{"id":1007775,"date":"2026-04-29T17:08:52","date_gmt":"2026-04-29T15:08:52","guid":{"rendered":"https:\/\/www.teal-consulting.de\/2026\/04\/29\/bsi-update-grundschutz\/"},"modified":"2026-08-02T22:27:56","modified_gmt":"2026-08-02T20:27:56","slug":"bsi-update-grundschutz","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2026\/04\/29\/bsi-update-grundschutz\/","title":{"rendered":"BSI Update: Grundschutz++ Will become mandatory in 2028 – why you should take action now"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text css=””]The wait is over: The BSI has published the first guidelines for Grundschutz++. What at first glance looks like additional bureaucratic red tape is, in reality, the new \u201cstate of the art\u201d for NIS2.<\/strong><\/p>\n

The Federal Office for Information Security (BSI)<\/strong> has delivered. Just in time for the NIS2 Implementing Regulation, the guidelines on the methodology of Grundschutz++ (GSpp)<\/strong> have been published. This makes it clear: The shift from static PDF modules to a dynamic, machine-readable security management system is irreversible.<\/p>\n

But be careful: Those who rush headlong into the migration will waste valuable resources. We\u2019ll show you what the new standard means for you and why it\u2019s the perfect springboard for true IT hardening.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text css=””]\n

Compliance pressures clash with outdated methods<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text css=””]Until now, IT-Grundschutz compliance has often involved a lot of tedious work in Excel and Word. With NIS2, the requirements are becoming much stricter. If your organization is classified as \u201cimportant\u201d or \u201cparticularly important,\u201d you must demonstrate a security status that reflects the current state of the art.<\/p>\n

The crux of the matter: Many companies still use architectures that offer little protection against modern attack vectors (such as ransomware or identity theft). While the current Grundschutz Edition 2023 remains valid until the end of 2028, if you\u2019re setting up a new ISMS today, you can no longer avoid the GSpp.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text css=””]\n

Grundschutz++ as a Technical Guide<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text css=””]The new Grundschutz++ is radically different. It is based on the OSCAL standard (NIST)<\/strong>, which means that security requirements become machine-readable. This saves you time in the long run when it comes to audits and administration. But the real highlight lies in the contents of the user catalog.<\/p>\n

Here, the BSI defines precise requirements that go far beyond simply \u201cticking boxes.\u201d For us at TEAL, it\u2019s clear: GSpp is the regulatory confirmation of what we\u2019ve been advocating for years.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text css=””]\n

Our theory: GSpp is the turbo boost for your leveling and PAW<\/h2>\n[\/vc_column_text][vc_empty_space height=”20″][vc_column_text css=””]Grundschutz++ consistently focuses on securing the \u201ccore\u201d\u2014that is, your most critical infrastructure components. We are convinced that a successful GSpp audit will not be possible without a strict tiering model, the use of Privileged Access Workstations (PAW), and consistent system hardening.<\/strong><\/p>\n

Why is that?<\/p>\n