Grundschutz++ consulting:
build, integrate, certify your ISMS
The new BSI methodology GS++ makes information security machine-readable, scalable, and automatable. We support you from planning to certification — and integrate GS++ seamlessly into your existing management system.
ISO 27001 & 42001 Lead Auditor
BSI IT-Grundschutz · AI Officer
The evolution of BSI IT-Grundschutz
GS++ is the consistent next step — built on extensive practical feedback, machine-readable in OSCAL, and applicable across industries.
Machine-readable (OSCAL)
Requirements in OSCAL format enable tool-assisted implementation and significantly reduce manual effort. Digitization of the entire ISMS documentation.
Modular layer architecture
BSI Standard 300-1 (methodology) + Grundschutz++ user catalogue in the State-of-the-Art Library with control and implementation layers and a planned assessment layer. In addition: a risk management catalogue, mappings and announced training concepts.
Iterative PDCA cycle
5 clear process steps that run cyclically. Start with your most important business process in the highest protection requirement category; further processes follow step by step.
Asset-based modeling
39 target object categories with inheritance hierarchy. Function-oriented mapping, 7 root nodes, 4 hierarchy levels. Automated processing supported.
Risk-driven & flexible
Risk assessment is applied where high protection needs, insufficiently covered assets or permanently unfulfilled SHOULD requirements exist. Methodology freely selectable within BSI guidance. Two levels: normal (SdT) and elevated.
Cross-sector & scalable
From small institutions (manual) and mid-sized (semi-automated) to large organizations (largely automated). Equally suitable for public administration and the private sector.
5 process steps in the PDCA cycle
Each step corresponds to a methodology practice and runs cyclically. It is the repeated cycles that build up the ISMS and develop it further.
Survey & planning
Context, compliance, policy, scope, roles, risk management
Requirements analysis
Information network, asset modeling, target object categories, requirements set
Implementation
Implementation status, prioritization, accountability, approvals
Monitoring
ISMS assessment, audit, compliance, monitoring, management review
Continuous improvement
Non-conformities, corrections, effectiveness review
Grundschutz++ & BSI Standard 300-1 in detail
Since October 2026, the Grundschutz++ methodology has been available as BSI Standard 300-1, version 1.0. Our deep dive explains the standard, the Grundschutz++ user catalogue and the milestone plan — with interactive tools for your planning.
- Process Steps Navigator: the five steps in the PDCA cycle with provisions, evidence and review questions
- Mapping Navigator: from ISO/IEC 27001 Annex A and the IT-Grundschutz Compendium to GS++ — based on the mappings in the State-of-the-Art Library (Compendium mapping still a draft)
- Readiness Check: self-assessment of your ISMS with prioritised next steps
- Transition at a glance: applications for certification to ISO 27001 based on GS++ from 1 January 2027, IT-Grundschutz certifiable until 30 November 2031
From gap analysis to certification
We accompany you through the entire GS++ lifecycle — pragmatic, efficient, and tailored to your size.
Gap analysis & readiness
- Inventory of the existing ISMS
- Delta analysis against GS++ requirements
- Maturity assessment
- Prioritized action plan
ISMS build per GS++
- Scope & information network
- Asset modeling & target object mapping
- Build the requirements set
- Establish security organization
Certification support
- Audit preparation & mock audits
- Documentation & evidence
- Support during the audit
- Remediation of findings
Migration from IT-Grundschutz
- Map existing modules to GS++
- Identify gaps & synergies
- Migration roadmap with quick wins
- Training of role holders
Risk management
- Methodology per BSI guidance
- Risk assessment for high protection needs
- Residual risk evaluation & treatment
- Integration into the implementation plan
Automation & tooling
- Building an OSCAL-based toolchain
- Automated requirements modeling
- Compliance-as-code approaches
- Integration into CMDB & ticketing systems
Embed GS++ seamlessly into your IMS
Grundschutz++ fits into your integrated management system as the ISMS building block. We support the combination with further ISO standards and regulatory requirements.
ISMS core standard. GS++ provides the requirements catalog, ISO 27001 the management framework. Certification to ISO 27001 based on GS++: applications from 1 January 2027.
AI management system. Integration of AI-specific requirements with GS++ for AI systems within the information network.
Privacy information management. Connect data protection requirements seamlessly with GS++ compliance obligations.
Cybersecurity for industrial automation. IEC 62443 adds requirements for OT-specific assets, for which GS++ provides no dedicated target object categories.
Leverage synergies in the IMS
- Joint risk assessment across all standards
- Unified document management & communication
- Combined internal audits save resources
- One management report for all systems
- GS++ practices cover organizational processes
Regulatory coverage
- NIS2 implementation act (NIS2UmsuCG)
- EU AI Act (Regulation 2024/1689)
- Cyber Resilience Act (CRA)
- GDPR & BDSG compliance
- KRITIS / BSI Act requirements
Grundschutz++ isn’t a future topic — it’s now
BSI Standard 300-1 has been published; the early adopter phase begins in the first quarter of 2027. Position yourself as an early adopter and gain a competitive edge with a future-proof ISMS.
- 15+ years experience in IT security & compliance
- Lead Auditor (ISO/IEC 27001 & ISO/IEC 42001)
- BSI IT-Grundschutz Practitioner · focus on Grundschutz++
- NIS2, DORA, CRA and AI Act expert
- AI Officer per EU AI regulation
- Wiz partner · OWASP GenAI Security
Start with Grundschutz++ now —
before everyone else wakes up
Machine-readable. Automatable. Certifiable from 1 January 2027.
Book a free initial conversation now and learn how GS++ transforms your ISMS.