The BSI publishes the Grundschutz++ methodology at it-sa on 27 October 2026. Grundschutz++ becomes certifiable on 1 January 2027, and the existing IT-Grundschutz stays certifiable until 30 November 2031. This page explains what changes, how the transition runs, and what it means for organisations with an existing IT-Grundschutz footprint as well as those entering compliance through NIS2.
02 / The short version
Grundschutz++ is the BSI's modernisation of IT-Grundschutz. The core steps are the ones compliance teams have used for two decades: identify the information domain, establish protection requirements, select suitable measures, document what you run, evidence what you claim. What the BSI has rewritten is the methodology, now built around processes, and the catalogue, now published as machine-readable data.
The old Compendium was a PDF, maintained on an annual cadence and cross-referenced by hand. Grundschutz++ is a structured, machine-readable catalogue in the OSCAL format, published openly through the BSI's GitHub organisation and versioned continuously. The regulatory intent has not changed. The artefact producing the intent has.
Put plainly: the regulatory intent, the roles and the responsibilities stay. What is new is a process-based methodology and a catalogue that exists as structured data, with cross-references to ISO 27001 and NIS2 built in.
03 / The concrete changes
Grundschutz++ is not a new ISMS philosophy. The BSI kept the Plan-Do-Check-Act backbone, the obligation to establish Schutzbedarf, and the primacy of the IT-Sicherheitsbeauftragte. Inside that frame, the catalogue itself changes in concrete ways.
The 2023 Compendium groups controls into 111 Bausteine across ten layers. Grundschutz++ consolidates the catalogue into 19 process-oriented Praktiken, grouped along the PDCA cycle. Work that used to live inside a Baustein now lives inside a Praktik; the selection logic changes from which Bausteine apply to a target object to which Praktiken apply, and at what depth.
The 2023 Compendium carries roughly 6,567 individual requirements across its Bausteine. The Grundschutz++ Praktiken contain approximately 985. The reduction is not a lowering of the bar: redundant phrasings have been consolidated, inheritance along a target-object hierarchy is now explicit, and organisation-wide requirements no longer repeat per target object. The net effect is fewer boxes to tick, better alignment between boxes, and less duplicated documentation.
The historical three-tier scale, normal, hoch, sehr hoch, collapses into two levels in Grundschutz++: normal for the general state of the art, erhöht for elevated protection. Anything that previously would have landed at sehr hoch now enters the Risikoanalyse track directly. This removes the grey zone between hoch and sehr hoch that most practitioners found unhelpful.
Grundschutz++ is published as OSCAL, the open compliance-document schema maintained by NIST. The BSI makes both JSON and XML serialisations available through the public BSI-Bund/Stand-der-Technik-Bibliothek GitHub repository. Catalogue updates arrive as commits, not as annual PDF releases. ISMS tools that speak OSCAL can ingest the catalogue directly and run target-actual comparisons against live system data.
The old IT-Grundschutz profiles, pre-configured Sicherheitskonzept templates for archetypes like e-file, 5G, or municipal utilities, become Blaupausen in Grundschutz++. Structurally similar, procedurally different: Blaupausen are machine-readable configurations that a tool can apply automatically to a target object, not document templates that consultants adapt by hand.
Grundschutz++ ships with OSCAL cross-references to ISO 27001:2022 Annex A controls and to NIS2 requirements. Organisations running a combined BSI/ISO scope no longer maintain the mapping in a separate spreadsheet. For multinational scopes, Grundschutz++ starts to look like a viable primary catalogue where previously only ISO could serve that role.
04 / The transition
Grundschutz++ becomes certifiable on 1 January 2027, and the existing IT-Grundschutz stays certifiable until November 2031. So 2027 does not force the move. Organisations that test the transition on one of their own Informationsverbünde that year will know, before their next re-certification, what it costs and whether their current tool can carry it.
