Grundschutz++ tool
for your ISMS
With Complaica you implement Grundschutz++ on your existing ISMS data. Link requirements to assets, plan measures and document internal audits — in one place and traceably.
- 01Grundschutz++ user catalog as an OSCAL catalog, updated straight from the BSI's GitHub
- 02All five process steps of the Methodik-GS++ — from survey and planning to continual improvement
- 03Migration from IT-Grundschutz and ISO 27001 based on the BSI mappings
- 04Internal audits under PERF.3 and ISO 19011: audit programme, audit plan, rating scheme, audit report
- 05AI integration (MCP) plus expert consulting — Co-Intelligence
Implement and manage Grundschutz++ with Complaica
What the Grundschutz++ software does for your implementation — at a glance.
- 01Grundschutz++ user catalog as an OSCAL catalog — imported and updated straight from the BSI’s GitHub
- 02Reuse existing ISMS data: assets, risks, measures and evidence from IT-Grundschutz or ISO 27001
- 03Requirement package from assets and target object categories — with inheritance, security level and the requirements’ links
- 04Plan measures: owners, deadlines, exceptions and the implementation status “implemented” or “not implemented”
- 05Internal audits, findings and management review under PERF.3 and ISO 19011
- 06All five process steps of the Methodik-GS++ and AI integration (MCP) with views right in the chat
Why Complaica as a Grundschutz++ tool?
Six reasons why organisations build and run their ISMS under Grundschutz++ with Complaica.
Software plus expert consulting
ISMS software and consulting from one source: our compliance experts support setup, migration, operation and audit preparation — as far as you need.
Right at the state of the art
The user catalog comes from the BSI’s State of the Art Library and stays current with it — no retyping, no waiting for an edition.
Migration instead of rebuild
What is recorded for IT-Grundschutz stays and is brought into the Grundschutz++ system; during the transition both rule sets run in parallel.
Built for machine-readable requirements
Inheritance through target object categories, consolidation, parameters and metadata are evaluated by the software instead of being kept up by hand — the tool-supported implementation the BSI’s guide recommends.
From the internal audit to certification
Audit programme, findings, corrections and management review on one data set — for the first audit under Grundschutz++ and every one after it.
Grundschutz++ in Complaica: from catalog to evidence
How you work with the Grundschutz++ software: five steps on one data set, each building on the one before.
- 01
Catalog
User catalog · OSCAL
Import the Grundschutz++ user catalog as an OSCAL catalog from the BSI’s State of the Art Library; importing again updates the same standard.
- 02
Assets
Target object categories
Record assets or take them over from a CMDB, asset management or Microsoft Azure, and assign them to target object categories.
- 03
Requirements
Requirement package
The categories’ requirements form the requirement package — with security level, threats and the links from the catalog.
- 04
Measures
Implementation planning
Plan open requirements as measures with owners, deadlines and status; justify and authorise exceptions.
- 05
Evidence
Audit trail · reports
Store documents and assessments on the object, with author and date; reports and dashboards show the state for management and audit.
Migration from IT-Grundschutz and other norms to Grundschutz++
Migration is a transition, not a rebuild: business processes, assets, risks, measures and evidence stay and are brought into the Grundschutz++ system. It rests on the mappings the BSI publishes in the State of the Art Library. Until IT-Grundschutz can no longer be certified, both rule sets can run in parallel.
From the IT-Grundschutz Compendium
The BSI mapping assigns the requirements of the Compendium, Edition 2023, to those of Grundschutz++ — with the kind of relation: equal, subset, superset or intersection. In Complaica each requirement shows where it comes from and which assessment needs to be checked again.
Mapping IT-Grundschutz 2023 → GS++
From target objects to target object categories
The target objects of the structure analysis become assets, each assigned one or more target object categories — by their function in the business process, not only by technical features. Parent categories are inherited.
STM.2.1.2 · STM.2.1.3 · STM.2.1.4.1
Reclassify protection needs
Three categories become two: business processes and information are classified as “normal” or “high”. High protection needs lead to a dedicated risk assessment with the chosen method.
GC.7.1.2 · GC.7.2 · STM.4.1
Clean up the implementation status
“Partially” and “dispensable” no longer exist. Partially implemented requirements become “not implemented” and go into implementation planning; justified deviations become authorised and documented exceptions.
UMS.1.1 · UMS.2 · UMS.5
From ISO 27001
For an ISMS to ISO/IEC 27001, the BSI mapping assigns the Annex A controls to the requirements of the methodology and the user catalog. Context, policy, risk management and audits reappear in the ISMS practices.
