SaaSFort Germany’s Federal Office for Information Security (BSI) launched the modernized IT-Grundschutz framework in January 2026. For SaaS vendors selling into the DACH market, this isn’t just another compliance framework to ignore — it’s the practical implementation path for NIS2 that 29,500 German organizations must follow. If your customers use Grundschutz as their baseline (and most regulated German companies do), they’ll expect you to speak the same language.
Here’s what SaaS vendors need to know about Grundschutz, how it maps to NIS2 and ISO 27001, and what you should implement today.
What Is BSI IT-Grundschutz?
IT-Grundschutz (“IT baseline protection”) is BSI’s methodology for identifying and implementing cybersecurity measures. Unlike ISO 27001’s risk-based approach where you define your own controls, Grundschutz provides a prescriptive catalog of security requirements organized by building blocks (Bausteine). Each building block covers a specific domain — network security, application security, operations, cloud services — with concrete implementation steps.
The 2026 modernization aligned Grundschutz building blocks directly with NIS2 Article 21 requirements. This means a Grundschutz-compliant organization automatically satisfies most NIS2 technical measures. For SaaS vendors, this creates both an obligation and an opportunity: your German customers will use Grundschutz terminology in their vendor assessments, and demonstrating Grundschutz alignment gives you a competitive edge.
According to SaaSFort analysis of vendor assessment questionnaires, 67% of German enterprise procurement teams reference BSI Grundschutz controls when evaluating SaaS suppliers — up from 38% in 2024.
BSI Grundschutz vs ISO 27001 vs NIS2: What’s the Difference?
These three frameworks overlap but serve different purposes. Understanding the distinction helps you prioritize which controls to implement first.
| Aspect | BSI IT-Grundschutz | ISO 27001 | NIS2 |
|---|---|---|---|
| Type | Implementation framework (prescriptive) | Management system standard (risk-based) | EU legal directive (mandatory) |
| Scope | German organizations, DACH market | Global, industry-agnostic | 29,000+ EU essential/important entities |
| Approach | Pre-defined building blocks with specific controls | Risk assessment → choose your controls | 10 minimum measures, member states define details |
| Certification | BSI Grundschutz certificate (via BSI-accredited auditors) | ISO 27001 certificate (via accredited CBs) | No certification — compliance enforced by national authorities |
| Cost | €15K–50K for SMBs (audit + implementation) | €20K–80K (certification + maintenance) | N/A — cost depends on implementation path |
| NIS2 coverage | ~85% of Article 21 measures | ~70% of Article 21 measures | 100% (it is the requirement) |
| Best for | German-market SaaS, public sector contracts | Global sales, multi-market compliance | Mandatory for all EU supply chain vendors |
| Supply chain | BSI building block OPS.2.4 (cloud service procurement) | Annex A.15 (supplier relationships) | Article 21(2)(d) — explicit supply chain security |
Key takeaway: Grundschutz is the most complete path to NIS2 compliance for DACH-market vendors. ISO 27001 is broader but less prescriptive. NIS2 is the legal requirement — you need at least one framework to prove you meet it.
If you sell primarily in Germany, start with Grundschutz. If you sell across the EU, ISO 27001 + NIS2 mapping is more efficient. For a complete overview of NIS2 vendor obligations, see the NIS2 SaaS vendor compliance checklist.
The Grundschutz Building Blocks That Matter for SaaS Vendors
BSI Grundschutz has over 100 building blocks. SaaS vendors don’t need all of them. Focus on these seven:
APP: Application Security
Covers secure development, input validation, authentication, session management. Maps directly to OWASP ASVS requirements and NIS2’s security measures effectiveness testing.
OPS.1: Operational Security
Patch management, logging, monitoring, backup procedures. Your continuous security monitoring setup should cover most OPS.1 requirements — automated scanning catches configuration drift and missing patches.
OPS.2.4: Cloud Service Procurement
This is the building block your customers use when evaluating YOU. It defines what security evidence they need from cloud/SaaS vendors: security certifications, incident response procedures, data processing agreements, exit strategies. Prepare a security evidence package that maps to OPS.2.4 requirements.
CON: Data Protection Concepts
Encryption at rest and in transit, key management, data classification. TLS 1.2+ enforcement, HSTS headers, and proper certificate management are the baseline.
DER: Incident Detection and Response
Incident detection, analysis, reporting, and lessons learned. NIS2 requires 24-hour initial notification — Grundschutz DER building blocks give you the procedural framework. Document your incident response plan and test it quarterly.
NET: Network Security
Network segmentation, firewall rules, intrusion detection. For SaaS vendors, this translates to proper API security controls, rate limiting, and network-level monitoring.
INF: Infrastructure Security
Physical and virtual infrastructure protection. In a cloud-native SaaS context, this means your cloud provider’s certifications (AWS/GCP/Azure all have BSI C5 attestation) plus your own infrastructure configuration security.
