Is Baseline Protection++ 2025 Coming?

Is Grundschutz++ coming in 2025?

What is Grundschutz++ and why is it important?

The IT security landscape is evolving at a rapid pace. Cyberattacks are becoming increasingly sophisticated, companies are advancing their digitalization, and regulatory requirements such as the NIS2 directive and the planned Grundschutz++ are continuously increasing. It is in this dynamic environment that Grundschutz++ is set to meet the rising demands for IT security.

As an advancement of the proven IT Grundschutz of the Federal Office for Information Security (BSI), Grundschutz++ aims to help companies design their IT security measures more efficiently and practically. But when will Basic Protection++ really arrive? And what makes it so special?

What is IT Grundschutz++?

Grundschutz++ is an enhancement of the existing IT Grundschutz of the BSI. It was designed to make the implementation of IT security measures easier, more modern, and more efficient for companies of all sizes. The goal remains the same: to achieve a high level of security in information technology while reducing complexity for users.

Why is Grundschutz++ needed?

Digitalization and new threats such as ransomware or supply chain attacks pose ever greater challenges for companies. While the existing IT Grundschutz provides a solid foundation, it is often perceived as too complex and inflexible. Small and medium-sized enterprises (SMEs), in particular, struggle with the high documentation burden if they want to implement IT Grundschutz without an ISMS tool. Fuentis AG is an official partner of the BSI.

What makes Grundschutz++ special?

A key aspect of Grundschutz++ is the departure from the previous documentation method. Instead of extensive Word documents and lists, Grundschutz++ relies on Excel spreadsheets, which allow security measures to be presented in a more structured and clear manner. However, this is the conventional implementation, which is significantly more complex and costly than using an ISMS tool. This change is intended to make IT security more accessible, especially for small and medium-sized enterprises (SMEs).

The key features of Grundschutz++ at a glance:

• Modernized content: Consideration of current challenges such as cloud security, IoT, and new threat scenarios of Industry 4.0.

• Practicality in focus: Grundschutz++ is intended to be not only secure but also practical. This has been a frequently expressed criticism of the existing IT Grundschutz from the BSI.

• Flexibility: The new structure allows for better representation of individual requirements and more targeted addressing of industry-specific risks.

An important step into the future

Grundschutz++ directly addresses the needs of modern companies that must assert themselves in a dynamic IT landscape. With new approaches and methods, it could help make IT security more accessible to organizations without compromising on quality. Whether these expectations will be met, however, will only become clear after its introduction.

Is Grundschutz++ really coming in 2025?

The introduction of Grundschutz++ has been anticipated for a long time. At the IT security trade fair it-sa 2024, the Federal Office for Information Security officially clarified that Grundschutz++ will not be introduced in 2025 but on January 1, 2026. This provides a clear deadline, giving companies and authorities time to prepare for the changes.

What does this mean for companies?

Even though Grundschutz++ will not be introduced until 2026, companies should use the time to familiarize themselves with the concepts of the current IT Grundschutz. The existing modules still provide a solid foundation for ensuring IT security. At the same time, companies should keep an eye on the BSI's developments to be able to switch to Grundschutz++ early.

What can companies do today?

Even though Grundschutz++ will only be introduced from January 1, 2026, companies can already take action to prepare and optimize their IT security measures. The current IT Grundschutz from the BSI continues to offer a proven foundation that can be used specifically to systematically strengthen information security.

Effectively using the current IT Grundschutz

A first important step is the consistent use of the existing IT Grundschutz modules. These cover a variety of security aspects and can be flexibly adapted to an individual company's requirements. At the same time, companies can build or improve an Information Security Management System (ISMS) based on the ISO 27001 standard or the BSI's recommendations. Such an ISMS not only creates a solid foundation for the current IT security strategy but also facilitates the later transition to Grundschutz++. Regular audits also help to identify and address vulnerabilities early before they become a risk.

Training employees and optimizing processes

Moreover, companies should invest in training their employees. Training sessions focused on the current IT Grundschutz prepare teams to implement the existing measures efficiently and to better understand the concepts of the future Grundschutz++. These measures not only strengthen the IT security competence of employees but also foster a culture of awareness towards potential security risks. At the same time, companies should review their internal processes for efficiency and flexibility to ensure a smooth transition to the new methods of Grundschutz++ later on.

A step into the future of IT security

From January 1, 2026, Grundschutz++ offers a practical concept for the increasing demands on IT security. Companies can already prepare by using the current IT Grundschutz and building an ISMS. While an ISMS can also be implemented with Word or Excel files, it is often time and cost-intensive. However, implementation is much more efficient and resource-saving with a specialized ISMS tool, facilitating the transition to Grundschutz++ and supporting a future-proof security strategy.