In short: VdS 10000 is a guideline from VdS Schadenverhütung (the German loss-prevention institute of the insurance industry) for information security in small and medium-sized businesses. According to VdS, it is based on ISO 27001 and BSI IT-Grundschutz (the German Federal Office for Information Security's baseline protection) but is considerably leaner and tailored to mid-sized businesses. For websites and web servers, what matters most are inventory, vulnerability handling, remote access with multi-factor authentication, data backup and the handling of security incidents.
Why VdS 10000 is interesting for mid-sized businesses
Many companies know they should approach information security in a more structured way but shy away from the effort of ISO 27001. That is exactly what VdS 10000 is for. VdS describes it as an industry-neutral catalogue of measures that is meant not to overburden small and medium-sized businesses and municipalities, either organisationally or financially.
Two statements from VdS help to put it in context. The effort is said to be about 20 percent compared with ISO 27001. And the BSI is said to rate the requirements of VdS 10000 as a subset of the basic protection level of IT-Grundschutz. The guideline is therefore not a replacement for the major standards but a realistic entry point that, according to VdS, is upward-compatible.
For insurers, VdS 10000 carries particular weight, because VdS is closely tied to the insurance industry. VdS emphasises that a certification can create trust with insurers and help to transfer the residual risk. What this means specifically for your policy is something to clarify with your insurer or broker; notes on claims are under Cyber insurance: what counts in a claim.
What is new in the 2025 version of VdS 10000
VdS revised the guideline in 2025. According to VdS, the following points were added or changed, among others:
- Clearer language, so that beginners also understand the requirements.
- Binding responsibilities: information security officers and the associated team must be officially appointed.
- Multi-factor authentication for remote access becomes mandatory.
- Data backup following the multi-generation principle, in different locations and on different media.
- Revised risk management with specifications on assessment criteria and thresholds above which a risk is accepted.
- A common chapter on “security incidents”, merging earlier chapters on disruptions, outages and incidents.
- Physical access such as keys and transponders is regulated together with the personnel processes.
The new edition also takes into account the guideline VdS 10100, which describes NIS2 requirements. VdS sees VdS 10000 as a basis on which these can be added later.
VdS 10000 and the web server: what to do in concrete terms
The guideline does not mention PHP or individual web servers. Its requirements can, however, be applied directly to web infrastructure. The following table shows what that can look like. It is an aid to translation, not an official interpretation.
| Requirement area | Meaning for website and web server | Example from the PHP2Shell situation |
|---|---|---|
| Overview of IT systems and risks | Websites, shops, portals and their servers are recorded and assessed | Knowing immediately which systems use PHP and in which version |
| Vulnerabilities and updates | Security updates are installed promptly and documented | Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart of all workers |
| Remote access with multi-factor login | SSH, hosting panel and CMS admin are additionally secured | Stolen passwords alone do not open admin access |
| Data backup | Several generations, separate locations and media | Falling back on a backup from before 17 October 2026, if necessary |
| Security incidents | Reporting route, assessment, documentation | Suspected web shell is reported and examined, not quietly deleted |
| Service providers | Host and agency are bound by contract | Written patch confirmation from the host |
For data backup, take a look at Backups following the 3-2-1 rule, and for remote access at Two-factor login for admin access. Both fit well with the new obligations of the 2025 version.
How do SMEs realistically proceed?
VdS 10000 can also be used as a guide without a certification goal. A pragmatic path begins with the inventory, because without an overview no other requirement can be met cleanly. Then come the points with the greatest effect per effort: multi-factor login, working backups with a restore test and a clear reporting route when something is suspected.
Only once these foundations are in place does the formal side pay off, with policies, appointed officers and risk assessment. Anyone who later aims for certification will find the procedure in the VdS documents; the audit itself is carried out by the certification body, not by a service provider like us.
A common stumbling block in mid-sized businesses is the question of who takes on the role of information security officer. The 2025 version requires an official appointment. In small companies, the task often ends up with the head of IT or with management itself. That is possible as long as time and authority are realistically sized. It is important that this person also has an eye on the websites looked after by marketing or an agency. These in particular like to slip through the net in the first inventory because they do not run in the company’s own data centre. A simple rule helps: every domain the company owns has a responsible person and an entry in the inventory.
For the web server, this means: hardening and patch discipline are not an optional extra alongside the guideline but exactly what it demands in everyday operation. What that involves is described in Server hardening for PHP web servers. The comparison with the major standards is drawn in the article ISO 27001 and TISAX: what concerns web servers.
How does PHP SOS help?
- Together with you, we create the inventory of your websites, servers and PHP versions and mark the critical systems.
- We implement the technical requirements on the web server: updates with evidence, multi-factor login for remote access, hardening and backup checks.
- We document this so that your information security officers can adopt it into the VdS documents.
- We do not promise certification. Whether the requirements are met is judged by the audit body.
Conclusion
VdS 10000 is a serious but feasible framework for mid-sized businesses. The 2025 version sharpens exactly the points that also count after PHP2Shell: responsible persons, multi-factor login, good backups and a regulated way of handling incidents. Anyone who starts at the web server quickly makes visible progress and has a solid basis for more.
Frequently asked questions
Who is VdS 10000 intended for?
According to VdS, for small and medium-sized enterprises as well as municipalities and municipal companies. It is industry-neutral and is meant not to overburden organisations or finances. According to VdS, larger organisations can also apply it.
What is the difference between VdS 10000 and ISO 27001?
According to VdS, VdS 10000 is based on ISO 27001 and BSI IT-Grundschutz but is tailored to SMEs and considerably leaner. VdS puts the effort at about 20 percent compared with ISO 27001 and describes the guideline as upward-compatible, that is, as a possible entry point to the ISO 27000 series.
Does VdS 10000 help with NIS2?
VdS describes the 2025 edition as a basis on which the NIS2 requirements can be added later. There is a separate guideline, VdS 10100, for that. Whether your company falls under NIS2 and what then applies should be clarified separately.
Is there a version for production plants?
Yes. For industrial automation systems, VdS publishes the guide VdS 10020, which interprets VdS 10000 for this area.