Mapping ISO/IEC 27001:2022 Annex A → GS++
Internal audits under Grundschutz++ and ISO 19011
Grundschutz++ requires, in the practice Monitoring and Evaluation, an audit programme with risk-based internal audits (PERF.3). The guidance for the audit programme, the conduct of audits and auditor competence comes from ISO 19011:2026. Complaica connects both with the requirement package.
- 01Set up and maintain audit programmes with their audits — e.g. the first audit under Grundschutz++ (PERF.3.1)
- 02Choose audit objects and depth from the requirement package on a risk basis (PERF.3.1.2)
- 03Run audits in sessions: rate each requirement conform, partial, nonconform or not applicable, with the progress per session
- 04One uniform rating scheme across all audits and standards (PERF.3.2.1)
- 05Create findings right at the requirement — as an observation or a nonconformity, with status and severity
- 06Audit reports with a status per audit programme, audit and standard (PERF.3.2)
- 07Management reviews with inputs, conclusions, activities and history (PERF.4)
- 08Bring nonconformities into the corrective and improvement plan and check effectiveness (VRB)
- ISO 19011:2026
The guidelines for auditing management systems, Edition 4 of May 2026: principles of auditing, managing an audit programme, conducting audits, and competence and evaluation of auditors — for internal and external audits alike.
- Onward in the PDCA cycle
Nonconformities from audits are examined for causes and recurrence (VRB.2), corrections are planned (VRB.4, VRB.5) and checked for effectiveness (VRB.6); the audit reports go into the management report (PERF.4.1.4).
- The BSI’s audit layer
The guide announces an audit layer of its own, the State of the Art Library an assessment layer for machine-readable audit artefacts. Neither has been published yet (as of 23 October 2026).
Grundschutz++ with AI assistance
With the optional AI integration (MCP), Complaica answers questions on Grundschutz++, explains practices and requirements, helps with measures and tasks and finds answers in your own policies and documents. Through MCP Apps, Complaica answers in the chat not only with text but with interactive views of your data — such as an asset’s risk matrix or the objects of the information domain. Assessment and decision remain yours.
- 01Risk matrix, object lists and further views right in the chat — with MCP Apps, in AI assistants such as Claude
- 02Answer questions on the Methodik-GS++ and the user catalog
- 03Explain requirements — what is asked for and which documentation fits
- 04Suggest, phrase and assign measures and tasks
- 05Evaluate your policies, procedures and documents and answer questions about them
- 06Explain how to use Complaica — which function for what
Operation and introduction: SaaS or on-premises
Complaica runs where your organisation needs it — the licence costs the same either way.
- SaaS, hosted in Germany
The SaaS variant is operated in Germany; you work in the browser, without infrastructure of your own.
- On-premises in your infrastructure
You run Complaica in your own environment — for organisations whose data may not leave the house.
- Taking over existing data
Import and export from and to Excel and over the REST API; our specialists accompany the transfer of your data free of charge.
- Introduction with support
Our consultants support setup and migration as far as you need; integrating your applications is free of charge.
Grundschutz++ consulting
Information security as a service: consulting along the Methodik-GS++ — from gap analysis through migration to the internal audit, as far as you need.
- Gap analysis against the user catalog
Comparing your current state with the Grundschutz++ requirements. Result: a prioritised gap list by security level and effort level.
- Migration from IT-Grundschutz
Planning and supporting the transition — assets and target object categories, protection needs, implementation status and requirement package, on your existing data set.
- Building the ISMS under the Methodik-GS++
Context, policy, scope, information security classification and security organisation — process step 1 as the basis for everything else.
- Risk assessment
Choosing and introducing a method for information security risk management and risk assessments for business processes with high protection needs.
- Internal audits
Setting up the audit programme, running or supporting internal audits under PERF.3 and ISO 19011, bringing findings into the improvement plan.
- Preparing for certification
Preparation for an ISO 27001 certification on the basis of Grundschutz++, which according to the BSI’s milestone plan is to be possible to apply for from 1 January 2027.
- External information security officer
A contact for your ISMS, for a time or permanently — for organisations without a role of their own for it.
Customer voices on the ISMS with Complaica
“The optimised compliance process”
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort. In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality. On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
More …Less
One of the features we like best about Complaica is the optimised compliance process. The user interface has a clear, structured design that offers more usability and encourages a higher working speed. This not only gives new users a steep learning curve, it also lets experienced users minimise their effort.
In every phase of the security management lifecycle, recurring tasks such as scoping, structure analysis, modelling and even the tracking of risks and measures are supported by a wealth of functionality.
