Org.1 (TOP)
Named responsible person
There must be a named person responsible for IT security, even if that person is the owner or an external IT service provider. Anonymous ownership fails the very first BSI checkpoint.
DIN SPEC 27076 · BSI-Aligned · KMU
DIN SPEC 27076
Readiness Assessment
Germany's pragmatic cybersecurity baseline for small and medium enterprises. Purpose-built for fast, resource-efficient assessments — structured around the BSI Cyber Security Check. No CISO required to complete.
- 27 QuestionsAssessment
- ~15 minDuration
- SMB / KMUScope
Who it applies to
- German small and medium-sized enterprises (KMU) — typically under 50 staff, but applicable up to ~250
- Organisations preparing for a BSI CyberRisikoCheck delivered by a registered IT service provider
- Suppliers asked to demonstrate baseline cybersecurity hygiene to enterprise customers or insurers
Generally out of scope
- Large enterprises with mature ISMS — they should target ISO 27001 or NIS2 Article 21 directly.
Key articles & clauses, in plain English
The five points auditors and supervisors actually verify first.
IAM.3 (TOP)
Multi-factor authentication for remote access
MFA on email, cloud services, VPN, and any system reachable from outside the company network. The single highest-impact control for SMBs against credential-based attacks.
BAK.2 + BAK.3 (TOP)
Separated, tested backups
Backups must be stored offline or off-site, and an actual restoration test must have been completed within the last 12 months. A backup that has never been restored is an assumption, not a control.
PCM.1 (TOP)
30-day patch window
Security-relevant updates applied to servers, workstations, and network equipment within 30 days of release — the primary defence against ransomware entry.
NET.4 (TOP)
Hardened remote access
VPN, RDP, and cloud admin access protected with strong authentication and restricted to named users. Exposed RDP remains the leading entry vector for SMB ransomware in Germany.
What this assessment covers
6 topics · 27 self-assessment questions.
- Domain 01
Organisation & Awareness
The BSI CyberRisikoCheck opens with organisational measures — documented responsibilities, a written security policy, regular employee training, and contractual obligations for IT service providers. These five requirements establish whether security is managed or informal.
- Domain 02
Identity & Access Management
The IAM area covers password policies, multi-factor authentication, account lifecycle management, and privilege separation. Four of the five IAM requirements are designated BSI TOP requirements — meaning non-fulfilment signals a serious, priority risk.
- Domain 03
Data Backup
The backup area checks whether backups exist, are stored separately from primary systems, and have been tested through an actual restoration. Two of the three requirements are TOP requirements — because a backup that has never been tested is worthless in a ransomware incident.
- Domain 04
Patch & Change Management
This area examines how quickly security updates are applied, whether a software inventory exists, and whether infrastructure changes are documented. Unpatched systems are the most common attack entry point for SMBs — and the most preventable.
- Domain 05
Malware Protection
The malware protection area covers endpoint protection, email filtering, and policies for external storage devices. Endpoint protection is a TOP requirement — its absence is treated by BSI as a fundamental, unacceptable gap for any organisation.
- Domain 06
IT Systems & Network
The final BSI area covers firewall configuration, Wi-Fi security, network segmentation, remote access, mobile device management, and incident handling. Eight requirements — five of which are TOP — covering the technical infrastructure that either protects or exposes the business.
Why the CyberRisikoCheck matters — your proof of commitment
Developed by a consortium of nearly 20 partners under the lead of the BSI and the BVMW, the CyberRisikoCheck is more than a technical scan. A 1–2 hour interview covers 27 requirements across six themes and produces an objective report with a risk score and prioritised actions — a credible 'proof of commitment' you can show to every stakeholder.
To regulators (NIS2 & CRA)
Built on BSI standards and an officially recognised norm, the report documents that you actively identify and manage risk — a defensible baseline as NIS2 and the Cyber Resilience Act tighten obligations.
To cyber insurers
Insurance experts (a GDV subsidiary) helped shape the norm, so the standardised report lets insurers assess your risk objectively. A good score — or evidence you are closing gaps — can improve premiums or make cover possible at all.
To management & owners
Management carries overall responsibility for information security. The check evidences that this duty of care was met through a professional assessment, and gives a neutral, external justification for IT budget.
A gateway to funding
Many programmes (KfW ERP loans, regional digitalisation grants) require proof that an investment is necessary. The report acts as that 'proof of necessity' — showing which gaps exist and why the funding is needed.
Top audit pitfalls
- Treating the BSI check as a paper exercise — assessors verify operational reality, not just policy text.
- Backups that are connected to the production network during a ransomware attack and become encrypted along with everything else.
- MFA on the corporate email but not on the cloud admin console — leaving a soft side-door wide open.
Frequently asked questions
It is a structured self-check, not a formal certification. Delivered by a BSI-registered IT service provider, it produces a documented finding usable for insurance, customer due diligence, and as a roadmap.
Typically two half-day workshops on-site or remote — one to gather evidence, one to walk through the findings and the action plan. Smaller organisations finish in a single half-day.
No. This online assessment is a structured self-evaluation that mirrors the DIN SPEC 27076 question catalogue. The official BSI check must be delivered by a registered provider; this assessment helps you prepare.
TOP requirements are designated by the BSI as the highest-priority controls. Failing a TOP requirement signals a serious, immediate cybersecurity risk that should be addressed before any other improvement work.
Yes — several German federal states offer go-digital and similar funding programmes that subsidise 50–80% of the cost when delivered by an accredited consultant.
You receive a documented gap register prioritised by BSI risk weighting, an action plan, and (optionally) a follow-up workshop after remediation to verify closure.
Start your DIN SPEC 27076 assessment
27 questions · ~~15 min · Scorecard based on your answers. No sign-up to begin.