Which business processes should be secured first in your ISMS? In its announcement on October 26, 2026, the German Federal Office for Information Security (BSI) officially announced the publication of BSI Standard 300-1. The new Grundschutz++ methodology adopts a process-oriented approach that prioritizes the protection of critical business processes. This represents an evolution of the existing IT-Grundschutz framework towards a more flexible, risk-oriented, and increasingly automatable Information Security Management System (ISMS).

Three key considerations are relevant for ISMS managers and CISOs when planning:
🔹 Process Prioritization: The methodology outlines the implementation of a continuous security process. For your planning, it is therefore important to assess how the priorities of critical business processes are reflected in your existing ISMS.

🔹 Choice of Risk Methodology: According to the BSI, organizations are free to choose their methods for risk identification, assessment, and treatment, provided they meet certain minimum criteria. The specific requirements must be clarified by reviewing the standard.

🔹 Automation through Machine-Readable Requirements: Security requirements can be more easily integrated into ISMS tools and automatically verified.

With Grundschutz++, information security becomes more closely aligned with actual business risks. This creates opportunities for more efficient security measures, improved prioritization, and better integration into existing management processes.

Important: The current version is initially aimed primarily at experienced early adopters. It does not immediately replace the existing IT-Grundschutz framework. The BSI has announced that ISMS implementations based on Grundschutz++ will be eligible for certification starting in 2027 and has outlined the methodology’s compatibility with ISO/IEC 27001.

✅ Our Practical Tip: Review Your Existing ISMS Now!

Work with your ISMS team to review your existing process prioritization and risk methodology against the requirements of BSI Standard 300-1. This will help you identify potential areas for adjustment at an early stage and systematically enhance your information security management.

SmartTECS Cyber Security GmbH supports you in further developing your Information Security Management System (ISMS) in accordance with BSI IT-Grundschutz and ISO/IEC 27001.