How did the IT-Grundschutz procedure change from BSI 100-2 (old) to BSI 200-2 (new)?

Question

Accepted Answer

The old approach prescribed fixed MEASURES per building block; the new one defines REQUIREMENTS and lets you choose the measures — moving Grundschutz closer to ISO 27001.

* From BSI 100-2 (prescribed Maßnahmen) to BSI 200-2 (Modellierung + requirement-based GS-Check). *
Old procedure (BSI 100-2):
Structure analysis → protection needs assessment → selection and adaptation of measures → basic security check → implementation of missing measures.
The building blocks contained predefined measures — what to do was largely dictated.
New procedure (BSI 200-2):
Structure analysis → protection needs assessment → Modellierung (modeling) → GS-Check (which requirements are fulfilled, and how?) → target/actual comparison and measure planning.
The key shift: blocks now state requirements ("what must be achieved"), and the organization freely chooses suitable measures ("how to achieve it"). Implemented measures are identified and evaluated against the requirements.
This requirement orientation is exactly how ISO 27001 works — hence the slide's conclusion: convergence of the Grundschutz and ISO 27001 methodologies.
Go deeper:

BSI-Standard 200-2: IT-Grundschutz-Methodik — Die modernisierte, anforderungsorientierte Vorgehensweise (Nachfolger von 100-2).