Key takeaways
- On October 26, 2026, the German Federal Office for Information Security (BSI) published the Grundschutz++ methodology as BSI Standard 300-1. It builds on IT-Grundschutz and is currently available in German only.
- Grundschutz++ does not replace ISO 27001. According to the BSI, an ISMS built on Grundschutz++ can be certified from 2027 and is compatible with ISO/IEC 27001; the outcome is an ISO 27001 certification based on Grundschutz++.
- The BSI's milestone plan (as of October 2026) opens certification applications on January 1, 2027, and ends certification under the existing IT-Grundschutz methodology on November 30, 2031.
- Three things are new: a process-oriented approach that starts from core business processes, a free choice of risk method within minimum criteria, and requirements published in a machine-readable format.
- Grundschutz++ is neither a law nor a substitute for NIS2 obligations. For an existing ISMS, 2026 is the year to review and prepare, not to migrate.
BSI Grundschutz++ is the new methodology from Germany's Federal Office for Information Security (BSI) for building an information security management system. BSI Standard 300-1 has set it out in published form since October 26, 2026. If you are an ISMS manager or CISO who holds or plans an ISO 27001 certificate, the practical question is whether you now have to rebuild your ISMS. The short answer is no. The longer answer covers what actually changes and which preparation pays off now.
What is BSI Grundschutz++?
Grundschutz++ (often shortened to GS++) is the successor to IT-Grundschutz, the BSI's long-standing baseline protection methodology that tells companies and public bodies how to build, run, and improve an ISMS. BSI Standard 300-1 contains the methodology. The requirements themselves sit in the Grundschutz++ user catalog, which the BSI publishes in its State-of-the-Art Library and which replaces the IT-Grundschutz Compendium.
In its press release of October 26, 2026, which is in German, the BSI says the standard is also meant to secure organizations with heterogeneous IT landscapes or complex virtualization. The methodology follows the PDCA cycle and links five steps into one continuous security process: assessment and planning, requirements analysis, implementation, monitoring, and continual improvement.
| Attribute | Grundschutz++ at a glance |
|---|---|
| Issued by | German Federal Office for Information Security (BSI) |
| Name | BSI Standard 300-1 "Methodik Grundschutz++" (Grundschutz++ methodology) |
| Published | October 26, 2026 |
| Requirements | Grundschutz++ user catalog in the BSI State-of-the-Art Library, machine-readable |
| Language | German only, for now |
| Certification | ISO 27001 based on Grundschutz++, applications from January 1, 2027, per the BSI milestone plan |
| Status | Early-adopter phase from the first quarter of 2027 to December 31, 2027, per the milestone plan |
If you have never used IT-Grundschutz and work directly to the standard, our guide to ISO 27001 certification covers the process, timeline, and effort. For you, Grundschutz++ is an option, not an obligation.
What Grundschutz++ is not
Grundschutz++ is a BSI methodology. It creates no new legal duty and no new certificate, and it does not decide whether your company falls under NIS2.
Not a law
A common misconception holds that Grundschutz++ puts a new obligation on companies. BSI standards describe methods. No law requires private-sector companies to build their ISMS on IT-Grundschutz or Grundschutz++. Companies that choose the methodology do so voluntarily, for example because a client expects a Grundschutz basis or because the modular structure suits them.
Not a new certificate
The BSI's milestone plan is explicit: from January 1, 2027, companies can apply for certification "nach ISO 27001 auf Basis von GS++", meaning ISO 27001 based on Grundschutz++. The certificate remains an ISO 27001 certificate, and Grundschutz++ describes one route to it. The requirements of ISO/IEC 27001 still apply in full, including the 93 Annex A controls, and the BSI states that Grundschutz++ is compatible with the standard.
Not a substitute for NIS2 obligations
Sector and size decide whether your company falls under NIS2, not your choice of ISMS methodology. In Germany, Section 28 of the BSI Act (BSIG) sets that scope. The risk-management measures under Section 30, the reporting duties under Section 32, and registration under Section 33 apply whether you work to ISO 27001, IT-Grundschutz, or Grundschutz++. A Grundschutz++ ISMS can help you implement and evidence the Section 30 measures; it does not replace the scoping assessment.
Our guide to the NIS2 Directive sets out what NIS2 requires, from the ten minimum measures to the reporting deadlines.
