GSTOOL Successor: Which Software Replaces the GSTOOL?

The BSI stopped selling the GSTOOL on 31 December 2014 and ended support at the end of 2016. It does not name a GSTOOL successor; instead, it lists more than 60 tool offerings (as of October 2026) from licensees without checking them. Good successors cover BSI 200-2 and 200-3 and manage catalogues with versioning so they are ready for IT-Grundschutz++, the fuentis Suite being one example.

What was the GSTOOL and why does it need a successor?

The GSTOOL was the BSI's software that public authorities and companies used to create and maintain security concepts based on IT-Grundschutz. According to a now archived BSI page, sales ended on 31 December 2014, with support ending in late 2016 according to the BSI page on performance characteristics. Since then, users have needed a different tool for new modules and the modernised IT-Grundschutz.

The GSTOOL therefore dates from before the modernisation of IT-Grundschutz in 2017. Existing licence holders were allowed to buy additional licences after sales ended, and the BSI provided an export tool for data migration.

There is no official successor product. Instead, the BSI refers to a list of tool offerings from vendors with a licence agreement and makes clear that naming other companies' IT-Grundschutz tools is purely a listing. The BSI does not check program quality or correct implementation.

The methodology shows why switching is now unavoidable. In 2017, the modernised IT-Grundschutz with BSI Standards 200-1 to 200-3 replaced the 100 series. According to the BSI migration guide, certification applications based on 100-2 were only possible until 30 September 2018, while the 15th supplement of the catalogues remained usable until 30 September 2021. A GSTOOL dataset thus reflects a methodology that no audit has been able to rely on since 2021.

And the next change is coming: From 1 January 2027, according to the BSI's Grundschutz++ milestone plan, applications for certification on the basis of Grundschutz++ can be submitted.

What does an IT-Grundschutz tool need to do today as a GSTOOL successor?

A GSTOOL successor must fully map the IT-Grundschutz methodology under BSI Standard 200-2: structure analysis, protection requirements assessment, modelling, IT-Grundschutz Check and risk analysis under BSI Standard 200-3. On top of that come multi-tenancy, audit reports, an import for legacy data and the ability to load new BSI catalogues such as Grundschutz++. The BSI itself has published a list of criteria for this.

The performance characteristics for software tools were drawn up with the end of GSTOOL support in mind. They name protection requirements assessment, modelling, risk analysis, reporting and audit support, and on the technical side multi-tenancy, field-level history tracking and an import function for GSTOOL datasets. Terms such as "basic security check", however, still come from the world of BSI 100-2.

For 2026, fuentis adds one criterion based on its own assessment: catalogues must be available as versioned data. The current version is the 2023 Edition of the IT-Grundschutz Compendium with 111 modules; the next catalogue arrives with Grundschutz++.

If you need the reports for a certificate, you should know the difference between IT-Grundschutz and ISO 27001. Beyond Grundschutz, a separate article shows which functions an ISMS tool should cover in day-to-day operation.

Which Grundschutz tools are possible GSTOOL successors?

The BSI list of IT-Grundschutz tools contains more than 60 tool offerings (as of October 2026) from vendors with a licence agreement. Four options with documented Grundschutz support are the fuentis Suite, the HiScout GRC Suite, verinice and DocSetMinder® ONE. They differ mainly in operating model, legacy data import and preparation for Grundschutz++.

Every tool that appears on the BSI list and whose Grundschutz functions are described on the vendor's website has been included. This is not a ranking. For a broader comparison, see The 5 best ISMS tools from Germany.

Sources: vendor websites, BSI list of tool providers. As of: 21 October 2026. "n/s" means not specified on the vendor's website. Note: fuentis AG, publisher of this blog, is the provider of the fuentis Suite.

fuentis Suite

BSI IT-Grundschutz with structure analysis, protection requirements assessment, security checks and risk analysis is included in all plans, including free/Basic, which is free of charge for 12 months. From the Standard plan upwards, the Catalog Manager manages modules and requirements with versioning and a change log.

Operation as SaaS with a separate database per tenant, as a private cloud or on-premise (Enterprise), developed and hosted in Germany. Data from third-party ISMS tools can be imported if a standard interface (API) is available. Find out more under Implementing IT-Grundschutz with the fuentis Suite.

HiScout GRC Suite

According to HiScout, the current BSI Grundschutz catalogues are integrated into the HiScout Grundschutz module, and the risk analysis meets the requirements of BSI Standard 200-3. Data from GSTOOL, Excel or a CMDB can be imported, and HiScout runs on-premise or as SaaS. For federal authorities, ITZBund provides the standard solution ZeDIS, which is based on it. On Grundschutz++, the vendor states that HiScout has been involved from the very beginning.

verinice

verinice comes from SerNet GmbH and is released under an open source licence. SerNet offers the classic single-user version as a subscription with a term of 1 to 3 years; according to the vendor, it will only be sold until 31 December 2026 and supported until 31 December 2027. Only verinice.EVAL is free, without import and export functions. Cloud and on-premise versions of the new generation are subject to a fee. According to the vendor, basic, standard and core protection, module modelling, IT-Grundschutz Check and risk analysis are covered. For the switch from GSTOOL, the classic verinice client reads all data directly from the GSTOOL database, including user-defined fields; for the new generation, SerNet only announces data migration for upcoming releases.

DocSetMinder ONE

According to the vendor, DocSetMinder ONE from Allgeier CyRis combines BSI IT-Grundschutz, ISO 27001, BCM under BSI 200-4 and the EU GDPR. Special modules and templates are available for IT-Grundschutz. The product page gives no details on import or Grundschutz++, so ask about these in the demo.