On top of that the platform’s performance is great — it is stable and excellent in terms of speed.
“We can do everything we need in one tool”
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool. For us, Complaica is better than the alternatives on the market and cheaper at the same time.
More …Less
Complaica is extremely user-friendly and customising it is child’s play. We can take care of ISO compliance and data protection with it — we can do everything we need in one tool.
For us, Complaica is better than the alternatives on the market and cheaper at the same time.
“The guided approach played a decisive role for us”
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process. Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before. So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
More …Less
We were new to compliance and to implementing ISO 27001, and had to go through the complicated certification process.
Given the regulatory complexity, we wanted to find the best way for us to get started. Our project manager (aka security officer) had never worked with such compliance standards and rules before.
So we decided on support from a third party — Complaica, to be precise. The guided approach played a decisive role for us. Complaica had all the detailed explanations for the compliance check and the risk analysis, including practical suggestions.
What changes with Grundschutz++
Grundschutz++ is not a new edition of the Compendium but a rebuilt rule set: the Grundschutz++ user catalog replaces the IT-Grundschutz Compendium (IT-Grundschutz-Kompendium), the Methodik-GS++ the IT-Grundschutz methodology of BSI-Standard 200-2. The main differences — with the requirements in which Grundschutz++ settles them.
| IT-Grundschutz (Compendium 2023) | Grundschutz++ | |
|---|---|---|
| Rule set | IT-Grundschutz Compendium in yearly editions, last Edition 2023; methodology in BSI-Standard 200-2 | User catalog in the OSCAL format in the State of the Art Library, published continuously on GitHub; methodology in the guide to the Methodik-GS++ |
| Structure | Modules (Bausteine) in ten layers, from ISMS and ORP to NET and INF | 20 practices (Praktiken): six of the methodology (GC, STM, UMS, VRB, PERF, RISK), eight organisational and six technical — about 1,000 requirements |
| Modelling | Modules are assigned to target objects (Zielobjekte) | Assets are assigned to target object categories; requirements are inherited along the hierarchy and consolidated into the requirement package (STM.2.1.3 to STM.2.1.4.2) |
| Protection needs | normal, high or very high per target object and protection goal, inherited by the maximum principle | “normal” or “high” per business process or information, set together with top management (GC.7.1.2); “high” is followed by a dedicated risk assessment (GC.7.2) |
| Protection approach | Basic, Standard and Core Protection; basic, standard requirements and requirements for increased protection needs | Security level (Sicherheitsniveau) per requirement — normal-SdT or increased (erhöht) —, reviewable in the requirement package (STM.3.1) |
| Obligation | MUST and SHOULD, each also negated | MUSS, SOLLTE and KANN (must, should, may) per DIN 820-2, plus an effort level of 0 to 5 per requirement for prioritising |
| Implementation status | yes, partially, no, dispensable | “implemented” or “not implemented” — implemented only when all dependent requirements are implemented too (UMS.1.1); deviations through exception management (UMS.5) |
| Risk | Risk analysis according to BSI-Standard 200-3 | Risk assessment (Risikobetrachtung) with a method of your choice, e.g. ISO 27005, ISO 31000 or BSI-Standard 200-3 (GC.12.1, RISK.1.1) |
| Protection goals | Confidentiality, integrity, availability | plus authenticity; the requirements state how strongly they act on each protection goal |
| Assessment | IT-Grundschutz Check and reference documents A.1 to A.6 | Audit programme, risk-based internal audits, a uniform rating scheme and audit reports (PERF.3) |
Methodik-GS++: five process steps in the PDCA cycle
Complaica covers the five process steps (Prozessschritte) of the guide to the Grundschutz++ methodology in its version of March 2026. Each step is matched by an ISMS practice of the user catalog; its requirements apply once to the whole information domain (STM.2.1.1).
- 01
Survey and planning
Plan · chapter 2 Practice GC
Set context, compliance management, interested parties, policy, scope, information security classification, security organisation and risk management.
- 02
Requirements analysis
Plan · chapter 3 Practice STM
Delimit the information domain, record assets and assign target object categories, model, extend and consolidate the requirement package.
- 03
Implementation
Do · chapter 4 Practice UMS
Determine the implementation status, assess missing implementations, plan, prioritise, approve and track the implementation.
- 04
Monitoring
Check · chapter 5 Practice PERF
Evaluate the ISMS’s performance, monitor compliance, run internal audits and management reviews, validate the requirements.
- 05
Continual improvement
Act · chapter 6 Practice VRB
Analyse nonconformities, plan corrective and improvement actions and check their effectiveness.
