The two paths at a glance
"ISO 27001 vs. IT-Grundschutz" is a slight simplification: the Grundschutz path also ends in an ISO 27001 certificate. The BSI calls its scheme „ISO 27001-Zertifizierung auf Basis von IT-Grundschutz“ (our translation: "ISO 27001 certification based on IT-Grundschutz", BSI Standard 200-2, chapter 11). From 1 January 2027, according to the BSI milestone plan, applications for ISO 27001 certification based on Grundschutz++ can be submitted; classic IT-Grundschutz remains certifiable until 30 November 2031. These dates are set by the BSI itself and are not statutory deadlines.
| Feature | ISO/IEC 27001 (without Grundschutz) | ISO 27001 based on IT-Grundschutz or Grundschutz++ |
|---|---|---|
| Basis | International standard; requirements for the management system and an annex with controls. The text of the standard is not freely available. | BSI Standards 200-1, 200-2, 200-3 with the IT-Grundschutz Compendium, since October 2026 also BSI Standard 300-1 with the Grundschutz++ user catalogue (Anwenderkatalog); both freely available |
| Selection of measures | The organisation first identifies risks and derives measures from them (this is how 300-1, Annex 4, describes the „klassischen Vorgehensweisen (z. B. ISO/IEC 27001)“, our translation: "classic approaches (e.g. ISO/IEC 27001)") | For normal protection requirements (Schutzbedarf) the BSI has carried out the risk assessment in advance; requirements follow from assigning assets to target object categories (Zielobjektkategorien). Own risk assessment (Risikobetrachtung) only in the cases of 300-1, ch. 2.11 |
| Scope of requirements | Annex A of ISO/IEC 27001:2022 with 93 controls (figure from the BSI mapping file) | Grundschutz++ user catalogue with 1,000 requirements in the build of 29 October 2026 (own count), of which only the assigned ones apply to each information domain (Informationsverbund) |
| Who audits, who certifies | „Hierbei werden die Zertifikate durch unabhängige Zertifizierungsstellen erteilt“ (our translation: "Here the certificates are issued by independent certification bodies"), after review by a qualified auditor (BSI Standard 200-1, ch. 9) | Classic: audit by an external auditor certified by the BSI; the certification body decides on the certificate (200-2, ch. 11). For Grundschutz++ the BSI has not yet described the audit procedure and the decision in the sources we evaluated; applications from 1 January 2027 and the certification of GS++ audit team leaders (GS++-Auditteamleiter) are announced. |
| What the certificate shows | An ISMS under ISO/IEC 27001 | According to 200-2, ch. 11, that „IT-Grundschutz im betrachteten Informationsverbund erfolgreich umgesetzt worden ist“ (our translation: "IT-Grundschutz has been successfully implemented in the information domain under review"); according to 200-2, ch. 1.5, the organisation can thereby document „dass sie sowohl ISO 27001 als auch den IT-Grundschutz in der erforderlichen Tiefe umgesetzt hat“ (our translation: "that it has implemented both ISO 27001 and IT-Grundschutz to the required depth") |
How Grundschutz++ and ISO 27001 relate
BSI Standard 300-1 expressly maps its steps to DIN EN ISO/IEC 27001. In the process step survey and planning, the activities of clauses 4 and 5 of the standard are carried out (chapter 2). For the methodology requirements of the catalogue, chapter 3.4 states that they reflect „die Kapitel 4 bis 10 der DIN EN ISO/IEC 27001“ (our translation: "clauses 4 to 10 of DIN EN ISO/IEC 27001"). In its press release of 26 October 2026 the BSI writes that an ISMS implemented under Grundschutz++ is „ab 2027 zertifizierbar und zur ISO/IEC 27001 kompatibel“ (our translation: "certifiable from 2027 and compatible with ISO/IEC 27001").
The difference lies in how measures come about. According to Annex 4 of 300-1, for normal protection requirements the BSI takes over a significant part of the risk work: the requirements are based on a BSI threat and risk assessment, and the organisation does not have to carry out its own threat and vulnerability analysis for most of the information domain. A separate risk assessment is required for high protection requirements, for assets not adequately covered and for SHOULD requirements that are permanently not fulfilled (chapter 2.11); for SHOULD requirements that are planned but not yet fulfilled, chapter 2.11 adds a residual risk assessment; how this fits with chapter 4.1.2, under which a temporary non-fulfilment does not trigger a risk assessment, is an open question of interpretation. For the procedure, chapter 2.11 allows common standards such as ISO/IEC 27005 or ISO 31000, as long as the 35 minimum criteria (Mindestkriterien) of Annex 3 are met.
For an ISO ISMS this means: the management system parts can be reused; the difference lies in the requirements package and the status check per requirement. Whether an ISO certification body outside the Grundschutz scheme accepts your Grundschutz documentation as evidence is for that body to decide; the BSI sources say nothing on this.
What the BSI ISO mapping provides
The State-of-the-Art Library (Stand-der-Technik-Bibliothek) contains a mapping of ISO/IEC 27001:2022 Annex A to Grundschutz++ (version 1.0.1-qa, last modified 27 July 2026). The file describes itself as a human-made semantic mapping of all 93 Annex A controls. Its targets are the methodology catalogue (13 mappings) and the kernel catalogue (83 mappings), 96 in total. By our count, 75 relationships are "subset-of", 16 "equivalent-to" and 5 "intersects-with". Of 299 distinct target identifiers, 280 appear in the user catalogue of 29 October 2026 and 19 do not (own count). We have not checked whether identical identifiers still denote the same requirement.
