BSI IT-Grundschutz Exam Guide
BSI IT-Grundschutz Certification Guide
The BSI IT-Grundschutz is a methodology for information security developed by the German Federal Office for Information Security (BSI). It provides a comprehensive approach to building and maintaining an Information Security Management System (ISMS).
Overview
The IT-Grundschutz is based on the BSI-Standard 200 series:
- BSI-Standard 200-1: Information Security Management Systems (ISMS)
- BSI-Standard 200-2: IT-Grundschutz Methodology
- BSI-Standard 200-3: Risk Analysis
- BSI-Standard 200-4: Notfallvorsorge (Business Continuity Management)
The methodology is supported by the IT-Grundschutz-Kompendium, a collection of security modules (Bausteine) organized by layers (INF, SYS, NET, APP, IND, ORG, PER, OPS, DER, CON).
Exam Domains
| Domain | Focus |
|---|---|
| IT-Grundschutz-Methodik | BSI-200-2, structure, process, Kompendium |
| Schutzbedarfsfeststellung | Schutzbedarfsstufen: normal, hoch, sehr hoch |
| Bausteine & Kompendium | Layers, modules, security measures |
| ISMS nach BSI | BSI-200-1, ISMS, ISO 27001 comparison |
| Risikoanalyse & Sicherheitskonzept | BSI-200-3, risk analysis, security concept |
| Notfallvorsorge | BSI-200-4, BCM, RTO, RPO, Notfallhandbuch |
| Umsetzung & Zertifizierung | Implementation, audits, certification |
Key Concepts
Schutzbedarfsfeststellung
Every IT system is classified by its protection needs (Schutzbedarf): normal, hoch, or sehr hoch, based on the potential damage from a security breach.
Bausteine (Modules)
The Kompendium contains modules organized by layers. Each module describes security requirements and measures for a specific technology or process.
Schutzziele
The three core security objectives: Vertraulichkeit (confidentiality), Integrität (integrity), Verfügbarkeit (availability).
Notfallvorsorge
Business Continuity Management includes the Business Impact Analysis (BIA), Recovery Time Objective (RTO), Recovery Point Objective (RPO), and a Notfallhandbuch (emergency manual).
Study Tips
- Learn the BSI-Standard 200 series structure (200-1 through 200-4).
- Understand the Schutzbedarfsstufen and how to determine them.
- Memorize the Bausteine layers (INF, SYS, NET, APP, IND, ORG, PER, OPS, DER, CON).
- Practice the risk analysis process (BSI-200-3).
- Know the difference between BSI-Grundschutz and ISO 27001.
- Understand RTO vs RPO and the Notfallvorsorge process.
Bereit, dein Wissen zu testen?
Probiere unsere Übungsprüfungen mit Hunderten von realistischen Fragen aus.
Üben starten →