Assigns target objects to the modules of the IT-Grundschutz Compendium.
Developed in Germany · Hosted in the EU or on-premises
Delivered together with
Sovereign hosting in Germany, single-tenant from the first user.
Legal, tax and compliance expertise for legally sound deployment.
Advisory and implementation for the public sector, starting with the AI readiness assessment.
A specialist server goes into operation and is entered in the asset register. That is where the manual work begins: going through the layers, finding modules, choosing the profile, writing down the scope boundary with the service provider.
A single server costs four layers, fourteen profile decisions and three passes, and the 50% in the figure comes from the first pass, which the agent delivers as a draft.
The 50% is the figure stated for this agent and refers to the initial modelling of a target object. It is based on experience, not an audited measurement.
The agent reads the target object from the asset register and works through the IT-Grundschutz Compendium layer by layer. For each layer it proposes the appropriate modules and marks where none applies.
Modellierungstabelle_S-042.xlsx with 14 module assignmentsThe agent enters the protection requirement from the register and assigns the modules to the Basic or Standard profile. It highlights every deviation from the chosen profile individually, as well as every module for which it lacks the basis for an assignment.
11 assignments in the Standard profile, 2 in the Basic profile, 1 without a profileThe agent writes down which modules sit with the external service provider and which remain in-house. Each scope boundary is recorded in a note that refers to the contract.
Scope boundary note for file reference ISB/2026/117, 2 itemsThe classification as normal, high or very high remains with the information security officer. The agent takes it from the asset register and works with it.
The auditor checks that on the system itself and in talks with operations. The agent supplies the assignment and the reasons; the auditor issues the attestation.
The agent works through the register line by line. A specialist server missing from it gets no modules, and recording it remains the job of operations.
Connected systems
Operations
A pilot typically runs on your own data within 4 to 6 weeks. The agent connects to your existing systems rather than running as a separate, parallel environment.
EU cloud, private cloud or on-premises. Processing is GDPR-compliant and models are never trained on your data. Details in the Trust Center.
It is based on experience from comparable projects and process benchmarks, not a commitment. We work out the realistic effect for your organisation during the assessment before the pilot.