IT-Grundschutz vs. Grundschutz++: what stays and what is new
The core stays the same: an ISMS run on the PDCA principle and compatible with ISO/IEC 27001. What changes is the starting point of the analysis, the freedom in choosing a risk method, and the format of the requirements.
| Attribute | IT-Grundschutz (2023 edition) | Grundschutz++ |
|---|---|---|
| Methodology | BSI Standards 200-1 to 200-3 | BSI Standard 300-1 |
| Requirements | IT-Grundschutz Compendium with modules (Bausteine) | Grundschutz++ user catalog in the State-of-the-Art Library, solution-neutral requirements only |
| Starting point | Modeling the information domain with modules | Process-oriented, with core business processes secured first |
| Risk method | Risk analysis under BSI Standard 200-3 | Free choice, provided the standard's minimum criteria are met |
| Requirements format | Compendium as a document | Machine-readable; the BSI says checks can be automated |
| Certificate | ISO 27001 based on IT-Grundschutz | ISO 27001 based on Grundschutz++ |
| Certifiable | Until November 30, 2031, per the BSI milestone plan | Applications from January 1, 2027, per the BSI milestone plan |
What stays
The goal does not change: an ISMS that runs information security as an ongoing management process and that a certification body can audit. A Grundschutz++ ISMS still needs the foundations an auditor wants to see: a defined scope, an asset inventory, clear roles, and solid evidence. The BSI has not yet described how much of that carries over directly in a switch, and as of October 28, 2026, we have not found official migration guidance.
What is new
The biggest difference is where you start. Grundschutz++ starts from an organization's core business processes and secures them first, instead of breaking the whole information domain down into modules up front. If you already know your core processes and the systems behind them, you start with an advantage.
Your risk method gets more room. You can choose your own method for identifying, assessing, and treating risk, as long as it meets the standard's minimum criteria. Many ISO 27001 companies already run their own risk method, based on ISO/IEC 27005 or an in-house scheme, so this lowers the barrier to entry.
The third change is technical. The BSI publishes every requirement in a machine-readable format, which it says makes checking them automatable. According to an overview by SITS, the State-of-the-Art Library contains 921 requirements across 19 practices and 53 target objects. Practices are task packages that bundle similar requirements and can be mapped to processes. Treat those numbers as a snapshot; they change with each new version of the catalog.
A second misconception concerns exactly this point: machine-readable does not mean implemented. A tool can import requirements and prepare checks. Evidence and audits still prove whether a control works in daily operations.
The BSI timeline: 2026 to 2031
The BSI publishes a milestone plan, dated October 2026, on its Grundschutz++ page, which is in German. The BSI notes that it updates the plan continually, so read the dates below as the current plan, not as deadlines.
| Date | Milestone according to the BSI |
|---|---|
| October 26, 2026 | BSI Standard 300-1 published and presented at it-sa in Nuremberg |
| November 30, 2026 | Training concepts for GS++ practitioners and GS++ consultants |
| December 2026 | Worked example based on the fictional public body "BDIT" |
| January 1, 2027 | Applications for ISO 27001 certification based on GS++ open |
| Q1 2027 | Early-adopter phase starts; upskilling for IT-Grundschutz consultants and audit team leaders who are already certified |
| February 26, 2027 | Concept for measuring ISMS performance integrated into the methodology |
| March 31, 2027 | Performance indicators for every requirement in the methodology practices |
| December 31, 2027 | Early-adopter phase ends |
| November 30, 2031 | Certification under IT-Grundschutz ends, five years after GS++ was published |
Many people read "certifiable from 2027" as "mandatory from 2027". The plan says something else: 2027 opens a second route to the certificate, and on current plans the existing route runs in parallel for about five more years. What remains open is how the BSI will handle the transition for existing certificates in detail, for example for surveillance audits and recertifications. As of October 28, 2026, we have not found specific transition rules.
