VS-NFD Readiness

VS-NfD stands for Verschlusssachen – Nur für den Dienstgebrauch (Classified Information – For Official Use Only) and is the lowest classification level in Germany. It applies to all companies that handle classified information as part of public sector contracts or defense industry work. This includes suppliers, IT service providers and consulting firms that need access to VS-NfD material.

The VS-NfD directive (GHB Annex 4) defines requirements across three pillars: personnel security (security vetting, briefings), physical protection (access controls, secure storage, classification marking) and IT security (network segmentation, encryption, approved products). All three areas must be fully implemented and documented.

In the self-accreditation process, the person responsible for VS-NfD within the company confirms in writing to management that all requirements of the VS-NfD directive have been fully implemented. This confirmation must be renewed every three years. Complete documentation of all measures is a prerequisite.

Preparation typically takes

6 to

12 months, depending on the current maturity level of the organisation. The gap analysis takes approximately

2 to

4 weeks, followed by implementation of personnel, physical and IT security measures, along with the required documentation.

VS-NfD-compliant IT security requires, among other things: use of approved products (BSI-certified), network separation between VS-NfD and standard networks, encrypted data transmission and storage, access controls and logging, as well as regular review of security measures.

Security clearance administration (Geheimschutzbetreuung) refers to the ongoing supervision by the Federal Ministry for Economic Affairs (BMWK) for companies working with classified information. VS-NfD compliance refers to the specific implementation of all requirements for the lowest classification level. Not all companies subject to VS-NfD requirements are under formal security clearance administration.

ADVISORI guides the entire readiness process: we begin with a gap analysis based on the VS-NfD directive, create an implementation plan for all three pillars, support the introduction of security measures and procedural instructions, prepare the documentation for self-accreditation, and assist with communication with the relevant authorities.