How does BSI Grundschutz map to ISO 27001 controls?
A single ISO 27001 control typically corresponds to multiple, more concrete BSI Bausteine — Grundschutz is roughly an order of magnitude more granular than ISO 27001 Annex A.
* Many-to-one: a fistful of detailed BSI Bausteine together satisfy one abstract ISO 27001 control. *
The two standards aren't rivals so much as the same idea at different resolutions, which is the whole reason a mapping is even possible. ISO 27001's Annex A states a control abstractly ("information backed up shall be...") and leaves the how to you — flexible, but vague. BSI Grundschutz takes that same control and explodes it into a building block full of concrete, numbered requirements an engineer can implement line by line. So the typical mapping is many-to-one: a fistful of detailed BSI Bausteine together satisfy one abstract ISO control. Concretely:
- Zutrittskontrolle (physical entry): ISO 27001 Annex A has essentially one control (A.11.1.2 + A.11.1.3, entry control + secure delivery zones). BSI expands this into the whole INF.1 building block with many Massnahmen.
- Backup: ISO 27001 has one requirement (A.12.3 Backup). BSI CON.3 Datensicherungskonzept breaks it into 12 separate Anforderungen in a single Baustein.
That difference in resolution is exactly why the two co-exist well in practice: organisations document the abstract ISO control as the "what" (good for the certificate and for flexibility) and the matching BSI Baustein as the "how" (good for the engineers who must actually build it). When wiring this into a GRC tool, don't try to map Bausteine 1:1 — group them as "this set of Bausteine implements ISO control A.X.Y."
Tip: When mapping between frameworks for a GRC tool, BSI Bausteine are usually too fine-grained to map 1:1 to ISO. Instead group them as "this set of Bausteine implements ISO A.X.Y" — many-to-one mapping.
Go deeper:
ISO/IEC 27001 (Wikipedia) — the abstract Annex A controls the concrete BSI Bausteine map onto.- BSI IT-Grundschutz (official overview, EN) — the granular Baustein/Massnahme structure being mapped.