What ISMS managers should do in 2026: prepare, don't migrate
2026 is the wrong year to migrate and the right year to prepare. The methodology is out, certification applications open only in 2027, training and a worked example follow in the coming months, and the early-adopter phase runs until the end of 2027. What you can prepare depends on where you start.
| Your starting point | What Grundschutz++ changes for you | Recommendation for 2026 |
|---|---|---|
| ISO 27001 certificate without a Grundschutz basis | Nothing mandatory. Your certificate and audit cycle are unaffected. | Watch the user catalog as an additional source of requirements; plan no switch |
| ISO 27001 certificate based on IT-Grundschutz | The existing route stays certifiable until November 30, 2031, per the BSI milestone plan. | Compare your ISMS against Standard 300-1 and tie the switch to a later audit cycle |
| First certificate in planning | From 2027 you can choose native ISO 27001, ISO 27001 based on IT-Grundschutz, or ISO 27001 based on Grundschutz++. | Choose your basis deliberately, and factor in that the IT-Grundschutz route is being phased out |
Five steps pay off whatever you decide later:
- Record your certification basis and dates. Note which basis your certificate is issued on and when your surveillance audits and next recertification fall. That gives you the realistic window for a switch.
- Link core processes to assets. Map your core business processes to the systems, applications, and service providers in your asset inventory. Grundschutz++ needs this mapping as its starting point, and it improves any ISO 27001 ISMS.
- Document your risk method and compare it. Check that your risk method is written down, and compare it against the minimum criteria in BSI Standard 300-1.
- Store evidence in a structured way. Record each piece of evidence with a date, an owner, and the requirement it supports. Structured evidence is easy to map to a machine-readable catalog later.
- Watch the early-adopter phase. The worked example in December 2026 and the experience of the first adopters in 2027 will show how auditors assess the new methodology. Decide after that.
Take a machine builder with 350 employees that holds an ISO 27001 certificate based on IT-Grundschutz, with recertification due in fall 2028. Instead of rebuilding the ISMS in 2026, the information security officer maps the company's twelve core processes to existing assets in the fourth quarter and checks the risk method against the minimum criteria. Management decides on the switch in early 2028, after the early-adopter phase ends. On current plans, the company has until November 30, 2031, to make the move at the audit cycle that suits it.
If your company also falls under NIS2, look at the overlap the same way. Our article on where NIS2 and ISO 27001 overlap shows which measures an ISO 27001 ISMS already covers and which gaps remain.
How Kertos supports you
Kertos combines a compliance platform with certified experts for ISO 27001 and NIS2. Whether you run your ISMS natively on ISO 27001 or later certify on the basis of Grundschutz++, the standard the audit checks against stays the same.
The foundations every ISMS needs sit in one place on the platform: scope, assets, roles, policies, and evidence. With the Kertos certifiable ISMS, you build that structure to ISO 27001 and keep it current, instead of pulling it together again before every audit.
You assess risks in Kertos Risk Management with a documented method that auditors can follow. Every company Kertos has taken into an audit has passed it.
If you want to run your ISO 27001 program on one platform, we will show you how that works with Kertos in a demo.
Frequently asked questions
Does Grundschutz++ replace ISO 27001?
No. Grundschutz++ is a BSI methodology for building an ISMS, and ISO/IEC 27001 remains the standard you are certified against. According to the BSI, an ISMS implemented under Grundschutz++ is compatible with ISO/IEC 27001 and leads to an ISO 27001 certification based on Grundschutz++.
Do I have to migrate now?
No. According to the BSI milestone plan, applications for certification based on Grundschutz++ open only on January 1, 2027, and the existing IT-Grundschutz route stays certifiable until November 30, 2031. In 2026, preparation pays off: review your ISMS, map core processes to assets, and tie the switch to a later audit cycle.
Is Grundschutz++ certifiable?
Yes, from 2027. The BSI states that an ISMS implemented under Grundschutz++ can be certified from 2027, and its milestone plan names January 1, 2027, as the start date for applications for ISO 27001 certification based on Grundschutz++. There is no standalone Grundschutz++ certificate.
Until when does the old IT-Grundschutz apply?
The BSI milestone plan, dated October 2026, names November 30, 2031, as the end of certification under IT-Grundschutz, five years after Grundschutz++ was published. As of October 28, 2026, we have not found detailed transition rules for existing certificates. The BSI updates the plan continually.
Do I need Grundschutz++ for NIS2?
No. In Germany, Section 28 of the BSI Act decides by sector and size whether your company falls under NIS2. The obligations in Sections 30 to 38 apply whether you build your ISMS on ISO 27001, IT-Grundschutz, or Grundschutz++.
