Question 1

What are the four security classification levels in Germany?

Accepted Answer

Germany uses four classification levels under Section 4 of the Security Clearance Act (SÜG):

1. VS-NfD (For Official Use Only): Lowest level. Unauthorized disclosure may be disadvantageous to German interests.

2. VS-Vertraulich (Confidential): Unauthorized disclosure may be harmful to German interests.

3. Geheim (Secret): Unauthorized disclosure may endanger national security or cause serious damage.

4. Streng Geheim (Top Secret): Highest level. Unauthorized disclosure may threaten the existence or vital interests of Germany.

These levels correspond to NATO classifications: NATO Restricted, NATO Confidential, NATO Secret, and Cosmic Top Secret.

Question 2

How must classified information be marked under the VSA?

Accepted Answer

The Verschlusssachenanweisung (VSA) prescribes strict marking rules:

• VS-NfD and VS-Vertraulich: Black or blue text marking on the upper page margin.

• Geheim and Streng Geheim: Red text with the note amtlich geheim gehalten on both upper and lower margins.

Required information includes the classification level, originating authority, file reference, and registry number. Electronic documents must carry the marking in both the filename and metadata. Private sector companies add auf amtliche Veranlassung geheimgehalten.

Question 3

Who has the authority to classify information in Germany?

Accepted Answer

Classification authority rests with the originating government body: - Federal and state authorities classify information according to its protection needs. - The originating body bears responsibility for choosing the correct level and keeping it current. - Private companies may only create and mark classified material on official instruction. - Classifications must be reviewed regularly. VS-NfD classifications expire automatically after 30 years unless otherwise specified.

Question 4

What does VS-NfD mean and what are the protection requirements?

Accepted Answer

VS-NfD stands for Verschlusssache - Nur für den Dienstgebrauch (Classified - For Official Use Only), the lowest German classification level. Unlike higher levels, no formal security clearance under the SÜG is required for access. Protection requirements include: - Access: Available to all agency employees in the course of their official duties. - Storage: Locked rooms or containers; no safe requirements as with higher levels. - IT Processing: Mobile devices and laptops must use BSI-approved encryption products. - Destruction: Secure destruction per DIN 66399 at protection level P-3 or higher. The BSI VS-NfD Merkblatt provides detailed practical handling guidelines.

Question 5

What IT requirements apply to VS-NfD data processing?

Accepted Answer

VS-NfD data processing must comply with BSI (Federal Office for Information Security) requirements:

• Encryption: BSI-approved products per BSI TR‑02102 using AES‑256.

• Access control: Role-based permissions and two-factor authentication.

• Network security: Transmission only via approved VPN connections.

• Audit logging: Complete documentation of all access and processing events.

• Secure deletion: Per BSI guidelines.

Note the distinction between BSI Zulassung (operational approval for classified processing, granted exclusively by BSI) and BSI Zertifizierung (conformity certification per BSI Technical Guidelines, performed by accredited auditors).

Question 6

How do German classification levels map to NATO and EU equivalents?

Accepted Answer

German levels follow a fixed international equivalency:

• VS-NfD = NATO Restricted / EU Restricted

• VS-Vertraulich = NATO Confidential / EU Confidential

• Geheim = NATO Secret / EU Secret

• Streng Geheim = Cosmic Top Secret / EU Top Secret

The Originator Principle applies: the issuing nation determines the classification. Downgrading or release may only be performed by the originator. EU classified documents are governed by Council Decision 2013/488/EU.

Question 7

What role does the SÜG play in security clearance for classified information?

Accepted Answer

The Sicherheitsüberprüfungsgesetz (SÜG) governs personnel security clearance in Germany: - Section 4 SÜG defines the four classification levels and their criteria. - Sections 8-10 SÜG establish three clearance levels: Ü1 (VS-Vertraulich), Ü2 (Geheim), Ü3 (Streng Geheim). - VS-NfD requires no formal SÜG security clearance. - The BfV (Federal Office for the Protection of the Constitution) and MAD (Military Counter-Intelligence Service) conduct clearance investigations. - Private companies need a security notice (Sicherheitsbescheid) from the BMWi to participate in classified contracts.

VS-NfD Classification and Marking of Classified Information

Your strategic success starts here

For optimal preparation of your strategy session:

Certifications, Partners and more...