF.7.A3	Standard (S)
INF.7.A4	Standard (S)
INF.7.A5	Standard (S)
INF.7.A6	Standard (S)
INF.7.A7	Standard (S)
INF.7.A8	Erhöhter Schutzbedarf (H)

Häuslicher Arbeitsplatz (INF.8)

Also published freely as E-ITS version 2024 INF.8

IT-Grundschutz Anforderungen in INF.8, Häuslicher Arbeitsplatz
Anforderung	Level
INF.8.A1	Basis (B)
INF.8.A2	Basis (B)
INF.8.A3	Basis (B)
INF.8.A4	Standard (S)
INF.8.A5	Standard (S)
INF.8.A6	Erhöhter Schutzbedarf (H)

Mobiler Arbeitsplatz (INF.9)

Also published freely as E-ITS version 2024 INF.9

IT-Grundschutz Anforderungen in INF.9, Mobiler Arbeitsplatz
Anforderung	Level
INF.9.A1	Basis (B)
INF.9.A2	Basis (B)
INF.9.A3	Basis (B)
INF.9.A4	Basis (B)
INF.9.A5	Standard (S)
INF.9.A6	Standard (S)
INF.9.A7	Standard (S)
INF.9.A8	Standard (S)
INF.9.A9	Standard (S)
INF.9.A10	Erhöhter Schutzbedarf (H)
INF.9.A11	Erhöhter Schutzbedarf (H)
INF.9.A12	Standard (S)

Besprechungs-, Veranstaltungs- und Schulungsräume (INF.10)

Also published freely as E-ITS version 2024 INF.10

IT-Grundschutz Anforderungen in INF.10, Besprechungs-, Veranstaltungs- und Schulungsräume
Anforderung	Level
INF.10.A1	Basis (B)
INF.10.A2	Basis (B)
INF.10.A3	Basis (B)
INF.10.A4	Standard (S)
INF.10.A5	Standard (S)
INF.10.A6	Standard (S)
INF.10.A7	Standard (S)
INF.10.A8	Standard (S)
INF.10.A9	Erhöhter Schutzbedarf (H)
INF.10.A10	Erhöhter Schutzbedarf (H)

Allgemeines Fahrzeug (INF.11)

Also published freely as E-ITS version 2024 INF.11

IT-Grundschutz Anforderungen in INF.11, Allgemeines Fahrzeug
Anforderung	Level
INF.11.A1	Basis (B)
INF.11.A2	Basis (B)
INF.11.A3	Basis (B)
INF.11.A4	Standard (S)
INF.11.A5	Standard (S)
INF.11.A6	Standard (S)
INF.11.A7	Standard (S)
INF.11.A8	Standard (S)
INF.11.A9	Standard (S)
INF.11.A10	Standard (S)
INF.11.A11	Erhöhter Schutzbedarf (H)
INF.11.A12	Erhöhter Schutzbedarf (H)
INF.11.A13	Erhöhter Schutzbedarf (H)
INF.11.A14	Erhöhter Schutzbedarf (H)
INF.11.A15	Erhöhter Schutzbedarf (H)
INF.11.A16	Erhöhter Schutzbedarf (H)
INF.11.A17	Erhöhter Schutzbedarf (H)

Verkabelung (INF.12)

Also published freely as E-ITS version 2024 INF.12

IT-Grundschutz Anforderungen in INF.12, Verkabelung
Anforderung	Level
INF.12.A1	Basis (B)
INF.12.A2	Basis (B)
INF.12.A3	Basis (B)
INF.12.A4	Basis (B)
INF.12.A5	Standard (S)
INF.12.A6	Standard (S)
INF.12.A7	Standard (S)
INF.12.A8	Standard (S)
INF.12.A9	Standard (S)
INF.12.A10	Standard (S)
INF.12.A11	Standard (S)
INF.12.A12	Standard (S)
INF.12.A13	Standard (S)
INF.12.A14	Erhöhter Schutzbedarf (H)
INF.12.A15	Erhöhter Schutzbedarf (H)
INF.12.A16	Erhöhter Schutzbedarf (H)
INF.12.A17	Erhöhter Schutzbedarf (H)

Technisches Gebäudemanagement (INF.13)