The BSI has spread the transition over several years on purpose, because inventories, Sicherheitskonzepte, evidence portfolios and audit workflows need time. Until 2031 organisations can choose between the two standards, and existing certificates keep their term. The closer 2031 gets, the more re-certifications will be under Grundschutz++.
Caveat · Some implementation aids, including sector-specific Blaupausen, profile mappings, and procurement templates, are still being published incrementally through the BSI GitHub repository. This page will update as they arrive.
05 / Your position
You already have a Strukturanalyse, a Schutzbedarfsfeststellung, a modelled set of Bausteine and an IT-Grundschutz-Check on record. So the transition does not start from a blank page. Part of your assessment carries over, part must be re-assessed, and part depends on points the BSI has yet to settle. How large each part is for your Informationsverbund, nobody knows today. It can be measured, though.
The second question is your tool: whether it reads the BSI's OSCAL catalogue, holds practices as objects of their own and links evidence in machine-readable form. Put these questions to your vendor in writing (section 06). The answers decide how much manual work the transition costs your team.
Test the transition on one InformationsverbundIf your organisation has been brought into scope by NIS2 or the KRITIS-Dachgesetz, the arithmetic is different. You do not have a Sicherheitskonzept today. Starting on the 2023 Compendium would mean producing a 2023-era artefact and then moving it across before 2031. Starting on Grundschutz++ means producing the artefact on the catalogue that will still apply after the transition.
From 2027 both paths are certifiable. The practical question is whether your tool, your certification body and your timeline support Grundschutz++ from day one. Where they do, starting on Grundschutz++ saves you a second project before 2031. Where they do not, the 2023 Compendium remains a defensible path, with a budget set aside for the transition.
What to do now06 / Practical next steps
Guidance that stands on its own, independent of vendor. The substance of this section does not change whether you ultimately run OrbisGraph or any other ISMS tool. It is the groundwork every organisation in scope will benefit from.
The Grundschutz++ methodology published on 27 October 2026 is the single best starting point. The Stand-der-Technik-Bibliothek GitHub repository is the canonical source for catalogues and updates. Everything else, including this page, is commentary.
Independent of tooling, mapping your existing Bausteine and measures to the practices shows which parts of your ISMS are already practice-oriented and which need restructuring.
Any project that enters scope between now and 2031 will face a transition question. Deciding the starting catalogue once, per project type, is cheaper than deciding it case by case and discovering inconsistency at audit.
Ask your ISMS tool vendor three questions in writing: does the product ingest the BSI's OSCAL catalogues natively, does it represent Praktiken as first-class objects, and does it support the BSI's own cross-references to ISO 27001 and NIS2. If any answer is on the roadmap, ask for a date.
Certification bodies working through the transition know which certifications they will still carry out under the 2023 Compendium and when they expect clients to move. Their calendar matters more than yours for audit planning.
The early-adopter phase runs from the first quarter to 31 December 2027. Training for Grundschutz++ consultants and audit team leaders also opens in the first quarter, with a separate path for those already certified under IT-Grundschutz. Organisations that start now learn the methodology at the same time as the auditors who will later apply it.
The BSI has spread the transition over five years on purpose, from the methodology's publication in October 2026 to the end of certification under the existing IT-Grundschutz in November 2031. Organisations that plan to that horizon and start with one Informationsverbund in 2027 carry less risk than those who squeeze the move into their last certification year.
07 / How OrbisGraph fits in
OrbisGraph is Pinnipedia's compliance platform. Under the hood, its catalogue layer is implemented as a knowledge graph: Bausteine, requirements, target objects, measures, evidence, sign-off states and cross-framework references held as typed nodes and edges. OrbisGraph does not hold a copy of the Compendium as a PDF and parse it for queries. OSCAL documents can be mapped into the underlying graph directly, because OSCAL itself is a graph-shaped schema underneath the JSON.