How future-proof is your tool with a view to IT-Grundschutz++?

With Grundschutz++, the BSI is replacing the IT-Grundschutz Compendium with a machine-readable user catalogue. From 1 January 2027, according to the BSI, applications for certification on the basis of Grundschutz++ can be submitted, while the existing IT-Grundschutz remains certifiable until 30 November 2031. A new tool should therefore manage both catalogues in parallel.

So why not simply wait? According to the BSI's milestone plan, as of October 2026, the methodology is due to be published at it-sa 2026 (27 October 2026), followed by an early adopter phase in 2027. Anyone still working with GSTOOL data or Excel will then be two methodology generations behind. Even at the last changeover, the IT-Grundschutz Check had to be carried out completely anew, according to the BSI migration guide.

The user catalogue is available as an OSCAL document in the BSI's GitHub repository and, in its current version, comprises 1,000 requirements. What changes in terms of methodology is summarised in the article IT-Grundschutz++ at a glance: what's new and the timeline.

„

If you are moving away from the GSTOOL or from Excel today, the question is not whether a tool maps the 2023 Edition of the Compendium. Many can do that. What matters is whether it manages requirements as data and can load new catalogues with versioning. With Grundschutz++, the BSI is moving from the Compendium to a machine-readable user catalogue, and that is exactly where future-proof parts ways with outdated.

Srdan Manasijevic, CEO fuentis

The fuentis Suite already maps practices, target object categories and blueprints in a structured way today and, by its own assessment, covers all Grundschutz++ requirements published so far. The page Preparing for Grundschutz++ with the fuentis Suite shows how to plan the switch.

How do you migrate GSTOOL or Excel data step by step?

First export your legacy data, then carry over the structure analysis and protection requirements, remodel according to the current Compendium and carry out the IT-Grundschutz Check completely anew. The BSI does not provide for a 1:1 transfer of old safeguards. For target objects with high protection requirements, a risk analysis under BSI Standard 200-3 follows.

The BSI's guide to migrating security concepts serves as the reference.

1. Back up legacy data. For the GSTOOL, the BSI provided an export tool that output security concepts as an XML file. According to the vendor, verinice reads the GSTOOL database directly, and HiScout names an import for GSTOOL and Excel data. Normalise Excel lists beforehand to target object, protection requirement, module and implementation status.
2. Carry over the structure analysis. Existing results remain usable, but under BSI Standard 200-2 business processes move more to the fore. Add any missing processes.
3. Review protection requirements. The categories normal, high and very high remain; check the inheritance again. The ISMS profiles of the fuentis Suite provide preconfigured protection requirement templates for this, but do not replace the structure analysis.
4. Remodel. The 2023 Edition of the IT-Grundschutz Compendium comprises 111 modules, 10 of them new. Check each one for applicability and justify both selection and non-selection.
5. Carry out the IT-Grundschutz Check anew. According to the BSI, the shift from prescribed safeguards to requirements makes it necessary to carry out the IT-Grundschutz Check completely anew. The BSI migration tables help, but according to the BSI there is often no 1:1 relationship between (new) requirements and (previous) safeguards. A pure data transfer does not produce an audit-ready check.
6. Risk analysis under BSI Standard 200-3. It is required for target objects with high or very high protection requirements, without a suitable module or in atypical deployment scenarios.

The BSI considers a push-button conversion the wrong approach: according to the BSI, an ISMS is a process, not a product. Use the migration as an opportunity to review your ISMS. Structured target objects, justified modelling and documented safeguards per requirement will also make the later move to the Grundschutz++ user catalogue easier.

Where should you start this week?

Start by taking stock: GSTOOL database or Excel files, edition used, date of the last check. Then put together a shortlist from the BSI list of tool offerings. Check each offering against three criteria: methodology under BSI 200-2 and 200-3, a path for your legacy data, catalogues managed with versioning. In the demo, test with your own information domain rather than with slides.

To try it out, free/Basic is free of charge for 12 months from contract start: view fuentis Suite free/Basic or book a demo.

Frequently asked questions

Is there an official GSTOOL alternative from the BSI?

No. The BSI has not named a successor product but refers to a list of tool offerings with a licence agreement, currently more than 60 entries. According to the BSI, this is purely a listing; it does not check program quality or correct implementation. For federal authorities, ITZBund provides the standard solution ZeDIS, according to the vendor HiScout. That is not a BSI recommendation.

Can I still use the GSTOOL today?

The BSI has not supported it since the end of 2016, as it confirms on its page on performance characteristics for software tools. It dates from the era of the IT-Grundschutz Catalogues, whose 15th supplement, according to the BSI migration guide, was only usable until 30 September 2021. For an audit under current IT-Grundschutz, you need a tool that works with the Compendium.

Can GSTOOL data be transferred to a new tool?

Yes, with limitations. The BSI provided an export tool that output security concepts as an XML file, and vendors such as verinice and HiScout name a GSTOOL import. According to the BSI migration guide, you still have to carry out the IT-Grundschutz Check completely anew, because old safeguards and new requirements often do not match 1:1.

Should I wait for Grundschutz++ before switching tools?

No. According to the BSI's milestone plan, the existing IT-Grundschutz remains certifiable until 30 November 2031. From 1 January 2027, according to the BSI, applications for certification on the basis of Grundschutz++ can be submitted, and an early adopter phase also runs until the end of 2027. Choose a tool that manages catalogues with versioning and can map both worlds in parallel.