BSI IT-Grundschutz

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-11-30 in 21 days Planned publication of training concepts for Grundschutz++ practitioners and consultants
2. 2027-01-01 in 53 days Planned start of applications for ISO 27001 certification on the basis of Grundschutz++
3. 2027-12-31 in 417 days Planned end of the early-adopter phase for the first applicable Grundschutz++ version
4. 2031-11-30 in 1847 days Planned end of certifiability for IT-Grundschutz, five years after Grundschutz++ is published
5. 2026-10-27 Planned publication of the Grundschutz++ methodology at it-sa 2026 in Nuremberg
6. 2026-08-31 Pilot phase of the Grundschutz++ methodology ends
7. 2026-04-01 Pilot phase of the Grundschutz++ methodology starts with public and private partners
8. 2023-02-01 IT-Grundschutz-Kompendium Edition 2023 becomes available, replacing Edition 2022

1. 2026-03-16
   Leitfaden zur Methodik Grundschutz++ (pilot version, March 2026) Draft

   Guide to the methodology of Grundschutz++, the successor to IT-Grundschutz: a process-oriented method along the PDCA cycle, with requirements as machine-readable rules in the BSI's state-of-the-art library. source

   More

   • That library, which holds the user catalogue, replaces the IT-Grundschutz-Kompendium, and flexible performance figures replace the basic, standard and high protection levels.
   • BSI piloted the method from 1 April to 31 August 2026 and plans to publish it for use at it-sa 2026 on 27 October 2026.
2. 2023-02-01
   IT-Grundschutz-Kompendium Edition 2023 RevisionCurrent

   The current edition of the module compendium, available since 1 February 2023; it replaced Edition 2022. source

   More

   • BSI keeps the current IT-Grundschutz maintained and applicable during a multi-year transition to Grundschutz++.
3. 2017-11-15
   BSI-Standard 200-1 Major version

   The modernised standard defining general requirements for an information security management system, compatible with ISO 27001 and aligned with BSI-Standard 200-2. source

4. —
   BSI-Standard 200-4 version 1.0 Major version

   The modernised business continuity management standard, replacing BSI-Standard 100-4 and aligned with ISO 22301:2019. source

   More

   • BSI states that no certification against the standard is planned for now.

IT-Grundschutz is a method and recommendation for any institution; BSI minimum standards bind federal bodies, and Grundschutz++ will replace it after a multi-year transition.

Audience

A method, guide, recommendation and self-help for authorities, companies and institutions that want to secure their data, systems and information. source

Federal bodies

BSI minimum standards define binding security requirements for federal institutions and are linked to the Grundschutz requirements. source

Building blocks

BSI-Standards 200-1 to 200-4 cover the ISMS, the IT-Grundschutz method (basic, core and standard protection), risk management and business continuity; the Kompendium holds the modules in ten layers. source source

Transition

Grundschutz++ is to replace IT-Grundschutz; until then IT-Grundschutz remains applicable during a multi-year transition, and both are compatible with ISO 27001. source

Institutions can obtain an ISO 27001 certificate on the basis of IT-Grundschutz from the BSI, after an audit by a BSI-certified auditor, or a testat for basic protection.

ISO 27001 on IT-Grundschutz

Possible for standard and core protection. A BSI-certified ISO 27001 Grundschutz auditor reviews the documents, audits on site and reports; the BSI decides on the certificate. source

Basic protection testat

Implementation of basic protection can be attested by a testat, issued only by an auditor certified by the BSI. source

Drafts

Modules in community or final draft status are not relevant for certification. source

BSI minimum standards bind federal bodies; BaFin's BAIT name IT-Grundschutz among the established standards banks must apply.

Minimum standards

Minimum standards set a uniform minimum security level in the federal administration and define binding requirements for federal institutions. source

Referenced by BaFin

BaFin's BAIT name IT-Grundschutz among the generally established standards banks must apply over and above the circular. source

1. Standard IT-Grundschutz-Kompendium Edition 2023 (BSI)
2. Standard BSI-Standards 200-1 to 200-4
3. Guidance Grundschutz++ - methodology and milestone plan (BSI)
4. Guidance Leitfaden zur Methodik Grundschutz++ (PDF, March 2026)
5. Guidance ISO 27001 certification on the basis of IT-Grundschutz (BSI)

1. ISO 27001

   The international ISMS standard; certification on the basis of IT-Grundschutz is an ISO 27001 certificate issued by the BSI with concrete Grundschutz requirements on top.

2. Germany C5

   BSI's criteria catalogue specifically for cloud services, audited by public auditors rather than certified by the BSI.

3. Germany BAIT

   BaFin's IT requirements for banks, which name IT-Grundschutz as one of the established standards to apply.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to BSI IT-Grundschutz (RSS)