Grundschutz++ is out, and version 1.0 says it is for early adopters

What was published, and on what date

The BSI has published BSI-Standard 300-1, "Methodik Grundschutz++". The date that matters is not the conference date: it is in the document's own change history, which records version 1.0 as of 20 October 2026, described as the initial publication of the first applicable version. The milestone plan had the standard presented at it-sa 2026 in Nuremberg on 27 October.

The BSI's Grundschutz++ page has moved to the present tense to match. It now says the BSI makes Grundschutz++ available for setting up an ISMS, and that BSI-Standard 300-1 describes the methodology. For eighteen months that page described a plan. It now describes a thing that exists.

Read the audience line before you plan around it

This is the sentence to take to a steering committee, and it is the BSI's own, in the introduction to the standard:

Version 1.0 is aimed primarily at early adopters — experienced institutions that want to implement early, and whose experience will feed the next version. The milestone plan says the same thing in calendar form: an early-adopter phase opens in the first quarter of 2027 and closes on 31 December 2027. Certification applications open on 1 January 2027, which is the start of that early-adopter year rather than general availability.

So "published" and "ready for your first ISMS" are not the same claim, and the owner is the one drawing the distinction. If you are an experienced German institution with a working ISMS and appetite, this is your window. If Grundschutz++ would be your first framework, the BSI has not asked you to be here yet.

Two protection-need categories, where there were three levels

The structural change most likely to break an existing spreadsheet is the smallest to state. Grundschutz++ sets two Schutzbedarfskategorien for business processes:

Normal and Hoch. An institution may define further categories of its own, but it has to map them back onto those two. Classic IT-Grundschutz worked with three requirement levels per Anforderung, and separately with three Vorgehensweisen — Basis-, Kern- and Standard-Absicherung. If your scoping documentation is built on three bands, the re-cut is to two, and the methodology is also now a single PDCA loop of five process steps rather than a choice of route: Erhebung und Planung, Anforderungsanalyse, Realisierung, Überwachung, kontinuierliche Verbesserung.

The requirements are a separate artefact, and they are machine-readable

The standard carries the methodology. The requirements come separately, as the Anwenderkatalog Grundschutz++, published as an OSCAL resolved catalog in the BSI's own public GitHub repository. We read the file rather than the announcement: 652 requirements, in 20 top-level groups and 140 subgroups, last modified 29 October 2026. Every one of the 652 carries its title, its normative statement and its guidance.

Two tags on each requirement do work that used to need a methodology decision. A security level — 518 are normal, 134 erhöht — and an effort level from 0 to 5. The groups are organised around management and operations rather than around technology: governance and compliance, structural modelling, implementation, improvement, monitoring and evaluation, risk management, information and assets, personnel, procurement, supplier management, change and testing, building management, and so on.

And one sentence on that page changes what the catalogue is for: as a further development of IT-Grundschutz, the Anwenderkatalog describes only requirements that do not target specific IT solutions. The 111 Bausteine of the Kompendium included product- and technology-specific modules. This catalogue does not. If your evidence pack leans on those modules, that part has no successor here.

Temper the tooling expectation, though. The BSI's own page still describes the Stand der Technik-Bibliothek — the platform the catalogue belongs to, which the BSI says supersedes the Kompendium — as being in a pilot phase that will become publicly available once the pilot concludes. The catalogue is published; the platform around it is not finished.

The licence, and what it does not unlock

This matters to anyone who reproduces requirement text, ourselves included. The BSI repository is licensed CC BY-SA 4.0 — named in its README and carried in full in its LICENSE file. Grundschutz++ requirement wording can therefore be reproduced, commercially included, with attribution and share-alike. The catalogue's own metadata calls Grundschutz++ a freely available approach.

Now the part a quick reader will get wrong. This is not a retroactive opening of the IT-Grundschutz-Kompendium. The Kompendium Edition 2023 is a different document under different terms: commercial use of IT-Grundschutz content still requires a licensing agreement with the BSI first. That is why this site publishes the Kompendium's 2,124 Anforderungen as structure — layers, modules, counts, levels — without their wording, and that has not changed today. Two corpora, two licences.

What has not changed

Edition 2023 is still the current edition of the Kompendium, and it is still certifiable. The milestone plan dates the end of certifiability under existing IT-Grundschutz to 30 November 2031, five years out. An ISMS built on Edition 2023 is on the current edition, not a superseded one, and nothing published on 20 October obliges you to move.

Nor does anything here create a NIS2 obligation. IT-Grundschutz is formally binding only on the German federal administration under the NIS2UmsuCG; for other German essential and important entities it is the benchmark auditors and insurers reach for, not a legal requirement. No German NIS2 duty requires Grundschutz++, and a framework is never a compliance: the obligations are owed under the national law.

One thing we are deliberately not asserting: that BSI-Standards 200-1 to 200-4 are superseded. The 300-1 does not mention them once. Until the BSI says what becomes of them, neither will we.

What to do this month

Download the standard and read section 1 and the Schutzbedarfsfeststellung — about twenty minutes — and decide one thing only: whether you are an early adopter in the BSI's sense. That answer sets whether 1 January 2027 is a date on your plan or a date you watch.

If it is on your plan, two near dates follow: training concepts for Grundschutz++ practitioners and consultants are due on 30 November 2026, and a worked example built on a fictional federal agency, BDIT, in December 2026. Conversion training for already-certified IT-Grundschutz consultants and audit team leaders comes in the first quarter of 2027. If it is not on your plan, the only date you need is 30 November 2031, and you have time to let version 1.1 find the sharp edges.