Expert Solutions for Secure Information Classification

VS-NfD Classification and Marking of Classified Information

Proper classification and marking of classified information is a critical building block of information security.

  • 01Standards-compliant classification and marking procedures
  • 02Systematic risk assessment and protection needs analysis
  • 03Automated classification tools and workflow integration
  • 04Comprehensive training and awareness programs
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

VS-NfD Classification and Marking of Classified Information

Correct classification and marking of classified information (VS-NfD) is a fundamental requirement for protecting sensitive information in government agencies and security-relevant organizations. A systematic approach ensures not only compliance but also operational efficiency in handling confidential documents.

We offer comprehensive support in developing, implementing, and optimizing VS-NfD classification systems. Our approach combines proven methods with effective technologies for maximum security and efficiency.

2 service modules

What we take on for you

Bookable individually or as an end-to-end programme.

01

VS-NfD Compliance Assessment and Strategy Development

We analyze your existing classification processes and develop a comprehensive strategy for compliant handling of classified information.

  • Detailed assessment of current classification practices
  • Identification of compliance gaps and security risks
  • Development of customized classification guidelines
  • Creation of a prioritized implementation roadmap
02

Technical Implementation and System Integration

We implement modern technology solutions for automated classification and integration into your existing IT landscape.

  • Development of automated classification and marking tools
  • Integration into document management systems and workflows
  • Implementation of tracking and audit functionalities
  • Building comprehensive monitoring and reporting systems

5 phases

Our Approach

Together with you, we develop a structured approach for secure and efficient classification and marking of classified information.

  1. Comprehensive analysis of existing information landscape and protection needs

  2. Development of a customized classification strategy and guidelines

  3. Implementation of technical solutions and process integration

  4. Training of employees and establishment of a security culture

  5. Continuous monitoring, evaluation, and optimization of classification processes

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
Proper classification and marking of classified information is more than just a compliance requirement – it is a strategic building block for protecting critical information and safeguarding national security interests.

Our Strengths

  • 01In-depth expertise in national and international classification standards
  • 02Long-standing experience in implementing VS-NfD systems in various agencies
  • 03Comprehensive approach from technical implementation to organizational development
  • 04Effective technology solutions for automated classification and compliance

Expert Tip

Successful VS-NfD implementation requires not only technical solutions but also a strong security culture and continuous awareness of all stakeholders for handling classified information.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about VS-NfD Classification and Marking of Classified Information

What are the four security classification levels in Germany?

Germany uses four classification levels under Section 4 of the Security Clearance Act (SÜG):

1. VS-NfD (For Official Use Only): Lowest level. Unauthorized disclosure may be disadvantageous to German interests.

2. VS-Vertraulich (Confidential): Unauthorized disclosure may be harmful to German interests.

3. Geheim (Secret): Unauthorized disclosure may endanger national security or cause serious damage.

4. Streng Geheim (Top Secret): Highest level. Unauthorized disclosure may threaten the existence or vital interests of Germany.

These levels correspond to NATO classifications: NATO Restricted, NATO Confidential, NATO Secret, and Cosmic Top Secret.

How must classified information be marked under the VSA?

The Verschlusssachenanweisung (VSA) prescribes strict marking rules:

• VS-NfD and VS-Vertraulich: Black or blue text marking on the upper page margin.
• Geheim and Streng Geheim: Red text with the note amtlich geheim gehalten on both upper and lower margins.

Required information includes the classification level, originating authority, file reference, and registry number. Electronic documents must carry the marking in both the filename and metadata. Private sector companies add auf amtliche Veranlassung geheimgehalten.

Who has the authority to classify information in Germany?

Classification authority rests with the originating government body:

• Federal and state authorities classify information according to its protection needs.
• The originating body bears responsibility for choosing the correct level and keeping it current.
• Private companies may only create and mark classified material on official instruction.
• Classifications must be reviewed regularly. VS-NfD classifications expire automatically after 30 years unless otherwise specified.

What does VS-NfD mean and what are the protection requirements?

VS-NfD stands for Verschlusssache

• Nur für den Dienstgebrauch (Classified
• For Official Use Only), the lowest German classification level. Unlike higher levels, no formal security clearance under the SÜG is required for access.

Protection requirements include:

• Access: Available to all agency employees in the course of their official duties.
• Storage: Locked rooms or containers; no safe requirements as with higher levels.
• IT Processing: Mobile devices and laptops must use BSI-approved encryption products.
• Destruction: Secure destruction per DIN 66399 at protection level P-3 or higher.

The BSI VS-NfD Merkblatt provides detailed practical handling guidelines.

What IT requirements apply to VS-NfD data processing?

VS-NfD data processing must comply with BSI (Federal Office for Information Security) requirements:

• Encryption: BSI-approved products per BSI TR‑02102 using AES‑256.
• Access control: Role-based permissions and two-factor authentication.
• Network security: Transmission only via approved VPN connections.
• Audit logging: Complete documentation of all access and processing events.
• Secure deletion: Per BSI guidelines.

Note the distinction between BSI Zulassung (operational approval for classified processing, granted exclusively by BSI) and BSI Zertifizierung (conformity certification per BSI Technical Guidelines, performed by accredited auditors).

How do German classification levels map to NATO and EU equivalents?

German levels follow a fixed international equivalency:

• VS-NfD = NATO Restricted / EU Restricted
• VS-Vertraulich = NATO Confidential / EU Confidential
• Geheim = NATO Secret / EU Secret
• Streng Geheim = Cosmic Top Secret / EU Top Secret

The Originator Principle applies: the issuing nation determines the classification. Downgrading or release may only be performed by the originator. EU classified documents are governed by Council Decision 2013/488/EU.

What role does the SÜG play in security clearance for classified information?

The Sicherheitsüberprüfungsgesetz (SÜG) governs personnel security clearance in Germany:

• Section 4 SÜG defines the four classification levels and their criteria.
• Sections 8‑10 SÜG establish three clearance levels: Ü1 (VS-Vertraulich), Ü2 (Geheim), Ü3 (Streng Geheim).
• VS-NfD requires no formal SÜG security clearance.
• The BfV (Federal Office for the Protection of the Constitution) and MAD (Military Counter-Intelligence Service) conduct clearance investigations.
• Private companies need a security notice (Sicherheitsbescheid) from the BMWi to participate in classified contracts.

Certificates, partners and more

ISO 9001 CertifiedISO 27001 CertifiedISO 14001 CertifiedBeyondTrust PartnerBVMW Bundesverband MitgliedMitigant PartnerGoogle PartnerTop 100 InnovatorMicrosoft AzureAmazon Web Services

Your strategic success starts here

Our clients trust our expertise in digital transformation, compliance, and risk management

Ready for the next step?

Schedule a strategic consultation with our experts now

30 Minutes • Non-binding • Immediately available

For optimal preparation of your strategy session:

Your strategic goals and challenges
Desired business outcomes and ROI expectations
Current compliance and risk situation
Stakeholders and decision-makers in the project

Prefer direct contact?

Direct hotline for decision-makers

Strategic inquiries via email

Detailed Project Inquiry

For complex inquiries or if you want to provide specific information in advance