What Is IT-Grundschutz++?

IT-Grundschutz++ is the next-generation modernization of the German BSI’s IT security framework. It provides a structured, practical way for organizations to identify threats, assess risks and implement effective security measures tailored to their needs.

Key Insights

• Digital transformation starting 2026: The methodology has been available as a pilot version since April 1, 2026 and is presented at it-sa on October 27, 2026; Grundschutz++ becomes certifiable on January 1, 2027. The previous PDF compendium is replaced by a machine-readable user catalogue in JSON format.
• Significant efficiency gains: An object-oriented structure and a CIA-based scoring system replace traditional protection categories.
• Practical transition: A multi-year period allows both versions to run in parallel. According to BSI, certification under the previous IT-Grundschutz ends on November 30, 2031.

Core Objectives of IT-Grundschutz++

Higher level of automation

Future modules will be published in machine-readable form, enabling:

• automation
• digital ISMS integrations
• seamless updates

Tools such as fuentis Suite 4 can leverage these features immediately.

Increased efficiency

Redundant structures are removed, documentation becomes leaner, and organizations can focus on their core operations.

Stronger practical orientation

Modules are easier to understand and apply, with only relevant practices required for each scenario.

Inspiration: WiBA (Path to Basic Protection)

The WiBA project supports municipalities by reducing complexity and effort:

• 111 → 67 modules
• practical checklists
• streamlined documentation
• complementary to Grundschutz profiles

What is WiBA?

WiBA helps municipalities assess their security posture without deep methodological knowledge – practical, accessible, efficient.

New Documentation Strategy

Grundschutz++ replaces narrative prose with structured, machine-readable documentation.

Core elements:

• JSON objects
• fixed sentence templates
• simplified ISMS integrations
• Git-based versioning
• structured documentation pyramid

The BSI plans to provide an official Git repository to support tool vendors such as fuentis.

More About IT-Grundschutz++

The new system enables continuous, data-driven security management instead of annual updates. A 5-level model allows scalable implementation across organizations of all sizes.

Automation & Simplified Documentation

Practical, action-oriented practices are now represented as JSON objects – easy to process in any system and align with DevOps workflows.

When Will It Launch?

According to the BSI milestone plan (as of September 2026), the timeline is:

• April 1 to August 31, 2026: Pilot phase of the methodology with partners from public administration and industry.
• October 27, 2026: Presentation of the methodology at it-sa in Nuremberg.
• January 1, 2027: Grundschutz++ becomes certifiable; ISO 27001 certifications based on Grundschutz++ are possible.
• November 30, 2031: End of certifiability under the previous IT-Grundschutz.

An extended transition period allows both standards to be used in parallel.

Conclusion

IT-Grundschutz++ modernizes the entire framework: more automation, better usability, lower overhead and flexible adaptation to evolving threats. It is suitable for SMEs, public institutions and critical infrastructure operators alike.

Grundschutz++ with fuentis Suite 4

As an official BSI license partner, fuentis enables fully digital, risk-based implementation of IT-Grundschutz – including the upcoming Grundschutz++.