What is the difference between classic IT baseline protection and Grundschutz++ style requirement structuring?

Classic baseline protection tends to organise controls around predefined building blocks, while Grundschutz++ emphasises a clearer must, should, can structure tied to target objects. The practical difference is governance clarity. Teams can distinguish non negotiable requirements from guidance and optional measures more easily, which supports prioritisation, transitional planning, and more consistent implementation across complex environments.

Why This Matters for Security Teams

Classic baseline protection is effective when the main goal is to catalogue common safeguards, but it can become ambiguous when teams need to separate mandatory requirements from advisory measures. Grundschutz++ style structuring is designed to reduce that ambiguity by making the hierarchy of obligation explicit, which helps security, audit, and operations teams align on what must be implemented now versus what can be planned later. That matters most in large environments where control ownership is split across infrastructure, application, and governance functions.

This is not just a documentation issue. When requirements are grouped only by module or building block, teams can lose sight of priority, exception handling, and transitional state. NHI Mgmt Group has repeatedly shown that governance gaps persist when organisations do not know how to operationalise identity controls at scale, including cases where 68% of organisations do not know how to fully address NHI risks, as discussed in the Ultimate Guide to NHIs. The same lesson applies to control structuring: clarity drives execution.

Security teams also benefit when requirement language maps cleanly to implementation and assurance. That is why many practitioners compare this shift with the control discipline seen in the NIST Cybersecurity Framework 2.0 and its emphasis on governance, risk ownership, and repeatable outcomes. In practice, many security teams encounter control failures only after an audit dispute or implementation delay has already exposed the gap, rather than through intentional requirement design.

How It Works in Practice

Classic IT baseline protection usually starts from predefined building blocks, then assigns controls to those blocks so organisations can apply a consistent minimum standard. The Grundschutz++ style approach keeps that structure, but makes the requirement grammar more explicit. A control is not just a line item; it is classified by obligation level, typically along the lines of must, should, and can, and then tied more directly to the target object or scenario it governs.

In operational terms, that means teams can treat requirements differently during planning and assurance. Must requirements become non negotiable implementation items. Should requirements become risk-managed expectations that may allow justified deviation. Can requirements become optional enhancements that support maturity rather than minimum compliance. This makes the control set easier to use for:

• Prioritising remediation backlogs
• Documenting compensating controls and exceptions
• Sequencing transitional projects across legacy and modern systems
• Separating audit evidence for mandatory versus recommended measures

The same logic aligns with more formal control libraries such as NIST SP 800-53 Rev. 5 Security and Privacy Controls, where control intent, enhancement, and implementation detail are distinguished for governance purposes. On the NHI side, the practical lesson is similar: the Schneider Electric credentials breach shows how unclear ownership and delayed enforcement can turn a control concept into a real exposure.

This approach works best when asset inventories, target object definitions, and risk acceptance workflows are already mature. These controls tend to break down when organisations lack a reliable inventory of systems and exceptions because the must, should, can structure becomes difficult to apply consistently.

Common Variations and Edge Cases

Tighter requirement structuring often increases governance overhead, requiring organisations to balance clarity against the cost of classification, review, and documentation. That tradeoff is real: the more precisely a framework distinguishes obligation levels, the more effort is needed to keep mappings current as systems and risks change.

Best practice is evolving on how far this granularity should go. Some teams prefer a leaner structure that keeps only a small number of mandatory items, while others want detailed dependency tagging for each target object. There is no universal standard for this yet, so the right level of detail depends on whether the main problem is inconsistent implementation, audit friction, or too much local interpretation.

In environments with federated ownership, the must/should/can model can be especially helpful because it reduces ambiguity during control handoff. In highly regulated settings, it may also improve exception governance by making deviations explicit instead of implied. Still, if the organisation cannot keep its control catalogue aligned to actual architecture, the additional structure can become bureaucratic rather than useful. That is why teams should treat requirement structuring as an operating model decision, not just a documentation preference.

Related resources from NHI Mgmt Group

• How should organisations structure IT GRC requirements when moving from classic baseline protection to a must, should, can model?
• What is the difference between attack surface management and NHI governance?
• What is the difference between reviewing human access and reviewing NHIs?
• What is the difference between role-based access and API key governance for NHI security?