CyberRisikoCheck under DIN SPEC 27076: who it suits and what comes next from 50 employees
Key takeaways
- The CyberRisikoCheck is a procedure by the German Federal Office for Information Security (BSI) based on DIN SPEC 27076. A one- to two-hour interview covers 27 requirements in six topic areas. You receive a report with a rating and prioritised recommendations.
- It is designed for small and micro enterprises with fewer than 50 employees. It is not a certification.
- Only IT service providers trained by the BSI may carry it out.
- With 50 or more employees on Microsoft 365, a self-assessment is usually no longer enough. Customers, cyber insurers and, where it applies, NIS2 ask for evidence from the actual configuration.
Many managing directors look for an entry point into IT security that is manageable and gives a clear answer. The BSI CyberRisikoCheck is built for exactly that. Whether it suits your company depends mainly on its size.
What is the CyberRisikoCheck?
A standardised consulting procedure based on DIN SPEC 27076. A trained IT service provider conducts a one- to two-hour interview with you and records the answers in a BSI web application. It covers 27 requirements in six topic areas, from organisation and backup to the protection of IT systems.
The result is a report with a rating and recommendations ordered by impact. The report also points to public funding programmes that may support the implementation. The BSI puts the effort at about one consultant day.
Who is it for?
Small and micro enterprises with fewer than 50 employees, typically without their own IT department. The procedure deliberately relies on a conversation rather than a technical review: it shows the biggest risks quickly, without access to your systems.
The CyberRisikoCheck is not a certification. It does not replace an ISMS under ISO 27001 or evidence for a supervisory authority or auditor.
Who may carry it out?
Only IT service providers qualified by the BSI. They need experience with security consulting, reference projects with small companies and training in the interview method. Qualified providers are listed on the BSI map. The BSI is currently revising the training concept and has not yet announced new dates. You can check the current status on the BSI page on the CyberRisikoCheck.
What changes from 50 employees?
The environment grows with the company: more accounts, more devices, more external sharing, often an IT provider who runs Microsoft 365. At the same time, external requirements increase.
- Customers ask about MFA, backup and responsibilities in supplier assessments.
- Cyber insurers want statements on MFA, endpoint protection and backups that hold up after an incident.
- NIS2 can apply from 50 employees if your company operates in one of the covered sectors. Management must then approve the measures and oversee their implementation.
A self-assessment in an interview only goes so far here. The statement “MFA is active” is often true, and still individual accounts are excluded. Such exceptions only show up in the configuration.
What fits from 50 employees on Microsoft 365?
A review that reads the actual settings and evidences every finding. Our security assessment reviews Microsoft 365, Entra ID and Intune with read-only access: sign-in and MFA, admin rights, email protection, sharing, devices, logging and backup. For each finding you receive location, priority and effort, mapped to NIS2, ISO 27001 and BSI IT-Grundschutz, at a fixed price.
If you have already completed a CyberRisikoCheck, its report is a good starting point. The assessment then shows how those points are actually implemented in your tenant.
Frequently asked questions
Is the CyberRisikoCheck a certification?
No. It is a standardised consultation with a report and recommendations. It does not result in a certificate or seal for your company.
Does DIN SPEC 27076 also apply to larger companies?
DIN SPEC 27076 is written for companies with fewer than 50 employees. Larger companies can use its requirements for orientation, but for customers, insurers and NIS2 they usually need reliable evidence from their systems.
How long does a security assessment take by comparison?
The CyberRisikoCheck takes about one consultant day. A Microsoft 365 security assessment covers data collection, evaluation, a report and a workshop with management and IT. Duration and fixed price are agreed before we start.