BSI Standard 300-1: what the Grundschutz++ methodology requires and how to prepare

Germany's Federal Office for Information Security (BSI) has published the methodology for Grundschutz++ as BSI Standard 300-1. Version 1.0 is dated 20 October 2026; the BSI announced it on 26 October and, according to its milestone plan, presented it at it-sa in Nuremberg on 27 October. On 42 pages, the standard describes how an organisation builds and develops an information security management system (ISMS) under Grundschutz++. The requirements themselves are published in machine-readable form in the Grundschutz++ user catalogue of the BSI state-of-the-art library (Stand-der-Technik-Bibliothek).

The BSI addresses this first version primarily to "early adopters", meaning experienced organisations that want to move early. The methodology was tested beforehand with selected pilot organisations. From 1 January 2027, organisations can apply for ISO 27001 certification on the basis of Grundschutz++. This article explains what 300-1 actually requires, where gaps remain and which steps are worth taking now.

Context: what the standard covers

Five process steps in the PDCA cycle

300-1 divides the ISMS into five process steps that are repeated along the PDCA cycle: assessment and planning, requirements analysis, implementation, monitoring and continual improvement.

In the first step, the organisation determines its context, involves compliance management, defines the scope, analyses interested parties and identifies its business processes. It also sets up the information security policy, the roles of the security organisation, a document control procedure and the framework for risk assessment. According to the standard, top management is responsible for the ISMS and cannot delegate this responsibility. Among other things, it approves the scope, the protection needs of the business processes, the order in which they are addressed, the resources and the policy.

For the first two process steps, the standard names the corresponding clauses of DIN EN ISO/IEC 27001; according to the BSI, the methodology requirements cover clauses 4 to 10 of the standard. The BSI describes an ISMS built under Grundschutz++ as compatible with ISO/IEC 27001.

The business process comes first

Protection needs are determined per business process, with regard to the confidentiality, integrity and availability of the information processed in it. There are only two categories: "normal", where the impact is limited and manageable, and "high", where it can be considerable. Organisations may define additional categories of their own, but must map them to these two. For a certifiable ISMS, the lowest category must always meet the state of the art.

For a first implementation, the standard recommends starting with the most important business process in the highest protection category. The remaining business processes in scope must then be examined step by step. An ISMS therefore does not have to begin with a complete model of the whole organisation.

Documentation also depends on protection needs. For normal protection needs, the standard only requires the dependencies between applications and IT systems and between IT systems and rooms. Mapping assets to the business process, including their essential dependencies, is only required for high protection needs. Existing CMDBs, asset registers, network diagrams or service maps may be used.

From asset to requirements package

Assets are mapped to target object categories. Annex 1 of the standard defines 39 categories, from sites, users, networks and IT systems to applications with subcategories such as directory services or web applications; the standard places cloud services under outsourcing. Parent categories always apply as well. The requirements follow from the assigned categories.

The individual requirements package has three parts: methodology requirements, which apply to every information domain; requirements without a target object category, which must always be included; and the requirements of the assigned categories. Blueprints can be added, that is, ready-made catalogues for specific scenarios with predefined parameters, as well as own additions, for example from compliance management. According to the standard, blueprints may be mandatory for certain organisations.

Many requirements contain parameters such as "regularly". The organisation specifies them when or after it builds the package. The standard explicitly notes that such parameters can also be used for automated checks.

Status and modal verbs

For each requirement in the package, the implementation status is checked in full. It is "met", "not met" or "not applicable"; any non-applicability has to be justified. The standard does not provide for "partially met".

What happens when a requirement is not met depends on its modal verb. The catalogue uses the German keywords MUSS (must), SOLLTE (should) and KANN (may):

• MUSS (must): Measures to meet the requirement have to be defined. A risk assessment does not replace compliance, and neither an exception nor risk acceptance is possible.
• SOLLTE (should): The gap is classified as temporary or permanent. Temporary means compliance is planned; the gap must then be soundly justified, and the remaining risk until then goes to top management (sections 2.11 and 4.1.1). Permanent means the requirement will not be met for the foreseeable future; a risk assessment is then required and the residual risk goes to top management for approval. If permanent gaps accumulate, the standard warns that the state of the art may be missed overall and that a certification audit could find a significant deviation.
• KANN (may): Requirements at the security level "elevated" are optional. They serve as a pool of additional measures for the risk assessment.

Risk assessment: fewer mandatory cases, fixed minimum criteria

The user catalogue is based on a general risk assessment carried out by the BSI. For normal protection needs, organisations therefore do not need an own risk assessment. It is mandatory in three cases: when a business process has high protection needs for at least one security objective, when a relevant asset is not sufficiently covered by the target object categories, and when an applicable SOLLTE requirement is permanently not met.

The method can be chosen freely; ISO/IEC 27005 and ISO 31000 are given as examples. It must, however, meet the 35 binding minimum criteria in Annex 3. These include a defined risk appetite, risk acceptance criteria, a risk owner for every risk, minimum entries in the risk register, approval of residual risks by top management, a time limit for temporarily accepted risks and a review at least once a year. The 47 elementary threats G 0.1 to G 0.47 serve as a starting point; the technical and organisational requirements in the catalogue carry the identifier of the threat they counter.

Automated checks as evidence

To determine implementation status, the standard lists methods ranging from interviews and document reviews to automated configuration checks and technical scans. For automated checks, the tool used, the time of the check and the result must be documented; if the tool produces a test report, it has to be linked to the measure and the requirement. The machine-readable catalogue in OSCAL/JSON format makes this possible. According to the BSI, the state-of-the-art library that contains it replaces the IT-Grundschutz Compendium. The build of 22 October 2026 of the user catalogue contains 1,000 requirements in 20 practices (our own count on 28 October 2026). The library also contains mapping tables from ISO/IEC 27001:2022 Annex A and from the 2023 IT-Grundschutz Compendium to Grundschutz++.