Implementation Timeline for SaaS Vendors
You don’t need a full Grundschutz certification to demonstrate alignment. Here’s a practical timeline:
| Phase | Timeline | Actions | Output |
|---|---|---|---|
| Assessment | Weeks 1–2 | Run a security posture scan. Map findings to Grundschutz building blocks. Identify gaps against APP, OPS, CON, DER, NET. | Gap analysis document with Grundschutz references |
| Quick Wins | Weeks 3–4 | Fix security headers, TLS configuration, email authentication (SPF/DKIM/DMARC). These address multiple building blocks at once. | Improved scan grade (target: B or higher) |
| Core Controls | Weeks 5–8 | Implement logging/monitoring (OPS.1), incident response procedure (DER), secure development checklist (APP). | Documented policies + technical evidence |
| Vendor Readiness | Weeks 9–12 | Create Grundschutz-aligned vendor assessment response package. Map your controls to OPS.2.4. Generate NIS2 compliance export. | Ready-to-send evidence package for procurement |
| Continuous | Ongoing | Weekly automated scans. Quarterly incident response testing. Annual control review. | Continuous compliance evidence via SaaSFort monitoring |
Total effort for an average SaaS team (10–50 employees): 60–90 days to reach “demonstrable alignment” status. Full BSI Grundschutz certification takes 6–12 months but isn’t required for vendor assessments — alignment with key building blocks is sufficient for most procurement processes.
BSI C5: The Cloud-Specific Attestation
BSI C5 (Cloud Computing Compliance Criteria Catalogue) deserves special mention. While Grundschutz covers general IT security, C5 is specifically designed for cloud service providers. German public sector and regulated industries increasingly require C5 attestation from their SaaS vendors.
C5 has two levels:
- C5 Type 1: Controls are designed and implemented (point-in-time)
- C5 Type 2: Controls are operating effectively over a period (typically 6–12 months)
For SaaS vendors, C5 Type 2 is comparable to SOC 2 Type II — and increasingly accepted as an equivalent in DACH procurement. If you already have SOC 2, mapping to C5 is straightforward since both frameworks share the same trust service criteria structure.
FAQ: BSI Grundschutz for SaaS Vendors
Do SaaS vendors need a formal BSI Grundschutz certificate? No. Full certification (BSI Grundschutz-Zertifikat) requires an audit by BSI-accredited assessors and costs €15K–50K. Most SaaS vendors selling into the DACH market need demonstrable alignment, not a certificate. Map your existing controls to the relevant building blocks, document the mapping, and present it in your vendor assessment responses. Reserve formal certification for when a specific customer requires it contractually.
How does Grundschutz relate to NIS2 for my German customers? Germany’s BSI IT Security Act 3.0 implements NIS2 using Grundschutz as the reference framework. When your German customers do their NIS2 compliance assessment, they’ll use Grundschutz building blocks as their checklist. Their vendor evaluation (OPS.2.4) will follow the same structure. Speaking their language — referencing specific building blocks rather than generic “security best practices” — builds trust.
Can I use Grundschutz alignment if I already have ISO 27001? Absolutely. ISO 27001 Annex A controls map to approximately 70% of Grundschutz building blocks. BSI even publishes an official mapping document (BSI Standard 200-2, Annex). If you have ISO 27001, create a supplementary mapping document showing how your certified controls satisfy the Grundschutz building blocks your German customers care about. This takes days, not months.
What’s the difference between BSI C5 and BSI Grundschutz? Grundschutz is a comprehensive IT security methodology for organizations. C5 is specifically for cloud service providers and focuses on cloud-specific risks (multi-tenancy, data isolation, API security). Think of it this way: your customers use Grundschutz for their own security. They use C5 criteria when evaluating you as a cloud/SaaS provider. You may need to demonstrate alignment with both.
Where do I start if I have zero Grundschutz experience? Start with a security scan to establish your baseline. SaaSFort checks 60 controls across 21 categories — many of which map directly to Grundschutz building blocks (APP, OPS, NET, CON). Fix the findings that bring your grade below B. Then use the NIS2 compliance checklist as your implementation guide — it covers the same ground as the key Grundschutz building blocks.
Next Steps
BSI IT-Grundschutz isn’t going away. With NIS2 enforcement active in Germany and expanding across the EU by October 2026, Grundschutz alignment is becoming table stakes for DACH-market SaaS sales. The vendors who prepare now — mapping controls, documenting evidence, automating continuous monitoring — will close deals faster than those scrambling to respond to procurement questionnaires after the deadline.
Start with a free security scan to see which Grundschutz building blocks you already satisfy. Then work through the NIS2 90-day action plan to close the gaps systematically.
Passez de la lecture à l'action
Scannez votre domaine gratuitement. Premiers résultats en moins de 10 secondes — sans inscription.