Grundschutz++, made readable.
Independent project, not an official BSI offering. Who is behind it
The law follows establishment in Germany, not the location of your parent company: a German subsidiary of a foreign group can be covered, and the group’s headcount and turnover count towards the size thresholds (§§ 28 (4), 59 BSIG). What this means for a company operating in Germany →
IT-Grundschutz isn’t automatically mandatory for everyone this law touches — BSI’s own FAQ is explicit about that. But an existing Grundschutz-based ISMS is, in BSI’s own words, “a valuable foundation” for meeting it.
What Grundschutz++ is
Section titled “What Grundschutz++ is”Germany’s Federal Office for Information Security (BSI) is replacing its longstanding IT-Grundschutz framework with Grundschutz++: a leaner, machine-readable catalog (in OSCAL) rather than the old PDF-based Kompendium, phased in over several years. This site is an independent, unofficial rendering of it — not a BSI product — built to actually search and read: full-text search, one permalink per requirement, a mapping back to the old Kompendium control it replaces.
Explore the catalog
Section titled “Explore the catalog”Operating in Germany
Does Germany’s NIS2 law apply to you, what is due and by when, and what a violation costs.
GermanThe full catalog
All 1,000 requirements, with obligation level, effort, and threats inline.
GermanRole-specific guides
Separate entry points for executives, security leads, and engineering.
GermanOld ↔ new mapping
Every old Kompendium control mapped to its Grundschutz++ replacement.
Right now, this overview, the page on operating in Germany and a few site pages exist in English — follow any of the other three links above and you land on the German version; the site tells you plainly when that happens, rather than quietly showing you a stub. More on why this project exists under About this site.