← Frameworks / BSI IT-Grundschutz / Control Mappings

Machine-readable: JSON API guide

BSI IT-Grundschutz Compendium

Comprehensive German cybersecurity methodology from the Federal Office for Information Security (BSI). Covers 111 modules across process, system, network, application, infrastructure, operations, and detection/response layers. Widely adopted across German government, critical infrastructure, and enterprise.

Controls: 172
Total Mappings: 252
Publisher: Bundesamt fur Sicherheit in der Informationstechnik (BSI) Version: 2023
BSI IT-Grundschutz → SP 800-53 SP 800-53 → BSI IT-Grundschutz Coverage Analysis
AC (25) AT (5) AU (12) CA (3) CM (8) CP (13) IA (12) IR (6) MA (2) MP (2) PE (21) PL (6) PM (10) PS (9) PT (8) SA (4) SC (14) SI (12)

AC Access Control

Control Name BSI IT-Grundschutz References
AC-01 Policy and Procedures
ORP.4
AC-02 Account Management
OPS.1.1.2ORP.4
AC-03 Access Enforcement
ORP.4SYS.1.1SYS.2.1
AC-04 Information Flow Enforcement
NET.1.1ORP.4
AC-05 Separation of Duties
OPS.1.1.2ORP.1ORP.4
AC-06 Least Privilege
OPS.1.1.2ORP.4
AC-07 Unsuccessful Logon Attempts
ORP.4
AC-08 System Use Notification
ORP.4
AC-09 Previous Logon Notification
ORP.4
AC-10 Concurrent Session Control
ORP.4
AC-11 Device Lock
ORP.4
AC-12 Session Termination
ORP.4
AC-13 Supervision and Review — Access Control
ORP.4
AC-14 Permitted Actions Without Identification or Authentication
ORP.4
AC-15 Automated Marking
ORP.4
AC-16 Security and Privacy Attributes
ORP.4
AC-17 Remote Access
CON.7OPS.1.2.4ORP.4
AC-18 Wireless Access
ORP.4
AC-19 Access Control for Mobile Devices
CON.7ORP.4
AC-20 Use of External Systems
ORP.4
AC-21 Information Sharing
ORP.4
AC-22 Publicly Accessible Content
ORP.4
AC-23 Data Mining Protection
ORP.4
AC-24 Access Control Decisions
ORP.4
AC-25 Reference Monitor
ORP.4

AT Awareness and Training

Control Name BSI IT-Grundschutz References
AT-01 Policy and Procedures
ORP.2ORP.3
AT-02 Literacy Training and Awareness
ORP.2ORP.3
AT-03 Role-based Training
ORP.2ORP.3
AT-04 Training Records
ORP.2ORP.3
AT-06 Training Feedback
ORP.3

AU Audit and Accountability

Control Name BSI IT-Grundschutz References
AU-01 Policy and Procedures
OPS.1.1.5
AU-02 Event Logging
OPS.1.1.5
AU-03 Content of Audit Records
OPS.1.1.5
AU-04 Audit Log Storage Capacity
OPS.1.1.5
AU-05 Response to Audit Logging Process Failures
OPS.1.1.5
AU-06 Audit Record Review, Analysis, and Reporting
DER.1OPS.1.1.5
AU-07 Audit Record Reduction and Report Generation
OPS.1.1.5
AU-08 Time Stamps
OPS.1.1.5
AU-09 Protection of Audit Information
OPS.1.1.5
AU-10 Non-repudiation
OPS.1.1.5
AU-11 Audit Record Retention
OPS.1.1.5
AU-12 Audit Record Generation
OPS.1.1.5

CA Security Assessment and Authorization

Control Name BSI IT-Grundschutz References
CA-02 Control Assessments
ORP.5
CA-07 Continuous Monitoring
DER.1
CA-09 Internal System Connections
ORP.5

