{"id":34821,"date":"2026-08-31T17:29:42","date_gmt":"2026-08-31T15:29:42","guid":{"rendered":"https:\/\/sits.com\/?p=34821"},"modified":"2026-09-18T15:08:17","modified_gmt":"2026-09-18T13:08:17","slug":"grundschutz-plus-plus-bsi-it-baseline-protection","status":"publish","type":"post","link":"https:\/\/sits.com\/en\/blog\/grundschutz-plus-plus-bsi-it-baseline-protection\/","title":{"rendered":"Grundschutz++ explained"},"content":{"rendered":"

[vc_row][vc_column][vc_column_text]Where do we stand today? As of July 2026, Grundschutz++<\/strong> is not yet a fully rolled-out successor to the existing IT Baseline Protection methodology. Instead, it is an applicable pilot version<\/strong> that the BSI is testing together with pilot partners.<\/p>\n

Nevertheless, the topic remains highly relevant because the direction is clear: IT Baseline Protection is becoming more digital, process-oriented, and structured in a way that allows tools to process its content directly. For companies and public sector organizations, now is therefore the time for preparation and strategic alignment<\/strong> to avoid poor investments, duplicated effort and resource bottlenecks.[\/vc_column_text]

<\/div>\n

Grundschutz++ at a Glance: OSCAL, requirements and timeline<\/h2>[vc_column_text]Grundschutz++ is a comprehensive modernisation of <\/strong>the<\/strong> BSI IT Baseline Protection <\/strong>framework<\/strong>. <\/strong>Requirements are provided through the State-of-the-Art Library as machine-readable OSCAL data in JSON format. According to the current BSI status, the framework consists of 19 practices and 921 requirements. The pilot phase runs until 30 September 2026, while publication of the methodology is planned for it-sa 2026<\/a> from 27 to 29 October. ISO 27001 certification<\/a> applications based on Grundschutz++ are expected to be possible from 1 January 2027 onwards.[\/vc_column_text]
<\/div>\n

What is Grundschutz++?<\/h2>[vc_column_text]Grundschutz++ is neither a new law nor an additional compliance framework that companies and public sector organizations must implement alongside ISO 27001, NIS2 and DORA<\/a>. It is a reform of the BSI methodology<\/strong> used by organizations to establish, operate and demonstrate an Information Security Management System.<\/p>\n

The existing IT Baseline Protection methodology is characterized by extensive standards and methodology documents, requirement catalogues, implementation guidance and periodic editions. Grundschutz++ shifts the focus towards a process-oriented methodology and a structured data foundation. The BSI's objective is to modernize content and reduce effort within the ISMS<\/a>, particularly where processes can be automated or data can be reused multiple times. [1]<\/a>[2]<\/a>[\/vc_column_text]

<\/div>\n[vc_single_image image=\"34829\"]
<\/div>\n[vc_column_text]The key change is therefore not \u201cfewer controls\u201d but more manageable controls<\/strong>. The expression \u2018controls\u2019 originates from the OSCAL data model<\/strong>, where individual requirements are represented as controls<\/em>. This refers to the familiar baseline protection requirements, not an additional layer of controls. Requirements are intended to be clearly structured, version-controlled, filterable, and reusable within tools.<\/p>\n

This creates opportunities for more data-driven security management through dashboards for implementation status, notifications of catalogue changes or metrics derived from linked evidence. However, it does not remove the organization\u2019s responsibility for decisions, risks, implementation measures or effectiveness reviews.<\/p>\n

Strategically, Grundschutz++ also gains importance through NIS2<\/a>. Essential and important entities must implement appropriate measures that take the state of the art into account. The State-of-the-Art Library makes BSI security requirements available in a machine-readable format and therefore provides valuable guidance. Whether an organisation is affected<\/a> and which measures are appropriate in a specific context must still be assessed independently.[3]<\/a>[6]<\/a>[7]<\/a>[\/vc_column_text]

<\/div>\n[vc_single_image image=\"34834\"]
<\/div>\n

OSCAL and Grundschutz++: Making BSI requirements machine-readable<\/h2>[vc_column_text]OSCAL stands for Open Security Controls Assessment Language. This open data model describes security requirements and related information in a machine-readable format. The BSI publishes its digitally structured security requirements through the State-of-the-Art Library, where the Grundschutz++ user catalogue is available as a JSON file.[2]<\/a>[3]<\/a>[\/vc_column_text]
<\/div>\n[vc_single_image image=\"34839\"]
<\/div>\n[vc_column_text]For practitioners, five effects are particularly relevant:<\/p>\n
    \n
  1. Changes become technically comparable: <\/strong>Instead of manually comparing two PDF versions, tools can analyze versions and deltas.<\/li>\n
  2. Content can be maintained continuously: <\/strong>Changes remain linked to a specific catalogue version and therefore remain traceable.<\/li>\n
  3. Catalogues become official data sources within tools:<\/strong>Supported ISMS<\/a> and GRC platforms can import the original version-controlled catalogue rather than transferring content into proprietary formats.<\/li>\n
  4. Profiles can be tailored more precisely<\/strong>: A profile is a filtered, organization-specific package of requirements. Organizations adopt the content relevant to their context and process it further.<\/li>\n
  5. Evidence can be linked more systematically<\/strong>: A ticket can document implementation of a requirement, a metric can demonstrate effectiveness, and a policy can provide organizational evidence. Integrated platforms can support assessments through these linked sources.<\/li>\n<\/ol>\n

    This creates the foundation for \u201cCompliance as Code\u201d, if processes, data and evidence are integrated properly. A JSON file on its own does not make an organization compliant.[\/vc_column_text]

    <\/div>\n[vc_single_image image=\"34844\"]
    <\/div>\n[vc_single_image image=\"34849\"]
    <\/div>\n[\/vc_column][\/vc_row][vc_row][vc_column]

    The 19 Grundschutz++ practices at a glance<\/h2>[vc_column_text]The current pilot catalogue organizes its content into 19 practices. The BSI differentiates between organizational, technical and overarching ISMS practices. The methodology is therefore aligned more closely with the activities that organizations must perform continuously, ranging from governance<\/a> and structural modelling to detection, response and continuous improvement<\/a> in a threat landscape increasingly shaped by the use of AI in cybercrime<\/a>. [4]<\/a>[\/vc_column_text]
    <\/div>\n[vc_single_image image=\"34854\"]
    <\/div>\n[vc_column_text]The five ISMS practices form the governance cycle:<\/p>\n