Only Annex A is mapped; the management system clauses 4 to 10 are not in the file, their link is made in the text of 300-1. The mapping helps if you need to show with an ISO ISMS which Grundschutz++ requirements your controls cover. It replaces neither the requirements package nor the status check under 300-1, ch. 4.1.
Decision matrix: which certification path fits
Read the matrix row by row and mark, for each criterion, the row that matches your situation. If the marks point in one direction, the path is clear. If they conflict, the criterion set from outside usually prevails: an explicit client requirement or a legal requirement. The matrix is general subject-matter guidance; whether a requirement legally applies to you is for your legal department to assess.
| Criterion | Your situation | Tendency | Reason and source |
|---|---|---|---|
| Client requirement | Contract or tender asks for an „ISO 27001-Zertifikat auf Basis von IT-Grundschutz“ (ISO 27001 certificate based on IT-Grundschutz) | Grundschutz path | The BSI scheme is required; 200-2, ch. 1.4 expressly mentions that this certification can be used as a security requirement for cooperation partners. Whether a certificate based on Grundschutz++ meets the requirement should be clarified in writing with the client beforehand. |
| Requirement reads "ISO/IEC 27001" without addition | open, tendency ISO path | Both certificates are ISO 27001 certificates; clarify in writing whether the client accepts both | |
| Requirement refers to BSI standards or IT-Grundschutz but asks for no certificate | Grundschutz approach, certificate optional | The method can be applied without certification; evidence can be provided through documents and audits | |
| You are a contractor of a German federal body | Check the contract; Grundschutz path likely if the contract passes on BSI requirements | Section 44(1) of the BSI Act (BSIG) obliges the federal administration itself to apply BSI standards, the Grundschutz Compendium and minimum standards; what is passed on to you is in the contract. For procurement, Section 44(4) names BSI technical guidelines and reference architectures. | |
| Evidence goal | Clients and partners mainly international | ISO path | ISO/IEC 27001 is an international standard; the Grundschutz scheme is a German BSI scheme |
| Evidence towards German authorities or their IT service providers | Grundschutz path | The certificate shows the implementation of IT-Grundschutz in the information domain (200-2, ch. 11) | |
| Documenting the state of the art under Section 30 BSIG (risk management measures of essential entities (besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen)) | both | Section 30 requires the state of the art and asks for relevant European and international standards to be taken into account, but names no framework | |
| Existing ISMS | ISO 27001 certified, no Grundschutz requirement | Keep the ISO path | A switch only helps if a client explicitly requires the Grundschutz path; the BSI ISO mapping shows the proximity to Grundschutz++ if needed |
| Certificate under ISO 27001 based on IT-Grundschutz | Grundschutz path, plan the move to Grundschutz++ | Classic certification possible until 30 November 2031; see Grundschutz++ migration | |
| ISMS under BSI standards without certificate | Grundschutz path | Method and documents can be continued; what changes with 300-1 is shown in IT-Grundschutz vs. Grundschutz++ | |
| No ISMS yet | open; for Grundschutz start directly with 300-1 | Anyone building a new ISMS on classic Grundschutz today faces a migration to remain certified after 30 November 2031 | |
| Operating model | Part of an international group with a shared ISMS | ISO path | A scope can contain several information domains (300-1, ch. 3.1); for a German sub-domain the Grundschutz path can be added if needed |
| Many similar systems, inventory kept in a CMDB | Grundschutz path works well | Assignment of assets to target object categories and grouping of similar assets (300-1, ch. 3.2); machine-readable catalogue for tools | |
| Few own systems, core service sourced from providers or the cloud | open | For the Grundschutz++ path, 300-1 requires outsourced parts to be delimited (ch. 3.1); in the ISO path too, providers belong in the scope definition. Check which evidence your providers can supply |
Combining both approaches
Both approaches can be combined. 200-2 states in ch. 1.4: „Auch wenn als Grundlage für das ISMS eine andere Methodik angewendet wird, ist es trotzdem möglich, vom IT-Grundschutz zu profitieren.“ (our translation: "Even if a different method is used as the basis for the ISMS, it is still possible to benefit from IT-Grundschutz.") An ISO ISMS can use the Grundschutz++ user catalogue as a source of concrete requirements, for example when selecting measures after its own risk assessment. This does not produce a certificate based on Grundschutz; that requires the BSI scheme.
A group with several information domains has a further option. 300-1 allows a scope to contain one or more information domains (ch. 3.1). Whether you take the Grundschutz path for one of them and work under ISO for the rest depends on the delimitation and on the effort of maintaining two sets of evidence; the method allows both.
Five questions before you decide
- What exactly do your contracts and tenders say? Note the precise wording of the requirement.
- To whom do you need to prove something in the next three years? List clients, supervisory bodies and internal functions with the type of evidence.
- Which documents do you already have? Policy, roles, risk method, inventory and audit reports can be reused on both paths.
- When do existing certificates expire? With a Grundschutz certificate, the next cycle determines when a move to Grundschutz++ makes sense (Grundschutz++ timeline).
- Who maintains the ISMS permanently? Grundschutz++ requires an implementation status for every requirement in the package (300-1, ch. 4.1.1); plan the capacity for this in operation.
Blackfort Technology supports the decision for the Grundschutz path and the move to Grundschutz++, see IT-Grundschutz consulting. For an ISMS under ISO/IEC 27001 without a Grundschutz basis, Blackfort Technology's ISO 27001 consulting on https://www.blackfort-tec.de/en is the right starting point.