For the transition to Grundschutz++ this means: your Sicherheitskonzept exists in OrbisGraph as a graph. In the transition pilot we load the Grundschutz++ catalogue next to it as a second graph and build the comparison with OrbisGraph's support. It shows, per requirement and Zielobjekt, what carries over, what must be re-assessed and what awaits a clarification from the BSI. Every result leads back to a passage in your documents and a passage in the catalogue, which the BSI publishes through its GitHub repository.
The cross-references built into Grundschutz++ (to ISO 27001:2022 and NIS2) fit the same model, as edges in the same graph. ISO 27001 on the same graph is on our roadmap for 2027.
OrbisGraph is a tool, not a certification body. Certificates are issued by accredited certification bodies, not by the platform. We have worked with the draft versions of Grundschutz++ since 2025 and applied for inclusion in the BSI list of IT-Grundschutz tools in September 2026. What the transition means for your Informationsverbund is shown by the transition pilot, on your own documents.
08 / FAQ
IT-Grundschutz in its 2023 edition is a PDF Compendium of 111 Bausteine and roughly 6,567 requirements. Grundschutz++ follows the same core steps, rebuilt around 19 process-oriented Praktiken, roughly 985 requirements, two Schutzbedarf levels instead of three, and an OSCAL/JSON catalogue published on GitHub, as of the 2025 preview. Methodology intent is preserved; catalogue form and level of detail are modernised.
No. A Sicherheitskonzept based on the 2023 Compendium stays certifiable until 30 November 2031. When you move, you do not start from a blank page: part of your assessment carries over, part must be re-assessed, part awaits clarification from the BSI. Your target objects and evidence remain the foundation.
For certification, on 30 November 2031, when certification under the existing IT-Grundschutz ends, five years after the methodology is published. Until then you can choose: Grundschutz++ is certifiable from 1 January 2027. Existing certificates keep their term.
The period in which the first applicable version of the methodology is used in practice: from the first quarter to 31 December 2027. What that means for your planning is in section 06.
Yes. The Grundschutz++ transition pilot is a fixed-price proof of concept that tests the transition on one Informationsverbund in twelve weeks. Your expert decides what stands. It ends with a decision memo for your leadership: transition with or without a tool change, timeline to re-certification. Orders from January 2027. See the transition pilot
OSCAL (Open Security Controls Assessment Language) is an open standard maintained by NIST for representing security catalogues, profiles, system security plans, and assessment results as machine-readable documents in JSON or XML. The BSI adopted it because it gives Grundschutz++ a format that ISMS tools can ingest directly, supports automated target-actual comparisons against live system data, and enables interoperable cross-references to other frameworks (ISO 27001, NIS2).
Existing certifications issued under the 2023 Compendium remain valid until the end of their term. From 2027, audits can be conducted against either standard. Re-certifications and new certifications later in the transition will increasingly be conducted against Grundschutz++. Accredited certification bodies are the authoritative source on what they will and will not certify; talk to yours early.
Tool readiness varies. The meaningful question is not whether the tool mentions Grundschutz++ but whether the tool ingests OSCAL catalogues natively, represents Praktiken as first-class objects, and speaks the BSI's cross-references to ISO 27001 and NIS2. Those are the three concrete questions worth asking any vendor in writing.
They are being rebuilt as Blaupausen inside Grundschutz++. Structurally analogous to the old profiles, procedurally different: Blaupausen are machine-readable configurations that tools apply to target objects, rather than document templates that teams adapt by hand. Early Blaupausen cover sectors already published by the BSI, including e-file, 5G infrastructure, and municipal utilities; more arrive incrementally in the Stand-der-Technik-Bibliothek.
The BSI's own publications are authoritative. The two primary surfaces are the Grundschutz++ pages on bsi.bund.de and the public GitHub repository BSI-Bund/Stand-der-Technik-Bibliothek. The Grundschutz++ methodology, published on 27 October 2026, is the single best orientation document for teams starting from zero.
A scoping call takes 45 minutes, online. We look at which Informationsverbund fits, which data route is possible and who on your side can act as the expert. We reply by email within three working days with proposed times.