Open Telekom Cloud listed for IT-Grundschutz

In this article, you will learn

• what the IT-Grundschutz certification involves,
• when the Open Telekom Cloud began the certification process
• and when the certificate is expected to be issued.

Companies, public authorities, and institutions can already implement their sovereign cloud strategies using the Open Telekom Cloud. This is now officially confirmed: On July 28, 2025, the Open Telekom Cloud submitted its application for IT-Grundschutz certification to the German Federal Office for Information Security (BSI). The service is now listed under certificate number BSI-IGZ-0757 on the BSI website. This step further strengthens Open Telekom Cloud’s leading position in the European cloud market.

The IT-Grundschutz (officially ISO27001 certification on the basis of IT-Grundschutz ) – not to be confused with the “native” ISO 27001 T-systems already has – is the new benchmark for secure and legally compliant cloud usage in Germany. Certification by the BSI guarantees the highest cloud security for users. 

Initially, IT-Grundschutz certification is relevant for public sector tenders, including federal authorities as well as IT service providers of states and municipalities. Over the coming years, the requirement is expected to expand to critical infrastructure companies, e.g., electricity grid operators, energy providers, healthcare institutions, financial and insurance companies, telecom providers, ports, airports, and public transport.

Its growing importance supports Germany’s efforts to achieve digital sovereignty. Hyperscalers typically operate standardized, globally distributed infrastructures that deliver services across multiple countries and jurisdictions. This global approach often makes it difficult to clearly define service boundaries and does not always meet the BSI’s stringent standards for traceability, control, and national data processing. By contrast, European cloud providers operate entirely within the EU, allowing for a more direct and transparent implementation of regulatory requirements. This not only simplifies the certification process but also enhances digital sovereignty by offering trustworthy, controllable cloud infrastructures made in Europe.

The application for IT-Grundschutz certification builds on an already comprehensive set of existing certifications. These include the BSI C5 Type 2 attestation, ISO 27001/27018, ISO 27701, SOC 1/2/3, TISAX, and the EU Cloud Code of Conduct. The Open Telekom Cloud also complies with a range of industry-specific regulatory requirements, such as the obligation to maintain professional confidentiality under Section 203 of the German Criminal Code (StGB), the protection of social data under Section 35 of the German Social Code I (SGB I), as well as provisions from the EU’s DORA regulation and the NIS2 directive.

With IT-Grundschutz certification, Open Telekom Cloud further strengthens trust with customers, partners, and authorities.

Since September 19, 2025, Open Telekom Cloud has been listed on the BSI website, confirming that it is undergoing the certification process. The listing already allows participation in public sector tenders. The team expects the six-month audit to conclude successfully and the certificate to be handed over in Q2 2026.The audit phase, conducted by a BSI-recognized auditor, is scheduled to start in January 2026.