Outlook

The ALPHA version of Grundschutz++ presented here requires further development before it can be used in a production environment. As things stand, many areas still lack further details regarding methodology and risk management, which the BSI has announced will be provided at it-sa.

Some aspects are therefore currently under active development:

• The inheritance of the implementation status of requirements from parent nodes to child nodes.
• The adaptation of implementation statuses: “met,” “not met,” or “not applicable” (currently “yes,” “no,” “partially,” “not required”).
• The expansion of the search function to allow direct searches for “practices,” “target object categories,” and other new terms from Grundschutz++.
• The adaptation of terminology, such as “asset” instead of “target object.”
• The automatic generation of the threat overview.

The ALPHA version nevertheless provides a solid foundation for evaluating and familiarizing oneself with the new IT-Grundschutz++ at an early stage.

Existing information networks that comply with the Modernized IT-Grundschutz can be migrated using the VNA Importer to both the IT-Grundschutz domain (in accordance with the BSI 200 series standards) and the new Grundschutz++ domain. In doing so, the structural analysis, the determination and inheritance of protection requirements, and (subject to further specification) risk analyses can be carried over.

The migrated information networks can then be viewed side by side in both domains and modeled in the Grundschutz++ domain in accordance with the requirements of the new Grundschutz++ Compendium.