VS-NFD Audit Trails & Logging

A VS-NfD audit trail is the complete, tamper-proof record of all access, changes, and handovers of classified information graded "VS — Nur fuer den Dienstgebrauch" (Restricted). The German Classified Information Directive (VSA) requires that every interaction with classified material is documented in a traceable manner. Without a functioning audit trail, organisations face findings in security clearance audits and, in serious cases, loss of their authorisation to handle classified information.

A tamper-proof audit trail for VS-NfD classified information must capture at minimum: who accessed the material (user ID, role), when (timestamp), which document (reference number, classification level), what action was performed (read, edit, handover, print, deletion), and from which system (IP address, device). Additionally, the business context should be documented, such as the reason for access. All entries must be stored immutably to prevent tampering.

VS-NfD logging is subject to stricter requirements than general IT logging. The Classified Information Directive additionally requires capturing the classification level, traceability of the chain of custody, and tamper-proof storage. The log data itself may be classified as VS-NfD and requires corresponding protection. Special retention periods and access rules apply that go beyond the requirements of GDPR or BSI IT-Grundschutz.

Integration starts with an inventory of all systems processing VS-NfD documents (DMS, email, file servers, specialist applications). A logging concept is created for each system that automatically captures the required log data and forwards it to a central SIEM system. The key is that logging runs in the background without hindering employees. Existing access controls are extended with audit hooks so that every access is captured automatically.

There is no single statutory retention period for VS-NfD log data, but the Classified Information Directive requires traceability for the entire lifetime of the classified document. In practice, this means audit trail data must be retained at least as long as the classified material itself remains classified. For many organisations, this is 10 to 30 years. Retention must be tamper-proof, and the log data itself is subject to security clearance requirements.

Structured audit trail documentation significantly reduces the effort required for security clearance audits. Ensure you can present a complete access history for every classified document. Produce regular reports on access statistics and anomalies. Conduct internal mock audits in which you spot-check audit trails. This allows you to identify gaps before the actual audit and close them in time.

Gaps in audit trails during a security clearance audit lead to formal findings and remediation requirements. In serious cases, the organisation's reliability under the Security Clearance Act (SUeG) may be questioned, which can result in loss of authorisation to handle classified information. For organisations that depend on VS-NfD contracts, this means losing their business foundation. This is why preventive measures and regular internal reviews are essential.