IT Baseline Protection (IT-Grundschutz) is not limited to on-premises environments. Its principles are universal, but implementation in the cloud requires a new way of thinking. This article is the cloud-specific companion to our guide on ISO 27001 based on IT Baseline Protection.
IT Baseline Protection Meets the Cloud
The Shared Responsibility Model is key. Who is responsible for what? This question must be answered clearly. For the public sector, cloud migration means reinterpreting IT Baseline Protection: the building blocks do not change, but the way the requirements are met does. Automation and cloud-native tools play a central role.
The Shared Responsibility Model in Detail
- Cloud Provider (e.g., Azure, AWS, GCP): Responsible for the security of the cloud. This includes the physical security of data centres, the security of the virtualisation layer, and the basic infrastructure.
- Customer (Authority): Responsible for security in the cloud. This includes service configuration, identity and access management, data protection, and operating system patching.
The BSI-compliant cloud security concept documents this demarcation — and it is exactly the demarcation that BSI C5 calls the corresponding user-side criteria.
Implementing Baseline Protection Building Blocks in the Cloud
OPS.1.1.5: Logging
- Azure: Azure Monitor, Log Analytics, Microsoft Sentinel
- GCP: Cloud Logging, Cloud Monitoring, Google Security Operations (Chronicle)
- Implementation: Enable logging for all services. Define retention periods. Automate analysis.
CON.1: Cryptography
- Azure: Azure Key Vault, Always Encrypted, Transparent Data Encryption
- GCP: Cloud Key Management Service, Confidential Computing
- Implementation: Enforce data-in-transit and data-at-rest encryption. Centralise key management — see BYOK vs. HYOK.
ORP.4: Identity and Access Management
- Azure: Entra ID, Conditional Access, Privileged Identity Management (PIM)
- GCP: Cloud Identity, Identity-Aware Proxy (IAP), IAM Conditions
- Implementation: Apply Zero Trust principles. Enforce MFA. Implement least privilege — see Conditional Access and MFA.
NET.1.1: Network Architecture
- Azure: Virtual Network, Network Security Groups, Azure Firewall
- GCP: Virtual Private Cloud (VPC), Firewall Rules, Cloud Armor
- Implementation: Use hub-and-spoke or VPC peering. Enforce network segmentation. Activate DDoS protection.
Quick Checklist: IT Baseline Protection in the Cloud
| Baseline Protection Building Block | Cloud Tool (Azure Example) | Implemented? |
| ORP.4 (IAM) | Entra ID, PIM | ☐ |
| CON.1 (Crypto) | Key Vault, TDE | ☐ |
| OPS.1.1.5 (Logging) | Log Analytics, Sentinel | ☐ |
| NET.1.1 (Network) | VNet, NSGs, Firewall | ☐ |
| SYS.1.1 (Server) | Azure Policy, Defender for Cloud | ☐ |
| CON.8 (Secure Development) | Azure DevOps / GitHub Advanced Security | ☐ |
To-Do List for Cloud Baseline Protection
- Week 1: Understand and document the Shared Responsibility Model.
- Week 2: Conduct a cloud-specific risk analysis.
- Month 1: Create a mapping of Baseline Protection building blocks to cloud services.
- Month 2: Build a landing zone with Baseline Protection configurations (Policy-as-Code).
- Month 3: Centralise logging and monitoring.
- Ongoing: Monitor compliance status with cloud tools (e.g., Defender for Cloud).
The Role of BSI C5
BSI C5 and IT Baseline Protection are complementary. BSI C5 is a requirements catalogue specifically for cloud services. Many C5 requirements can be met directly with Baseline Protection measures. Anyone implementing IT Baseline Protection in the cloud is well on their way to BSI C5 compliance — and C5:2026 is now structurally aligned with ISO 27001:2022, which makes the mapping even more direct.
The BSI-compliant cloud security concept should integrate both frameworks. It demonstrates how the requirements of C5 and Baseline Protection are met through technical and organisational measures in the cloud.
Insight42: Your Partner for Cloud Security
We translate IT Baseline Protection for the cloud. We build secure landing zones that incorporate ISO 27001 and BSI C5 requirements from the start, and ensure ongoing secure operations with managed services.
Make your cloud Baseline Protection-compliant. See NIS2 & Cloud Security Beratung (German) or contact us.