Also published freely as E-ITS version 2024 INF.13

IT-Grundschutz Anforderungen in INF.13, Technisches Gebäudemanagement
Anforderung	Level
INF.13.A1	Basis (B)
INF.13.A2	Basis (B)
INF.13.A3	Basis (B)
INF.13.A4	Standard (S)
INF.13.A5	Standard (S)
INF.13.A6	Standard (S)
INF.13.A7	Standard (S)
INF.13.A8	Standard (S)
INF.13.A9	Standard (S)
INF.13.A10	Standard (S)
INF.13.A11	Standard (S)
INF.13.A12	Standard (S)
INF.13.A13	Standard (S)
INF.13.A14	Standard (S)
INF.13.A15	Standard (S)
INF.13.A16	Standard (S)
INF.13.A17	Standard (S)
INF.13.A18	Standard (S)
INF.13.A19	Standard (S)
INF.13.A20	Standard (S)
INF.13.A21	Standard (S)
INF.13.A22	Standard (S)
INF.13.A23	Standard (S)
INF.13.A24	Standard (S)
INF.13.A25	Erhöhter Schutzbedarf (H)
INF.13.A26	Erhöhter Schutzbedarf (H)
INF.13.A27	Erhöhter Schutzbedarf (H)
INF.13.A28	Erhöhter Schutzbedarf (H)
INF.13.A29	Erhöhter Schutzbedarf (H)
INF.13.A30	Erhöhter Schutzbedarf (H)

Gebäudeautomation (INF.14)

Also published freely as E-ITS version 2024 INF.14

IT-Grundschutz Anforderungen in INF.14, Gebäudeautomation
Anforderung	Level
INF.14.A1	Basis (B)
INF.14.A2	Basis (B)
INF.14.A3	Basis (B)
INF.14.A4	Basis (B)
INF.14.A5	Basis (B)
INF.14.A6	Basis (B)
INF.14.A7	Standard (S)
INF.14.A8	Standard (S)
INF.14.A9	Standard (S)
INF.14.A10	Standard (S)
INF.14.A11	Standard (S)
INF.14.A12	Standard (S)
INF.14.A13	Standard (S)
INF.14.A14	Standard (S)
INF.14.A15	Standard (S)
INF.14.A16	Standard (S)
INF.14.A17	Standard (S)
INF.14.A18	Standard (S)
INF.14.A19	Standard (S)
INF.14.A20	Standard (S)
INF.14.A21	Standard (S)
INF.14.A22	Standard (S)
INF.14.A23	Standard (S)
INF.14.A24	Standard (S)
INF.14.A25	Standard (S)
INF.14.A26	Standard (S)
INF.14.A27	Standard (S)
INF.14.A28	Erhöhter Schutzbedarf (H)
INF.14.A29	Erhöhter Schutzbedarf (H)
INF.14.A30	Erhöhter Schutzbedarf (H)

Where each reference takes you

Every identifier on this page is a link. Inside the site: an Anforderung identifier links to itself, so you can cite a single row in an audit note; a group heading links to itself; and every article 21(2) letter opens that measure in full — its wording, what it means and what an auditor asks for.

Catalogue reviewed 2026-07-26, against IT-Grundschutz-Kompendium Edition 2023 requirements of 2023-02-01. IT-Grundschutz and the documents it comes from belong to Bundesamt für Sicherheit in der Informationstechnik (BSI).

Germany

Germany Transposition Pack (NIS2UmsuCG)

How NIS2 actually applies in Germany: the BSI as competent authority, registration duties, and where German law goes beyond the directive.

National reference document (Markdown): what binds you in Germany, not the directive
The national law, its adoption and entry-into-force dates, and its current status
How Germany numbers the article 21(2) measures, and any measure it adds
Registration channel and portal, with the deadline rule
Supervision: who inspects, and from when
IT-Grundschutz: the three implementation routes, the modules and layers, the move to Grundschutz++, and why it is the de facto benchmark without being legally mandatory
Gap-analysis worksheet (CSV, opens in Excel): one row per measure with the national reference, plus status, evidence, gap, remediation, owner and target-date columns
Framework mapping (CSV): each covered measure of article 21(2) against all eight frameworks in our data hub — the six national assessment frameworks plus ISO/IEC 27001 and NIST SP 800-53 — with the units that carry it, the level the mapping is made at, and the stated limit of that mapping
Mapping legend (CSV): every framework unit cited, with its meaning — the 22 NIST CSF 2.0 categories used by CyFun, the 10 IT-Grundschutz layers, the 10 C2M2 domains, the 93 ISO/IEC 27001 Annex A controls and the 20 NIST SP 800-53 families
NIS2-to-enterprise crosswalk (CSV): one row per measure, one column per framework — the national frameworks a supervisor reads, then ISO/IEC 27001 Annex A controls and NIST SP 800-53 families, so you can see what you already hold before building anything new
Every fact carries its source and a review date — regenerated from our data hub, so it cannot drift from the site

129 € excl. VAT

Instant download · 30-day money-back guarantee

Sources

https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/it-grundschutz_node.html

We are not affiliated with Bundesamt für Sicherheit in der Informationstechnik (BSI). IT-Grundschutz and related marks belong to their owners.