Current Developments and Outlook for IT-Grundschutz++
Germany’s IT security landscape is undergoing a fundamental transformation. With IT-Grundschutz++, the Federal Office for Information Security (BSI) is developing a completely new approach to cybersecurity – moving away from static manuals towards a living, measurable and automatable security framework.
Key Takeaways
Measurable revolution: IT-Grundschutz++ makes cybersecurity quantifiable for the first time by using CIA metrics (confidentiality, integrity, availability), enabling objective assessment instead of purely checklist-based evaluations.
Scalable implementation: The 5-level system (from basic to elevated protection needs) allows implementation tailored to organisational size and protection needs – from small businesses to critical infrastructures.
Agile community development: A paradigm shift from annual editions to continuous, GitHub-based development with transparent community participation and a focus on continuous compliance.
The Paradigm Shift: From Static to Dynamic
For decades, annual IT-Grundschutz editions shaped the German security landscape. However, the rapid evolution of cyber threats, technologies and regulatory requirements has made this traditional approach increasingly inadequate.
IT-Grundschutz++ breaks with this pattern and introduces continuous evolution for the first time.
The vision:
Cybersecurity becomes measurable and automatable.
Instead of static checklists, organisations work with prioritised, machine-readable rules within ongoing PDCA cycles.
Security strategies can be optimised in a truly data-driven way.
The Three Core Innovations of IT-Grundschutz++
1. The Innovative 5-Level System
IT-Grundschutz++ introduces a well-structured level model that organises security requirements by organisational size and protection needs:
Level 1: Basic protection for all organisations against common threats
Level 2: Extended requirements for small businesses addressing typical incidents
Level 3: Practical, SME-ready security measures
Level 4: Comprehensive requirements for federal authorities and large enterprises
Level 5: Optional requirements for scenarios with elevated protection needs
This enables a scalable approach: organisations start with the level that fits their situation and gradually enhance their protection.
2. Measurable Cybersecurity via Metrics
A core feature of IT-Grundschutz++ is the quantification of security. Each practice or requirement is assigned scores along the CIA triad:
Confidentiality
Integrity
Availability
These metrics objectively indicate how effective a given measure is against specific threats.
Thresholds for each level define the target values to be achieved.
The degree of fulfilment reflects the current security posture.
For the first time, organisations can scientifically measure their cyber maturity, document progress in a transparent way and invest precisely where security gains are highest.
More on IT-Grundschutz++
Instead of rigid yearly editions, the new system enables a continuous, data-driven security strategy. Organisations can:
objectively assess their level of protection,
quantify improvements over time,
and allocate resources to areas with the largest security impact.
The 5-level system ensures that this approach is scalable from small organisations to critical infrastructure operators.
3. Community-Driven Development on GitHub
IT-Grundschutz++ moves away from isolated standard development. The BSI relies on transparent, community-driven evolution via GitHub:
Open data formats: Downloads in JSON and XLSX for flexible integration into tools and ISMS platforms
Agile updates: Continuous improvements instead of infrequent big-bang releases
Participation: Issues, pull requests and discussions enable active contribution from experts and vendors
Versioning: Branches and tagged releases combine stability with agility
This level of transparency turns IT-Grundschutz++ into one of Germany’s first truly agile security standards.
Automation in Practice: The End of Manual Compliance
IT-Grundschutz++ envisions ISMS automation in three incremental phases:
Collection
Automated inventory of systems, data, services and suppliers
Integration
Embedding security into CI/CD pipelines using „smart standards“ and „smart contracts“
Tight alignment of development, operations and compliance
Sustainment
Continuous compliance monitoring
Automatic blocking, alerting and escalation when deviations occur
Rich metadata enables precise filtering by practices, target objects and action verbs. Organisations only see the requirements that matter for their current situation – personalised cybersecurity becomes reality.
The shift from point-in-time audits to continuous compliance fundamentally changes how ISMS management is done.
Current Status: Where Does IT-Grundschutz++ Stand Today?
The transformation from the static 2023 edition to IT-Grundschutz++ is progressing rapidly:
The last classic edition contained around 1,800 objects.
The new digital compendium is already growing to more than 7,500 structured elements.
On 25 February 2025, the BSI hosted a digital workshop called “Digitales Kompendium”. During this two-hour online session, experts from different domains were able to:
get to know the IT-Grundschutz++ concept,
develop formats for support and pilot projects,
and commit to active cooperation during the pilot phase.
Further sessions of this kind are planned.
If you have questions about BSI IT-Grundschutz or IT-Grundschutz++, we are happy to support you – just send us an email.
fuentis Team
Team
The fuentis team brings together specialists in information security, data protection and risk management — supporting organizations with reliable, audit-ready solutions.