CM Configuration Management

Control Name BSI IT-Grundschutz References
CM-02 Baseline Configuration
NET.1.2NET.3.1SYS.1.1SYS.2.1
CM-03 Configuration Change Control
OPS.1.1.2OPS.1.1.3
CM-04 Impact Analyses
OPS.1.1.3OPS.1.1.6
CM-05 Access Restrictions for Change
OPS.1.1.2
CM-06 Configuration Settings
APP.1.1NET.1.2NET.3.1SYS.1.1SYS.2.1
CM-07 Least Functionality
APP.1.1NET.1.2NET.3.1SYS.1.1SYS.2.1
CM-12 Information Location
NET.1.2
CM-14 Signed Components
NET.3.1OPS.1.1.3SYS.1.1

CP Contingency Planning

Control Name BSI IT-Grundschutz References
CP-01 Policy and Procedures
DER.4
CP-02 Contingency Plan
DER.4
CP-03 Contingency Training
DER.4
CP-04 Contingency Plan Testing
DER.4
CP-05 Contingency Plan Update
DER.4
CP-06 Alternate Storage Site
CON.3DER.4
CP-07 Alternate Processing Site
DER.4
CP-08 Telecommunications Services
DER.4
CP-09 System Backup
CON.3DER.4
CP-10 System Recovery and Reconstitution
DER.4
CP-11 Alternate Communications Protocols
DER.4
CP-12 Safe Mode
DER.4
CP-13 Alternative Security Mechanisms
DER.4

IA Identification and Authentication

Control Name BSI IT-Grundschutz References
IA-01 Policy and Procedures
ORP.4
IA-02 Identification and Authentication (Organizational Users)
ORP.4
IA-03 Device Identification and Authentication
ORP.4
IA-04 Identifier Management
ORP.4
IA-05 Authenticator Management
ORP.4
IA-06 Authentication Feedback
ORP.4
IA-07 Cryptographic Module Authentication
ORP.4
IA-08 Identification and Authentication (Non-organizational Users)
ORP.4
IA-09 Service Identification and Authentication
ORP.4
IA-10 Adaptive Authentication
ORP.4
IA-11 Re-authentication
ORP.4
IA-12 Identity Proofing
ORP.4

IR Incident Response

Control Name BSI IT-Grundschutz References
IR-01 Policy and Procedures
DER.2.1
IR-04 Incident Handling
DER.2.1
IR-05 Incident Monitoring
DER.1DER.2.1
IR-06 Incident Reporting
DER.2.1
IR-08 Incident Response Plan
DER.2.1
IR-09 Information Spillage Response
DER.2.1

MA Maintenance

Control Name BSI IT-Grundschutz References
MA-04 Nonlocal Maintenance
OPS.1.2.5
MA-07 Field Maintenance
OPS.1.2.5

MP Media Protection

Control Name BSI IT-Grundschutz References
MP-06 Media Sanitization
CON.6
MP-08 Media Downgrading
CON.6

PE Physical and Environmental Protection

Control Name BSI IT-Grundschutz References
PE-01 Policy and Procedures
INF.1INF.2
PE-02 Physical Access Authorizations
INF.1INF.2
PE-03 Physical Access Control
INF.1INF.2
PE-04 Access Control for Transmission
INF.1INF.2
PE-05 Access Control for Output Devices
INF.1INF.2
PE-06 Monitoring Physical Access
INF.1INF.2
PE-07 Visitor Control
INF.1INF.2
PE-08 Visitor Access Records
INF.1INF.2
PE-09 Power Equipment and Cabling
INF.1INF.2
PE-10 Emergency Shutoff
INF.1INF.2
PE-11 Emergency Power
INF.1INF.2
PE-12 Emergency Lighting
INF.1INF.2
PE-13 Fire Protection
INF.1INF.2
PE-14 Environmental Controls
INF.1INF.2
PE-15 Water Damage Protection
INF.1INF.2
PE-16 Delivery and Removal
INF.1INF.2
PE-17 Alternate Work Site
CON.7INF.1INF.2OPS.1.2.4
PE-18 Location of System Components
INF.1INF.2
PE-21 Electromagnetic Pulse Protection
INF.1INF.2
PE-22 Component Marking
INF.1INF.2
PE-23 Facility Location
INF.1INF.2

