VS-NFD Reporting Obligations Authority Communication

Companies under classified information protection (Geheimschutzbetreuung) must report various events to the BMWi (Division for Industrial Security). These include: changes in the Security Officer (SiBe) or their deputy, changes in corporate legal form or shareholder structure, loss or compromise of classified information, security-relevant incidents such as break-ins or unauthorized access to classified areas, and significant changes to premises where classified information is processed or stored. The legal basis is the Security Screening Act (S�G) and the Handbook of Industrial Security (GHB) with its annexes.

The central contact for security-cleared companies is the Division for Industrial Security at the Federal Ministry for Economic Affairs and Climate Action (BMWi). Depending on the type of incident, other authorities may be relevant: the Federal Office for Information Security (BSI) for IT security incidents, the Federal Office for the Protection of the Constitution (BfV) for espionage or sabotage indications, and state-level constitutional protection authorities for regional incidents. For VS-NfD without formal security clearance, the classified information issuer (contracting authority) is the primary contact.

For VS-NfD without Geheimschutzbetreuung (formal classified information protection), a contractual commitment to comply with the VS-NfD information sheet (Annex

4 of the GHB) is sufficient. No formal security clearance procedure, security screening, or visitor registration is required. For higher classification levels (VS-Vertraulich and above) or when the contracting authority requires it, formal Geheimschutzbetreuung through the BMWi is mandatory. This entails more comprehensive reporting obligations, including appointing a Security Officer, regular personnel security screenings, and full compliance with all GHB requirements.

Deadlines vary depending on the type of reportable event. Security incidents such as loss or compromise of classified information must be reported immediately, without culpable delay. Structural changes such as shareholder changes or corporate restructuring must be reported in advance of becoming effective, so that Geheimschutzbetreuung remains uninterrupted. Personnel changes involving the Security Officer must also be communicated promptly. We recommend setting up an internal reporting calendar with reminder functions to ensure no deadline is missed.

ADVISORI advises security-cleared companies on establishing structured communication processes with BMWi, BSI, and constitutional protection authorities. This includes creating reporting templates and communication protocols, preparing for inspections and audits by authorities, training the Security Officer and their deputy in proper authority communication, and supporting comprehensive documentation of all reportable events in accordance with GHB requirements.

Violations of reporting obligations in classified information protection can have severe consequences. The BMWi can withdraw Geheimschutzbetreuung, meaning the company can no longer accept classified contracts. Loss or compromise of classified information can result in criminal prosecution under Section 353b of the German Criminal Code (violation of official secrecy) with imprisonment of up to five years. Additionally, losing Geheimschutzbetreuung can cause significant economic damage, as ongoing contracts are jeopardized and new classified contracts become impossible.

The VS-NfD information sheet (Annex

4 of the Handbook of Industrial Security) governs the handling of classified information at the lowest classification level. It requires that all authorized persons must be verifiably informed about the information sheet. The VS-NfD responsible person in the company must exclude persons who prove unsuitable from access and report this to the VS-NfD contracting authority. In case of incidents where the confidentiality of VS-NfD information may have been compromised, the contracting authority must be informed immediately.