IT security concept: Structure, content and obligations according to NIS-2, ISO 27001 and BSI-Grundschutz

An IT security concept is the written documentation of the technical and organisational measures with which a company ensures its information security and demonstrates this to regulators, auditors and customers. It is a mandatory document according to Art. 32 GDPR for all processing of personal data, an integral part of an ISMS according to ISO/IEC 27001:2022 with its 93 controls and a prerequisite for any certification according to BSI IT-Grundschutz. With the NIS2UmsuCG and the KRITIS umbrella law, the requirements continue to increase for around 29,500 companies in Germany that are regulated as essential or important institutions according to NIS-2 and must provide written evidence of their risk management measures.

In practice, many security concepts fail because they are written as a static PDF, which collects dust in a file after creation and is recognizable as not being used during the first audit. However, the regulatory expectations require a living, regularly checked and comprehensibly maintained set of documents with clearly assigned responsibilities. This article describes the structure of an audit-proof IT security concept, the mandatory chapters, the integration with the information security officer, the 24/72 reporting path according to NIS-2 as well as the form of delivery through CIVAC as a compliance platform and officer-as-a-service with an SLA of two working days instead of the classic six weeks of external consulting.

The obligation to provide written documentation of information security results from several standards that often operate in parallel in medium-sized companies and, in total, result in a demanding documentation standard. Art. 32 GDPR requires appropriate technical and organisational measures to ensure the security of the processing of personal data and makes written documentation the controller's obligation to provide evidence to the supervisory authority. § 8a BSIG obliges KRITIS operators to take appropriate organisational and technical precautions, which must be submitted to the Federal Office for Information Security every two years with independent audit evidence.

With the NIS2UmsuCG, which transposes EU Directive 2022/2555 into German law, the circle of addressees is dramatically expanded. Around 29,500 companies in Germany fall under NIS-2 as essential or important institutions and must provide evidence of written risk management measures in accordance with Section 30 BSIG, with personal liability for management in accordance with Section 38 BSIG. There are also industry-specific obligations: TKG for telecommunications providers, the DORA Regulation (EU) 2022/2554 for the financial sector, BaFin's MaRisk and BAIT, the KRITIS umbrella law, the Trade Secrets Act for the obligation to protect sensitive business data and the EU AI Act for high-risk AI systems.

An IT security concept fulfils these obligations at the same time if it is structured according to recognised standards and the Represents multiple obligations in one documentation layer. ISO/IEC 27001:2022 and BSI IT-Grundschutz both offer a complete methodology with the necessary level of maturity. The choice depends on the business model, internationality, the requirements of large customers and how CRITIS is affected. CIVAC supplies the information security officer with an appointment certificate, workspace and an underlying ISO/IEC 27001:2022 ISMS with 93 controls. Others run compliance like a filing cabinet. We run it like software.

A complete IT security concept is divided into ten chapters, which can be found regardless of the standard chosen and which every auditing body expects in this or a comparable order. Chapter one defines the scope: which locations, business processes, systems, data types, subsidiaries and cloud services fall under the concept. A definition that is too narrow invites questions from examiners; a definition that is too broad creates a disproportionate documentation requirement and maintenance effort. Chapter two describes the security organisation: roles, responsibilities, reporting lines to management, representation regulations and, in particular, the position of the information security officer as an independent function.

Chapter three documents the determination of the protection needs for each business process and each information category according to the three protection goals of confidentiality, integrity and availability, supplemented by authenticity, liability and non-repudiation where industry-specific. Chapter four deals with risk analysis with documented methodology, assessment criteria and prioritised measures for risk treatment. Chapter five lists the technical and organisational measures according to Art. 32 GDPR as well as the controls according to Annex A of ISO/IEC 27001:2022, mapped to the identified protection needs and the identified risks.