PL Planning

Control Name BSI IT-Grundschutz References
PL-01 Policy and Procedures
ORP.1
PL-04 Rules of Behavior
ORP.5
PL-08 Security and Privacy Architectures
NET.1.1
PL-09 Central Management
ISMS.1ORP.1
PL-10 Baseline Selection
ISMS.1
PL-11 Baseline Tailoring
ISMS.1

PM Program Management

Control Name BSI IT-Grundschutz References
PM-01 Information Security Program Plan
ISMS.1ORP.1ORP.5
PM-02 Information Security Program Leadership Role
ISMS.1ORP.1
PM-03 Information Security and Privacy Resources
ISMS.1
PM-06 Measures of Performance
ISMS.1
PM-09 Risk Management Strategy
ISMS.1
PM-13 Security and Privacy Workforce
ORP.2ORP.3
PM-14 Testing, Training, and Monitoring
ORP.3
PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research
CON.2
PM-26 Complaint Management
CON.2
PM-27 Privacy Reporting
CON.2

PS Personnel Security

Control Name BSI IT-Grundschutz References
PS-01 Policy and Procedures
ORP.2
PS-02 Position Risk Designation
ORP.2
PS-03 Personnel Screening
ORP.2
PS-04 Personnel Termination
ORP.2
PS-05 Personnel Transfer
ORP.2
PS-06 Access Agreements
ORP.2
PS-07 External Personnel Security
ORP.2
PS-08 Personnel Sanctions
ORP.2
PS-09 Position Descriptions
OPS.1.1.2ORP.2

PT Personally Identifiable Information Processing and Transparency

Control Name BSI IT-Grundschutz References
PT-01 Policy and Procedures
CON.2
PT-02 Authority to Process Personally Identifiable Information
CON.2
PT-03 Personally Identifiable Information Processing Purposes
CON.2
PT-04 Consent
CON.2
PT-05 Privacy Notice
CON.2
PT-06 System of Records Notice
CON.2
PT-07 Specific Categories of Personally Identifiable Information
CON.2
PT-08 Computer Matching Requirements
CON.2

SA System and Services Acquisition

Control Name BSI IT-Grundschutz References
SA-04 Acquisition Process
ORP.5
SA-11 Developer Testing and Evaluation
APP.3.1OPS.1.1.6
SA-20 Customized Development of Critical Components
OPS.1.1.6
SA-23 Specialization
APP.3.1

SC System and Communications Protection

Control Name BSI IT-Grundschutz References
SC-07 Boundary Protection
APP.3.1NET.1.1NET.1.2NET.3.1
SC-08 Transmission Confidentiality and Integrity
APP.3.1CON.1
SC-12 Cryptographic Key Establishment and Management
CON.1
SC-13 Cryptographic Protection
CON.1
SC-18 Mobile Code
APP.1.1
SC-28 Protection of Information at Rest
CON.1CON.7OPS.1.2.4SYS.2.1
SC-32 System Partitioning
NET.1.1
SC-38 Operations Security
CON.1
SC-41 Port and I/O Device Access
NET.3.1
SC-42 Sensor Capability and Data
CON.7OPS.1.2.4SYS.2.1
SC-44 Detonation Chambers
APP.1.1OPS.1.1.4
SC-46 Cross Domain Policy Enforcement
NET.1.1
SC-47 Alternate Communications Paths
NET.1.1
SC-48 Sensor Relocation
DER.1

SI System and Information Integrity

Control Name BSI IT-Grundschutz References
SI-02 Flaw Remediation
OPS.1.1.3SYS.1.1SYS.2.1
SI-03 Malicious Code Protection
APP.1.1OPS.1.1.4
SI-04 System Monitoring
DER.1
SI-08 Spam Protection
OPS.1.1.4
SI-10 Information Input Validation
APP.3.1
SI-12 Information Management and Retention
CON.6
SI-13 Predictable Failure Prevention
DER.4
SI-16 Memory Protection
OPS.1.1.4SYS.1.1SYS.2.1
SI-18 Personally Identifiable Information Quality Operations
CON.2CON.6
SI-19 De-identification
CON.2
SI-20 Tainting
DER.1OPS.1.1.5
SI-21 Information Refresh
APP.3.1