BSI IT-Grundschutz: Implementing Platform Requirements
BSI IT-Grundschutz module SYS.1.1, requirement A3: Restrictive permission assignment. Requirement A6: Deactivation of unnecessary services. Requirement A1: Applying updates and patches. These are not recommendations. They are verifiable requirements. The question is not whether you have implemented them. It is whether you can prove it.
The gap rarely lies with intent. It lies between the configuration sitting on a server and the structured evidence a BSI auditor needs to see. BSI IT-Grundschutz does not just describe what secure IT operations look like. It describes exactly what must be implemented and demonstrated. lennlay closes that gap: Bausteine are translated into automated, versioned platform states. Evidence is not produced after the fact. It is a byproduct of the implementation itself.
Not a certification project. A description of how security actually works.
BSI IT-Grundschutz is not primarily a certification instrument. It is a description of what functioning IT security looks like in practice.
The BSI IT-Grundschutz Kompendium contains Bausteine for every IT system type. Each Baustein is structured around three requirement tiers: Basis-Anforderungen that must be implemented in all cases; Standard-Anforderungen for normal protection needs; and requirements for elevated protection needs on high-risk systems.
The critical difference from ISO 27001: Bausteine give concrete technical requirements, not "implement appropriate controls." Instead: configure service accounts with minimal privileges, enforce SSH with public key authentication, deactivate unused services. That is not open to interpretation. That is an audit requirement.
The publisher is the BSI, the German Federal Office for Information Security. The Kompendium is updated regularly (current version: 2023). The optional BSI IT-Grundschutz certification builds on the methodology but is not a prerequisite for compliance. Many organizations use IT-Grundschutz as a compliance basis without pursuing formal certification.
- Publisher: BSI, German Federal Office for Information Security
- Current: IT-Grundschutz-Kompendium 2023
- Structure: Bausteine by IT system type, three requirement tiers
- Certification: optional, not required for compliance
- Compatible with NIS2 (NIS2UmsuCG §30) and ISO 27001, combinable
- Not only for Behoerden: KRITIS operators, healthcare, and any German organization can use IT-Grundschutz as an ISMS basis
- BSI-Standard 200-2 describes the IT-Grundschutz methodology
- BSI-Standard 200-3 describes risk analysis using IT-Grundschutz
What the Kompendium specifically requires and how lennlay delivers it
Four Bausteine apply directly to lennlay platforms. Each defines verifiable requirements, not recommendations.
General Server
- A1 Applying updates and patches: regular, structured patch application
- A3 Restrictive permission assignment: service accounts with minimal privileges, no root logins for services
- A5 Protection against unauthorised access: SSH hardening, firewall rules, monitoring
- A6 Deactivation of unnecessary services: attack surface reduction
Servers under Unix (Linux/RHEL)
- A2 Careful assignment of IDs: UID/GID management, no shared accounts
- A6 No use of Telnet or other insecure protocols
- SSH with public key authentication (standard requirement)
- PAM configuration for centralised authentication control
Web Server
- Security headers: X-Frame-Options, HSTS, Content Security Policy
- TLS configuration: secure protocols and cipher suites only
- Access control: only necessary directories accessible
- Error handling: no internal error messages exposed to clients
Software Development / APP Deployment
- Requirements for secure software delivery
- Documentation of deployment processes
- Change control: every configuration change traceable
- Complete version history of all platform states
Two compliance requirements, one technical implementation
For organizations subject to both BSI IT-Grundschutz and NIS2 (NIS2UmsuCG) simultaneously, the good news is that the technical measures overlap significantly. A single lennlay implementation can serve both audit contexts.
NIS2UmsuCG §30 prescribes technical measures that are compatible with IT-Grundschutz Baustein implementations. Consistent IT-Grundschutz implementation addresses the majority of NIS2 Article 21 requirements at the same time. Two audit contexts, one technical basis.
BSI IT-Grundschutz is not a Behoerden framework
IT-Grundschutz is commonly perceived as a standard for German public authorities. That perception is an oversimplification that causes real problems in practice.
The BSI IT-Grundschutz Kompendium is open to everyone. Federal and state authorities use it, but they are not the only target audience. KRITIS operators frequently have to demonstrate IT-Grundschutz compliance or an equivalent methodology. Hospitals and healthcare organizations in the NIS2 scope benefit from the framework's concrete requirement structure. Enterprises in regulated sectors use IT-Grundschutz alongside ISO 27001. Both frameworks can be combined because they can be mapped against each other.
lennlay supports all of these use cases. The technical Bausteine are identical regardless of whether the client is a public authority, a KRITIS operator, or a regulated enterprise.
IT-Grundschutz as a binding framework. Evidence required by BSI auditors or internal audit.
IT-Grundschutz and the KRITIS regulation intersect. Platform hardening is mandatory, with mandatory evidence.
NIS2 scope and concrete requirement structure. IT-Grundschutz as a practical implementation framework.
IT-Grundschutz as an ISMS complement to ISO 27001. Combinable and mutually mappable.
Six deliverables for BSI IT-Grundschutz at platform level
Baustein-oriented Linux baselines
RHEL hardening aligned with SYS.1.1 and SYS.1.3. Service account control, SSH hardening, service cleanup, update management. Delivered through the lennlay.core Ansible Collection: reproducible, versioned, auditable.
Apache and Tomcat per APP.3.2
Web server hardening: TLS protocols, security headers, access control. GIaaS MVP catalogue: Apache HTTP Server available, Apache Tomcat available. Every configuration is validated against APP.3.2 requirements.
Documented evidence
The Compliance Scanner checks against BSI-referenced policies. Structured report with pass/fail per requirement. Usable by BSI auditors, internal data protection officers, and internal reviewers.
Exception documentation
Every exception to a Baustein requirement is documented, risk-assessed, and assigned an approval date and expiry. No "we deliberately skipped that" without evidence: only documented, approved exceptions.
EaaS for BSI projects
Marcel König (RHCA/RHCE) and Matthias Siegl for embedded BSI assessments, baseline build-out, and Compliance Scanner setup. Project support from the first Baustein mapping through to audit evidence.
On-premises operation
No SaaS, no cloud dependency. Ansible Collections run inside your own infrastructure. GIaaS baselines are delivered as artefacts: no external data flows, full control over your own environment.
When lennlay is the right partner for BSI IT-Grundschutz
BSI IT-Grundschutz evidence
Review by BSI auditors or internal audit teams. Baustein requirements must be technically demonstrated: not described, not planned, but evidenced. Manually managed platforms cannot deliver that without substantial manual effort. lennlay automates evidence generation as an integral part of platform configuration.
KRITIS requirements
Critical infrastructure operators face dual pressure: BSI IT-Grundschutz and the KRITIS regulation are interlinked. Platform hardening is not optional. It is mandatory, with a mandatory evidence obligation. lennlay delivers the technical implementation and the structured proof in one step.
Combined NIS2 obligation
Authorities and hospitals subject to both BSI IT-Grundschutz and NIS2 do not need two separate compliance infrastructures. One hardening standard, one set of evidence, two compliance requirements met. The technical measures overlap because the protection objectives are the same.
BSI IT-Grundschutz is auditable. Is your platform?
In 15 minutes we can clarify which Bausteine apply to your platforms and what lennlay can concretely deliver.