Chapters six to eight cover incident management with the NIS 2 reporting path, emergency preparedness including business continuity management and supplier security with contract requirements and audit rights. Chapter nine describes the training and awareness program with mandatory modules per functional group and a documented repetition logic. Chapter ten defines the review process: internal audit at least annually, management review at least semi-annually, adjustment after each significant incident and after each significant business change. Audit-proof, documented, § 8a BSIG-proof. For each of the ten chapters, CIVAC provides a template from the 490 ready-to-use audit templates, supplemented by the role-specific responsibility in the workspace and the link to the training and incident documentation. The templates are calibrated for both ISO/IEC 27001:2022 and BSI IT-Grundschutz.

Assessing protection needs is the analytical heart of every IT security concept and the point at which bad concepts most often fail. For each information category and system, it assesses how much damage would occur if confidentiality, integrity or availability were lost and which business processes would be affected. A three-level scale is common: normal, high, very high, with documented criteria for each level in the form of damage levels, regulatory consequences, reputational consequences and operational impacts. BSI-Grundschutz works with specific amounts of damage in euros, ISO/IEC 27001:2022 allows more freedom of method, but requires a consistent, comprehensible assessment across all values.

The risk analysis is based on the determination of protection needs and translates this into a manageable prioritization. It identifies specific threats for each protection objective, estimates their probability of occurrence based on empirical values ​​and the external threat situation and combines both to form a risk assessment. Recognized methodologies include ISO/IEC 27005:2022, BSI standards 200-3 and 200-4, NIST-SP 800-30 methodology, and OWASP application risk methodology. The choice of methodology must be documented in the concept and implemented consistently across all business processes.

A common mistake in medium-sized companies is the mixing of threats and risks or the lack of documentation of the assessment standard in a statement of applicability. Both are vulnerable in the audit and lead to additional effort in follow-up documentation. The CIVAC workspace structures the assessment of protection needs as a data object for each system with documented justifications for each protection level and connects the risk analysis directly with the catalogue of measures. Every adjustment is versioned with a time stamp and is traceable for the auditor. The auditor calls, the evidence is ready. The ISO 27001:2022 transition brings additional methodology requirements that the concept must reflect.

The catalogue of measures is the most extensive chapter of the concept and at the same time the most common weak point in the audit because it requires both technical depth and organisational discipline. Art. 32 GDPR lists four protection objectives that must be taken into account in every assessment: pseudonymization and encryption of personal data, confidentiality, integrity, availability and resilience of the systems and a procedure for regular review of effectiveness. ISO/IEC 27001:2022 supplemented with the 93 controls from Annex A, divided into four subject areas: organisational, personnel, physical and technical measures, each with clear objectives. The BSI IT-Grundschutz is structured in building blocks with almost 100 requirement blocks depending on the profile, from basic to standard to core.

The measures must be appropriate to the identified protection needs and must not be over- or under-dimensioned. A mere standard list is not enough; The selection must be justified with a statement of applicability, controls not applied must be explicitly declared as exceptions and gaps must be identified in writing by management as accepted residual risks. Mandatory topics in medium-sized businesses in 2026 include multi-factor authentication for all privileged accounts and remote access, a documented patch management policy with escalation rules based on CVSS severity, segmented networks with zero trust principles, a backup concept with a 3-2-1 rule and regularly tested recovery points, a cryptography concept with traceable key management and a Endpoint detection and response solution on all endpoints.

Supply chain and third-party risks will have to be documented much more strictly than in the past due to the entry into force of NIS-2 and the EBA-DORA standards in 2026. Each critical supplier must be managed with contractual safeguards, security requirements, documented incident reporting obligations and audit rights. CIVAC bundles the catalogue of measures as a data object for each control objective and connects it with the training, supplier and incident documentation. The appointment certificate, signed, filed, verifiable.

The incident management chapter describes how the company detects, classifies, contains, resolves, documents and reports security-related events to authorities. Section 32 BSIG obliges essential and important facilities according to NIS-2 to provide an early warning within 24 hours of becoming aware of a significant security incident and to report an incident within 72 hours, supplemented by a final report within one month of completion of the management. Deadline begins as soon as we become aware of it. The report is made to the BSI via the NIS 2 reporting platform, in parallel to the Federal Network Agency for telecommunications services or to BaFin for financial service providers.