The 20 practices of the user catalog
Instead of modules, the Grundschutz++ user catalog groups its requirements into practices (Praktiken). The practice’s abbreviation stands before every requirement: GC.7.1.2, for instance, belongs to group GC.7 information security classification of the practice Governance and Compliance. In Complaica each practice is an area of the catalog, evaluable up to the information domain.
Methodology
6 practices · 99 requirements
- GC Governance and compliance 35
- STM Structure modelling 15
- UMS Implementation 11
- VRB Improvement 10
- PERF Monitoring and evaluation 24
- RISK Risk management 4
Organisational
8 practices · 450 requirements
- ASST Information and assets 58
- PERS Personnel 30
- BES Procurement management 109
- DLS Service provider management 18
- TEST Changes and tests 36
- GEB Building management 75
- SENS Awareness 87
- NOT Emergency planning 37
Technical
6 practices · 451 requirements
- ARCH Architecture 63
- BER Authorisation 92
- DET Detection 82
- REA Security incident handling 23
- KONF Configuration 157
- DEV Development 34
Counted in the Grundschutz++ user catalog, catalog version 2026-10-22 (commit 9fb19de of 23 October 2026): 1,000 requirements, of which 149 MUSS, 627 SOLLTE and 224 KANN. The figures change with the BSI’s publications.
The user catalog as an OSCAL catalog — straight from the BSI’s GitHub
The BSI no longer publishes the state of the art in editions but continuously: as OSCAL catalogs in the State of the Art Library on GitHub. Complaica connects the user catalog as an OSCAL catalog and keeps it current.
- Straight from the State of the Art Library
Complaica takes the resolved Grundschutz++ user catalog directly from the BSI’s repository on GitHub. Importing again updates the same local standard — no export, no conversion and no waiting for a new edition.
- Changes marked, assessments kept
New, changed and removed requirements are marked. Existing assessments are kept. Where a requirement’s content has changed, its professional validity should be checked again.
- Properties and links of the requirements
What the catalog brings with a requirement stays on it: the security level, the threats and the links — required requirements without which it does not count as implemented, and related ones (UMS.1.1).
- Versions and audit trail
Every catalog state stays traceable as a version, and the audit trail of changes survives updates. More on the page about the OSCAL tool.
- Released online sources
Besides the Grundschutz++ user catalog, the BSI Methodik Grundschutz++ as a catalog of its own as well as NIST SP 800-53 Revision 5 and the NIST Cybersecurity Framework 2.0 are available as released online sources. Your own OSCAL catalogs are added the same way.
Milestone plan: certification planned from 2027
The BSI’s planning for the transition according to its milestone plan (as of October 2026, checked on 23 October 2026). These are planned dates; the BSI adjusts the plan continuously — the version on its website is authoritative.
- 27 October 2026
Planned: publication of the Methodik-GS++ at it-sa 2026 in Nuremberg.
- 30 November 2026
Planned: training concepts for GS++ practitioners and GS++ consultants.
- December 2026
Planned: worked example based on the fictitious model authority “BDIT”.
- 1 January 2027
Planned: Grundschutz++ becomes certifiable — applications for an ISO 27001 certification on the basis of GS++ are to be possible, likewise for GS++ consultants and GS++ audit team leaders.
- Q1 2027
Planned: start of the early-adopter phase and of the further training for already certified IT-Grundschutz consultants and audit team leaders.
- February and March 2027
Planned: concept for measuring the ISMS’s performance in the methodology; key performance indicators for every requirement of the ISMS practices.
- 31 December 2027
Planned: end of the early-adopter phase.
- 30 November 2031
Planned: end of IT-Grundschutz certification — five years after the publication of GS++.
Grundschutz++ and further standards
Grundschutz++ is rarely the only rule set an organisation is subject to. In Complaica the requirements of further standards use the same assets, risks, measures and evidence: what is documented for Grundschutz++ also counts for IT-Grundschutz during the transition, for an ISMS to ISO 27001, for NIS2, DORA, TISAX or data protection management under the GDPR. Double maintenance falls away.
Every norm ships with its requirement catalog; your own catalogs can be added at any time. All areas are shown on the GRC platform Complaica.
Frequently asked questions about Grundschutz++ tools
What is Grundschutz++?
Grundschutz++ (GS++) is the redevelopment of the Grundschutz by the German Federal Office for Information Security (BSI): a fully process-oriented rule set for building and running an ISMS. It consists of the Methodik-GS++ and the Grundschutz++ user catalog (Anwenderkatalog), whose requirements are machine-readable in the OSCAL format. The user catalog replaces the IT-Grundschutz Compendium.
