ISO 27001 certification on the basis of IT-Grundschutz (BSI, Germany)
The German national route to an ISO 27001 certificate that also proves the BSI baseline protection catalogue is met; common for German public sector and critical infrastructure suppliers.
- 3requirementsin our own words
- 0editions none dated yet
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| Germany | Applies | Voluntary In force | None stated Voluntary; common in German public sector and critical-infrastructure supply chains. | Not stated |
| Austria, Belgium, Bulgaria, Switzerland, Cyprus, Czechia, Denmark, Estonia, Spain, Finland, France, United Kingdom, Greece, Croatia, Hungary, Ireland, Italy, Lithuania, Luxembourg, Latvia, Malta, Netherlands, Norway, Poland, Portugal, Romania, Sweden, Slovenia, Slovakia | Does not apply | Voluntary In force | None stated German BSI scheme; other countries use ISO 27001 with their own national variants. | Not stated |
What it asks for
3 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Define the information domain and the systems inside the certification. | Scope statement Policy, checked by document review | Security lead | Every year Management system, the organisation |
| Model the domain with the Compendium building blocks and assess residual risk. | Modelling and risk analysis Record, checked by document review | Security lead | Every year Management system, the organisation |
| Pass a BSI-licensed auditor's review; the certificate needs ISO 27001 requirements met plus the baseline protection measures. | Audit report and certificate Certificate, checked by document review | Compliance manager | Each certification cycle Management system, the organisation |
About the programme
- Assessed by
- A certification body licensed by the scheme owner
- Scope
- information domain
- Levels
- single certificate
- Validity
- Cycle not stated on the pages read.
- Time to a first certificate
- BSI: three months to a year depending on the volume of systems audited
- Accreditation route
- Auditors licensed by BSI
- Regulator
- BSI runs the certification scheme under the BSI Act
- Who asks for it
- Public tenders, Regulator
- Where it is used
- DE
Related programmes
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.