The reporting concept must define in writing what is considered a significant incident, who carries out the classification based on the NIS 2 thresholds, who authorizes the report, who technically issues it and who then communicates with affected customers and business partners. In the case of data breaches with a personal connection, the 72-hour deadline applies to the data protection supervisory authority in accordance with Article 33 of the GDPR, and in the case of particularly serious incidents, the obligation to notify those affected in accordance with Article 34 of the GDPR applies. For financial service providers, the DORA reporting requirement is added. Multi-pronged reporting obligations are the rule, not the exception, and must be operated in a synchronized manner.

The fines are significant: up to 10 million euros or 2 percent of global group sales for essential facilities, up to 7 million euros or 1.4 percent for important facilities. CIVAC operationalizes the 24/72 reporting path in the workspace as a triggered workflow: Incident recorded, severity assessed, early warning created, management approves, report sent to BSI, final report planned. The templates are available for each supervisory authority and stored in the respective language, so that valuable hours are not lost on format questions during early warning or full reporting. Each step in the workflow is time-stamped, role-accountable, and reproducible for review. The auditor calls, the evidence is ready.

The information security officer is the operational link around the IT security concept and the addressee of first choice for any supervision. Section 30 Paragraph 2 No. 6 BSIG expects a named person with an independent reporting line to management and sufficient resources to fulfil the task. ISO/IEC 27001:2022 requires the formal assignment of roles and responsibilities within the ISMS under clause 5.3. The BSI IT-Grundschutz describes the role in detail in the ISMS.1 layer with tasks, qualification requirements and position requirements for the management.

The order is made in writing by the management. The appointment document describes the scope of tasks, reporting line, representation in the event of absence, resources, duration of the appointment and the obligation to report regularly to management level. In the audit, an incorrect order leads to the concept being deemed not to have been managed responsibly and the risk of fines increasing because the personal liability of the management in accordance with Section 38 BSIG is not relieved by proper delegation. According to BSI specifications, double staffing with IT management or data protection officer is only permitted with documented conflict resolution.

Medium-sized companies regularly lack the internal capacity to fill the role qualified and independently. Officer-as-a-Service solves this problem: CIVAC appoints an external information security officer with an appointment certificate, reporting line and workspace within the SLA of two working days. The external ISB carries out the annual risk analysis, oversees ongoing TOM maintenance, coordinates incident management in the 24/72 reporting path, organises the training program and delivers quarterly reports to management. Licence the workspace for your internal representatives, or have our representatives order it. Both paths feed the same audit export and provide the same quality of evidence to ISO certifiers, BSI auditors or an NIS 2 supervisory authority. Switching between models is possible within the contract term without losing evidence.

The choice of standard is a strategic decision with long-term consequences for audit costs, customer requirements and internal processes. ISO/IEC 27001:2022 is internationally recognised, accredited and certifiable and the de facto standard in supplier onboarding for large corporations, especially in the automotive, pharmaceutical, financial and manufacturing industries. The 93 controls from Annex A cover the majority of the NIS 2 requirements, so that the certification fulfils essential parts of the NIS 2 obligations at the same time. The transition from the 2013 to the 2022 version had to be completed by October 2026; affected companies completed recertifications during this time and adjusted their Statement of Applicability.

The BSI IT-Grundschutz is the German de facto standard in the public sector, in KRITIS sectors and in tenders with federal participation. It is more detailed than ISO/IEC 27001:2022 and includes prepared building blocks for each system and business process, which significantly speeds up the creation of the concept in the initial phase. Certification is carried out by auditors licensed by the BSI. A combination of both approaches is possible and is increasingly required in regulated industries: the ISMS follows ISO/IEC 27001:2022 with its management logic, the operational implementation uses the BSI modules with their technical depth.

