Public bodies, public-sector IT providers and universities
For organisations that are certified under IT-Grundschutz or in certification and want to settle the transition before their next re-certification.
Grundschutz++ transition pilot · proof of concept
Test the transition to Grundschutz++ on your own Informationsverbund.
Grundschutz++ becomes certifiable in 2027. Nobody can yet say what the transition means for your Sicherheitskonzept, or whether it works in the tool you use today. The transition pilot measures it on one Informationsverbund of 50 to 250 Zielobjekte, in twelve weeks and at a fixed price. Your leadership then decides on measurements rather than estimates.
Companies and KRITIS operators
For organisations with a Sicherheitskonzept under IT-Grundschutz or an ISO 27001 certificate on the basis of IT-Grundschutz. Fully in English and under NDA if you prefer.
01 / Why 2027
The early-adopter phase starts in 2027. The existing IT-Grundschutz runs out in 2031.
- 27 October 2026 · methodology published
- 1 January 2027 · Grundschutz++ certifiable
- 2027 · early-adopter phase
- 30 November 2031 · end of certification under the existing IT-Grundschutz
Every organisation certified under IT-Grundschutz plans its transition in these years. The usual way is to lay both catalogues side by side and judge, requirement by requirement, what still holds. The pilot makes that work measurable on one Informationsverbund before you plan the rest.
Source: BSI milestone plan, as of October 2026
02 / Result
It ends with a decision memo for your leadership.
Every requirement and every Zielobjekt in your Informationsverbund gets one of three findings, each with its reason and source.
Carries over
Status, evidence and approval stay as they are.
Must be re-assessed
The requirement is narrower, broader or only partly covered, or it asks for different evidence. The reason is stated.
Awaits clarification from the BSI
The published methodology leaves the point open. The question is written out, and nothing is guessed.
What you receive
- The delta for the whole Informationsverbund, each entry with its reason and source
- Three practices transitioned end to end, every decision recorded with name and time
- An effort benchmark against your own estimate for the manual route
- The decision memo: transition with or without a tool change, timeline to re-certification, open questions for the BSI
03 / How it works
Your Sicherheitskonzept and the Grundschutz++ catalogue, compared as two graphs.
OrbisGraph rebuilds your Sicherheitskonzept on Edition 2023 as a knowledge graph, and your expert confirms this baseline. Our analyst loads the published Grundschutz++ catalogue next to it as a second graph and builds the comparison with OrbisGraph's support. Every result leads back to a passage in your documents and a passage in the catalogue. Your expert decides what stands.
Weeks 1 to 4 · baseline
Your documents and tool export are taken over and indexed as a graph. At the first review gate your expert confirms the baseline.
Weeks 5 to 10 · transition
The mappings between the two catalogues are curated with your expert, the delta is derived for the whole Informationsverbund and three practices are transitioned end to end. At the second review gate every mapping in the sample is confirmed.
Weeks 11 to 12 · decision
Effort benchmark and decision memo. In the closing workshop, leadership and the ISM team go through the options together.
The timeline is an example. The calendar follows your organisation and the BSI publication, and the transition phase starts only once the catalogue is available in machine-readable form.
We measure coverage, your expert's acceptance rate and review hours per practice. The target values are set together at kick-off.
Who runs the pilot
Pinnipedia Technologies is a technology company based in Brandenburg, Germany. The founding team includes two professors of the Freie Universität Berlin, one of them with ten years at BSI and BMI, and a professor of the Berliner Hochschule für Technik with a BSI and BMI background. Cybersecurity researchers of the Freie Universität Berlin measure the extraction quality of OrbisGraph in a reproducible benchmark on real IT-Grundschutz corpora. The IT-Grundschutz module is built with funding from the BMWE's Innovation Programme for Business Models and Pioneering Solutions (IGP). We applied for inclusion in the BSI list of IT-Grundschutz tools in September 2026.
04 / Next step
A scoping call in 2026 leads to an order from January 2027.
- Scoping call
45 minutes, online, in November or December 2026. We look at which Informationsverbund fits, which data route is possible and who your expert is.
- Scoping memo
Within ten working days of the call: scope, calendar, measures and price on one page.
- Order
From January 2027, under your rules.
Neither the call nor the memo creates an obligation.
Request a scoping call. We measure, you decide.
Leave your details. We reply by email within three working days with proposed times for a 45-minute call.