Who is affected and when

Timeline

The BSI maintains a milestone plan that it updates continuously. As of October 2026, it provides for the following:

• 30 November 2026: training concepts for GS++ practitioners and GS++ consultants
• December 2026: worked example based on a fictitious authority
• 1 January 2027: applications for ISO 27001 certification on the basis of Grundschutz++ open, as do applications for personal certification as GS++ consultant and GS++ audit team leader
• Q1 2027: start of the early adopter phase and upskilling for consultants and audit team leaders already certified for IT-Grundschutz
• 26 February and 31 March 2027: concept for performance measurement and performance indicators for each methodology requirement
• 31 December 2027: end of the early adopter phase
• 30 November 2031: end of certification under classic IT-Grundschutz

Until the end of November 2031, organisations can therefore choose whether to certify under classic IT-Grundschutz or under Grundschutz++.

Federal administration

For bodies of the German federal administration, Section 44(1) of the BSI Act (BSIG) refers to minimum requirements derived from the BSI standards, IT-Grundschutz and the federal minimum standards, each in their current version. The Act required the BSI to modernise IT-Grundschutz by 1 January 2026. Under Section 44(2) BSIG, implementing these minimum requirements ensures compliance with the risk management duties under Section 30 BSIG, unless a more far-reaching EU implementing act applies. Under Section 44(1) BSIG, the BSI publishes the current versions on its website. We have not found an explicit statement in the BSI sources we reviewed on whether the 2023 Compendium, Grundschutz++ or both currently apply. Where a federal body is also an operator of critical facilities, the requirements of Section 30(9) and Section 31 BSIG take precedence in case of conflict.

Companies and NIS2 entities

Under Section 30(2) BSIG, the measures of important and essential entities should meet the state of the art and take relevant European and international standards into account. It does not prescribe a specific framework. Grundschutz++ is therefore one of several routes. Whether it suits a particular organisation depends on the individual case, for example on whether public sector clients expect evidence based on IT-Grundschutz.

Existing IT-Grundschutz ISMS

Organisations that already hold an ISO 27001 certificate on the basis of IT-Grundschutz do not have to switch immediately. In our view, there is a lot to be said for planning the switch with the next recertification cycle. Organisations that want to certify an ISMS in 2027 or later should, in our view, start directly under 300-1; otherwise a migration is likely before 2031.

300-1 itself mentions neither the standards 200-1 to 200-3 nor the previous approaches of basic, core and standard protection. The standard leaves open whether these variants continue under Grundschutz++.

What is still missing

The BSI is still delivering some parts. On performance evaluation of the ISMS, the standard itself states that uniform requirements are still pending and that organisations are free to design it until then; performance indicators are due in spring 2027 according to the milestone plan. The user catalogue also still differs from the standard as of 22 October 2026. It knows only "implemented" and "not implemented" as status values, while the standard has three. The catalogue also provides for removing irrelevant requirements from the package, whereas the standard makes all requirements without a target object category mandatory in the package and records non-applicability in the status. Anyone setting up templates or tools now should follow the standard.

Readiness: what you can prepare now

1. Decide on the framework and take it to top management. Decide whether you stay with classic IT-Grundschutz, work with ISO 27001 without an IT-Grundschutz basis or move to Grundschutz++, and by when. With an existing certificate, the timeline should follow the recertification date. The decision belongs to top management because it approves scope and resources.
2. Record your business processes. Where no process map exists, Annex 2 accepts a simple table with identifier, name, responsible unit, short description and key applications. Determine the protection needs per process and choose the process you start with.
3. Check your risk method against the minimum criteria. Whether you use BSI Standard 200-3, ISO/IEC 27005 or your own method: compare procedures, roles, criteria and risk register with the 35 criteria in Annex 3. In our experience, gaps are often found in risk appetite, acceptance criteria and time limits for accepted risks.
4. Compare existing documentation using the mapping tables. If you run an ISMS based on the 2023 Compendium or on ISO 27001, the BSI mapping tables give a first view of which Grundschutz++ requirements are already covered and where new ones come in. The table for the 2023 Compendium still has draft status, the one for ISO 27001 covers only the Annex A controls.
5. Automate evidence where technically possible. Patch levels, multi-factor authentication, logging or hardening can often be evidenced from existing tools. Record which tool produced which result and when, and link it to the requirement.
6. Justify "not applicable" properly. Because requirements without a target object category always enter the package, every non-applicability needs a traceable justification. This can be checked in a later certification audit.

Personal certification

If you support Grundschutz++ professionally, keep an eye on the training dates. The BSI has announced the training concepts for GS++ practitioners and GS++ consultants for 30 November 2026; applications for certification as GS++ consultant open on 1 January 2027. Consultants and audit team leaders already certified for IT-Grundschutz will receive separate upskilling from the first quarter of 2027. The admission requirements for GS++ consultants have not yet been published. For the current IT-Grundschutz consultant certificate, the BSI requires basic training or self-study, a passed practitioner exam and advanced training and, among other things, several years of professional experience and leading IT-Grundschutz consulting projects totalling at least 40 person-days within the three years before the application.

Blackfort Technology supports ISMS based on BSI IT-Grundschutz from structuring to audit support and acts as external information security officer. For Grundschutz++, we help with the decision on when to switch, with comparing existing ISMS against 300-1, with a risk method that meets the minimum criteria and with building tool-based evidence. More at www.blackfort-tec.de.