For medium-sized companies outside of KRITIS, ISO/IEC 27001:2022 is the right choice in most cases. It allows for a more streamlined initial certification and offers the international recognition that larger customers demand in audits. Anyone who takes part in federal tenders or fulfils specific KRITIS obligations is supplemented by BSI IT-Grundschutz. CIVAC maps both standards in parallel in the workspace and provides the ISMS with 93 controls as a certified platform. Others run compliance like a filing cabinet. We run it like software.

Statistically, between 70 and 90 percent of all companies that have been successfully attacked have been compromised through a human factor, usually through phishing, social engineering, accidental configuration errors or the improper use of cloud services. An IT security concept without a viable training and awareness program therefore remains paper and fails in the first audit. The training chapter must define mandatory modules for each functional group, set clear repetition cycles, store proof of participation for each employee and measure effectiveness via phishing simulations or knowledge tests.

Mandatory topics in medium-sized companies in 2026 are phishing detection in a form that is realistic for the industry, password and MFA hygiene, the handling of personal data in accordance with the GDPR, the reporting channels if a security incident is suspected, and secure use of cloud services and AI tools as well as the handling of mobile devices and private devices in the bring-your-own-device model. Special groups such as development teams also need secure coding training with a connection to OWASP, the sales team needs training on sanctions and export controls, the human resources department needs training on data protection and HinSchG, and management needs training on personal liability and cyber crisis management.

Awareness is the continuous reinforcement between the mandatory training courses and decides whether the training knowledge is effective in everyday life. Realistic phishing simulations with comprehensible evaluations, monthly mini-briefings, visible posters in break rooms and clearly visible success reports after averted incidents contribute more to the security culture than annual Powerpoint obligations. The CIVAC workspace provides ready-made training paths for each representative role, simulates phishing campaigns, documents proof of participation as a data object for each employee and exports the complete training status per person for the auditor, the supervisory authority or the major customer in the vendor audit at the push of a button. The repetition logic automatically triggers training reminders before the expiration date, so that the training status is never considered out of date in the audit. Audit-proof, documented, § 32 GDPR-proof.

CIVAC is a German compliance platform and officer-as-a-service with 25 live officer roles, 93 controls according to ISO/IEC 27001:2022, 490 ready-to-use audit templates and EU data residency for all stored data. The information security officer is operated via the workspace, including the appointment certificate, reporting line to management, protection needs assessment, risk analysis, catalogue of measures, training program, incident management and 24/72 reporting path according to NIS-2. The SLA for standard inquiries is two working days instead of the classic two to six weeks of external consulting services.

The IT security concept is not managed in the CIVAC workspace as a static PDF, but as a living set of connected data objects: scope, security organisation, protection needs assessment, risk analysis, catalogue of measures, supplier files, incidents, training and reviews form a networked model. Every change is versioned with a time stamp, every responsibility is assigned to a person, every audit export delivers exactly the format that ISO certifiers, BSI auditors or the responsible supervisory authorities expect. Group structures are mapped via a single ISMS with company-specific evidence, which eliminates duplicate work.

Licence the workspace for your internal representatives, or have our representatives order it. Both paths provide the same quality of evidence because the data lives in the same system and feeds the same audit export. The choice depends on the existing internal capacity, the regulatory profile, the desired risk distribution and the speed with which the concept must be ready for certification in the market. If there is an acute need, for example before a customer audit, an NIS 2 inspection or an M&A due diligence, ordering externally is the faster way.

Turn reading into a mandate. Companies with specific needs can reach the CIVAC delivery team at info@civac.de or via the contact form on civac.de. The initial discussion clarifies the NIS 2 scope of application, the maturity level of existing documentation, the standard choice between ISO/IEC 27001:2022 and BSI IT-Grundschutz, the training landscape and the migration path to the workspace. An indicative cost estimate will be available within one working day, and the appointment certificate from the ISB within 48 hours of conclusion of the contract.