Open Telekom Cloud registered for IT-Grundschutz

In this article, you will learn

• what the IT-Grundschutz certification involves,
• when the Open Telekom Cloud began the certification process and
• when the certificate is expected to be issued.

Today, companies, public authorities, and institutions can already implement their sovereign cloud strategies using the Open Telekom Cloud. T-Systems is now seeking renewed official recognition: On July 28, 2025, the Open Telekom Cloud was officially registered with the German Federal Office for Information Security (BSI) for certification under the IT-Grundschutz framework. With this step, the Open Telekom Cloud further solidifies its leading position in the European cloud market and is now listed on the BSI’s official website.

The IT-Grundschutz certification – not to be confused with the “classic” ISO 27001 based on IT-Grundschutz—is the new benchmark for secure and legally compliant cloud usage in Germany. While it is initially most relevant for public sector tenders, its significance is expected to expand across other industries in the coming years.

Its growing importance supports Germany’s efforts to achieve digital sovereignty. Hyperscalers typically operate standardized, globally distributed infrastructures that deliver services across multiple countries and jurisdictions. This global approach often makes it difficult to clearly define service boundaries and does not always meet the BSI’s stringent standards for traceability, control, and national data processing. By contrast, European cloud providers operate entirely within the EU, allowing for a more direct and transparent implementation of regulatory requirements. This not only simplifies the certification process but also enhances digital sovereignty by offering trustworthy, controllable cloud infrastructures made in Europe.

The registration for IT-Grundschutz certification builds on an already comprehensive set of existing certifications. These include the BSI C5 Type 2 attestation, ISO 27001/27018, ISO 27701, SOC 1/2/3, TISAX, and the EU Cloud Code of Conduct. The Open Telekom Cloud also complies with a range of industry-specific regulatory requirements, such as the obligation to maintain professional confidentiality under Section 203 of the German Criminal Code (StGB), the protection of social data under Section 35 of the German Social Code I (SGB I), as well as provisions from the EU’s DORA regulation and the NIS2 directive.

Just a few weeks after registration, the Open Telekom Cloud will appear on the BSI’s official website. The audit phase – carried out by BSI-accredited auditors – is scheduled to begin in August. After the six-month audit period, the certificate is expected to be issued in the second quarter of 2026.