What is the difference between IT-Grundschutz and Grundschutz++?
IT-Grundschutz assigns modules of the Compendium to target objects and knows three protection-needs categories, three approaches and four implementation states. Grundschutz++ groups about 1,000 requirements into 20 practices, models them through target object categories into a requirement package, and knows the protection needs “normal” and “high”, the security levels normal-SdT and increased, and only “implemented” or “not implemented”. The method of risk assessment can be chosen freely.
What is a Grundschutz++ tool?
A Grundschutz++ tool is ISMS software that reads the user catalog as a machine-readable catalog and maps the Methodik-GS++ in a data model: business processes, assets, target object categories, requirement package, implementation status, risks, audits and evidence are linked. The software takes care of inheritance, consolidation and updates.
Does Complaica support Grundschutz++?
Yes. Complaica is one of the first tools to support BSI Grundschutz++. The user catalog is connected as an OSCAL catalog from the State of the Art Library and assessed on the same data set as IT-Grundschutz.
How does Complaica update the user catalog?
Complaica imports new states of the user catalog directly from the BSI’s GitHub repository; importing again updates the same local standard. New, changed and removed requirements are marked, existing assessments and the audit trail are kept. Where a requirement’s content has changed, its professional validity should be checked again.
How does the migration from IT-Grundschutz to Grundschutz++ work?
The migration takes place on the existing data set. Target objects become assets with target object categories, protection needs are classified as “normal” or “high”, partially implemented requirements go into implementation planning. The BSI mapping from the Compendium 2023 to the user catalog shows which requirement corresponds to which. During the transition both rule sets can run in parallel; on request our consultants support the migration.
Can an ISMS to ISO 27001 be moved to Grundschutz++?
Yes. The BSI publishes a mapping of the Annex A controls of ISO/IEC 27001:2022 to the Grundschutz++ requirements. In Complaica assets, risks, measures and evidence stay; the Grundschutz++ requirements are assessed on the same objects. According to the BSI’s milestone plan, an ISO 27001 certification on the basis of Grundschutz++ is to be possible to apply for from 1 January 2027.
How does Complaica support internal audits under Grundschutz++?
You set up an audit programme (PERF.3.1) with its audits, choose audit objects from the requirement package on a risk basis (PERF.3.1.2) and run the audit in sessions: each requirement is rated conform, partial, nonconform or not applicable under one rating scheme (PERF.3.2.1), and findings — observations or nonconformities — are created right at the requirement. Audit reports carry a status (PERF.3.2), management reviews collect inputs and conclusions (PERF.4), nonconformities go into the improvement plan (VRB).
What role does ISO 19011 play in internal audits?
ISO 19011 is the international guidance for auditing management systems, currently Edition 4 of 2026. It describes principles of auditing, managing an audit programme, conducting audits and auditor competence. Grundschutz++ sets out what an audit programme must achieve; ISO 19011 gives the proven way to do it.
From when is Grundschutz++ certifiable?
According to the BSI’s milestone plan (as of October 2026, checked on 23 October 2026), applications for ISO 27001 certification on the basis of Grundschutz++ are to be possible from 1 January 2027, and certification under IT-Grundschutz is to end on 30 November 2031. These are plans the BSI adjusts continuously — the version on the BSI’s website is authoritative.
Is Complaica available as SaaS and On-Premises?
Yes, both. The SaaS variant is hosted in Germany; On-Premises you run Complaica in your own infrastructure. The licence costs the same either way.
How do I start with Grundschutz++ in Complaica?
Request an account or a demo. Existing data from Excel, over the REST API or from other ISMS tools is taken over — migrating your data is free of charge and accompanied by our specialists. Then you import the user catalog, assign your assets to the target object categories and work through the requirement package; our consultants support you as far as you need.
Sources References and legal sources
8 sources · Grundschutz++, Methodik-GS++, Anwenderkatalog Grundschutz++, GS++ catalog file, … Show Hide
Norms & standards
Guidelines & official publications
The BSI’s Grundschutz++ materials are developed continuously: the user catalog appears as a versioned OSCAL file on GitHub, the guide and the milestone plan in versions with their own date. The current version at the BSI is authoritative; the access date stands at each source. Standards are available from the publishers named.
Start Grundschutz++ with Complaica
Test the Grundschutz++ tool, request a demo or talk about migrating your IT-Grundschutz — write to us.
Thank you.
We will get back to you within one business day.
Not sent.
That did not work. Please check the fields or email us directly.