← Back to news 28.10.2026

Grundschutz++ now has its standard: BSI 300-1

On 26 October, the BSI published the methodology for Grundschutz++ as BSI Standard 300-1. Process-oriented, with a freely selectable risk method subject to minimum criteria, and with all requirements in machine-readable form. An ISMS under Grundschutz++ becomes certifiable from 2027. What this means for work with the Kompendium today and what makes sense now.

For months there has been the Grundschutz++ user catalogue, but no binding description of how to apply it. On 26 October, the BSI closed that gap: the methodology for Grundschutz++ has been published as BSI Standard 300-1, just in time for it-sa.

What the BSI announces

According to the press release, the standard describes how to implement a continuous security process and differs from the existing IT-Grundschutz above all in its process-oriented approach, which aims to secure the central business processes of an organisation first. Three points stand out:

Business processes first. The starting point is not an inventory of all target objects but the question of which processes carry the organisation.
Your own risk method. The method for risk identification, assessment and treatment can be chosen freely, subject to so-called minimum criteria. Anyone already working with ISO 27005 or their own method does not have to rebuild, but has to show that the minimum criteria are met.
Machine-readable. All requirements are now available in a machine-readable format. The user catalogue is published as an OSCAL file, no longer only as a PDF.

And on certification: an ISMS implemented under Grundschutz++ is certifiable from 2027 and compatible with ISO/IEC 27001. Before that comes an early adopter phase in which development is to continue with the community.

What this means today

Anyone currently working with the IT-Grundschutz Kompendium, edition 2023, does not have to throw anything away tomorrow. But three things are worth doing now:

Read the standard before switching. 300-1 is a new approach, not a new form. Anyone who just renames modules misses the process-oriented approach.
Check your own risk method against the minimum criteria. This is where it shows how much of the existing ISMS carries over.
Expect moving numbers. The user catalogue is updated continuously, requirement identifiers have still shifted in recent months, and the official mapping from the 2023 Kompendium to Grundschutz++ is not complete. Anyone mapping today should record the catalogue version.

For our own articles, we are changing the order from today: Grundschutz++ first, with the catalogue version, and the 2023 Kompendium as "previously" after it.

How isidaten handles this

isidaten works with catalogues in OSCAL format and already ships the Grundschutz++ user catalogue, currently as of 24 September 2026. Automatic evidence, for example on patch deadlines or data backup, already refers to the matching Grundschutz++ requirements. When the BSI updates the catalogue, the new version is imported instead of retyping a PDF.

The test question

Do you know which of your business processes would have to be secured first under 300-1, and is that written down anywhere other than in management's head?

If not, that is the first step, regardless of whether and when you switch.