C5 and IT-Grundschutz: what you can reuse and what Grundschutz++ changes

How do C5 and IT-Grundschutz differ?

Both come from the BSI and look at information security as a whole, but they serve different purposes. The BSI describes the difference in its C5 FAQ as follows: IT-Grundschutz is a standard for protecting all information of an organisation, and the IT-Grundschutz-Compendium describes safeguards for typical processes, systems and applications. C5 is purely an audit standard, designed for the services of a cloud service provider, with criteria instead of safeguards so that providers can design how they meet them to fit their service.

According to the FAQ, both address the same level of security for cloud services in their minimum requirements, and the BSI considers both suitable for demonstrating the security of cloud services. Which evidence a customer asks for depends on that customer’s own requirements. An IT-Grundschutz certificate does not automatically lead to a C5 attestation. According to the FAQ, existing certificates are generally not recognised in the attestation audit. Why an attestation says something different from a certificate is explained on C5 attestation.

What IT-Grundschutz work can you reuse for C5?

Four results of the IT-Grundschutz approach have an explicit point of reference in the catalogue. The right-hand column is our assessment of what is missing.

In addition, the catalogue derives its terms in part from the IT-Grundschutz-Compendium (section 1.2.1) and lists the 2023 Compendium among the standards taken into account (section 2.3). What you can carry over from an ISO 27001 ISMS in general is covered on C5 and ISO 27001.

What is missing after IT-Grundschutz for a C5 attestation?

C5 requires three things on top:

• Operating effectiveness over a period: For type 2, the auditor tests whether controls operated over the audit period, among other things by sampling. You need evidence with a time reference, collected from the start of the period (see C5 type 1 and type 2 and evidence and documentation).
• Cloud-specific criteria: C5:2026 contains criteria designed specifically for cloud services, for example on separating customer data according to a cloud layer model (OPS-30, OPS-31), on containers (OPS-34, OPS-35) or on transparency towards customers when their data is accessed (IAM-07). Whether a module fits in substance has to be checked case by case. As of 1 November 2026, the BSI has not yet published its cross-reference table for C5:2026.
• System description and complementary criteria: The C5 report rests on the provider’s system description with the complementary customer controls (also called complementary user entity controls, CUEC). You write this document specifically for the C5 report.

According to the catalogue, even an official mapping table only shows a thematic relationship. Whether your safeguards meet the criteria always has to be assessed individually (section 3.3).

What is Grundschutz++, and where does it stand?

Grundschutz++ (GS++) is the BSI’s redevelopment of its baseline protection methodology. According to the BSI page “Grundschutz in der Informationssicherheit” (checked on 1 November 2026), it will replace IT-Grundschutz in the longer term. Until then, IT-Grundschutz remains applicable during a transition period of several years, and both are compatible with ISO 27001. The methodology is described in BSI Standard 300-1. The requirements are set out in the Grundschutz++ user catalogue (Anwenderkatalog), machine-readable in the “Stand der Technik Bibliothek” (state-of-the-art library), which according to the BSI replaces the IT-Grundschutz-Compendium. The user catalogue now only describes requirements that are not aimed at specific IT solutions.

The BSI publishes a milestone plan, which it says it adjusts on an ongoing basis. As of October 2026, checked on 1 November 2026:

The current plan on the BSI page applies; dates may change.

What does Grundschutz++ mean for your C5 project?

For a C5 attestation nothing changes directly: the C5:2026 catalogue does not mention Grundschutz++, and its criteria apply regardless of the methodology you use to run your ISMS. You should still plan for three points:

• Wording of OIS-01.01AS and the C5 Equivalence Ordinance: OIS-01.01AS refers to “ISO 27001 based on BSI IT-Grundschutz”, the ordinance to “ISO 27001 auf der Basis von IT-Grundschutz”. As of 1 November 2026, the sources do not say whether a certificate according to ISO 27001 based on GS++ falls under this. For OIS-01.01AS, clarify this with the auditor. For the ordinance it is a legal question that needs to be assessed case by case.
• References to modules: The examples in the supplementary information to AM-07, OPS-26 and PSS-11 refer to the Compendium. If you switch to GS++, map the affected controls to the new requirements and record the mapping in your evidence register.
• Timeline: Under the BSI plan, an IT-Grundschutz certificate remains available until the end of November 2031. If you build up a C5 attestation and switch to GS++ at the same time, you change processes during a possible type 2 period. Keep the two apart in your planning or record the switch as a change in the system description.

Example: hosting provider with an IT-Grundschutz certificate

Fictitious example, not a client. A hosting provider runs web portals and specialist applications for municipal bodies and has held a certificate ISO 27001 based on IT-Grundschutz for its data centre for years. A healthcare customer asks for a C5 attestation for a new SaaS application.

What the provider carries over: the ISMS documentation as the basis for OIS-01, the deletion processes under CON.6 for AM-07, the hardening rules based on modules for OPS-26, and risk management as the starting point for OIS-07. What is new: tailoring the scope to the one cloud service, the system description with complementary customer controls, controls on tenant separation, containers and customer information, and an evidence register that is filled from the first day of the type 2 period. Before saying anything to the customer, the provider checks whether the existing certificate’s scope covers the new service. It deliberately schedules the switch to GS++ after the first type 2 period.

How we support providers with IT-Grundschutz experience

In a C5 readiness assessment we map your existing IT-Grundschutz results to the C5 subcriteria and show what is missing. Blackfort Technology does not issue attestations or certificates; the attestation is issued by an independent auditor.