VS-NfD Classification and Marking of Classified Information

Germany uses four classification levels under Section

4 of the Security Clearance Act (SÜG):1. VS-NfD (For Official Use Only): Lowest level. Unauthorized disclosure may be disadvantageous to German interests.2. VS-Vertraulich (Confidential): Unauthorized disclosure may be harmful to German interests.3. Geheim (Secret): Unauthorized disclosure may endanger national security or cause serious damage.4. Streng Geheim (Top Secret): Highest level. Unauthorized disclosure may threaten the existence or vital interests of Germany.These levels correspond to NATO classifications: NATO Restricted, NATO Confidential, NATO Secret, and Cosmic Top Secret.

The Verschlusssachenanweisung (VSA) prescribes strict marking rules:- VS-NfD and VS-Vertraulich: Black or blue text marking on the upper page margin.- Geheim and Streng Geheim: Red text with the note amtlich geheim gehalten on both upper and lower margins.Required information includes the classification level, originating authority, file reference, and registry number. Electronic documents must carry the marking in both the filename and metadata. Private sector companies add auf amtliche Veranlassung geheimgehalten.

Classification authority rests with the originating government body:- Federal and state authorities classify information according to its protection needs.- The originating body bears responsibility for choosing the correct level and keeping it current.- Private companies may only create and mark classified material on official instruction.- Classifications must be reviewed regularly. VS-NfD classifications expire automatically after

30 years unless otherwise specified.

VS-NfD stands for Verschlusssache

66399 at protection level P-3 or higher.The BSI VS-NfD Merkblatt provides detailed practical handling guidelines.

VS-NfD data processing must comply with BSI (Federal Office for Information Security) requirements:- Encryption: BSI-approved products per BSI TR‑02102 using AES‑256.- Access control: Role-based permissions and two-factor authentication.- Network security: Transmission only via approved VPN connections.- Audit logging: Complete documentation of all access and processing events.- Secure deletion: Per BSI guidelines.Note the distinction between BSI Zulassung (operational approval for classified processing, granted exclusively by BSI) and BSI Zertifizierung (conformity certification per BSI Technical Guidelines, performed by accredited auditors).

German levels follow a fixed international equivalency:- VS-NfD = NATO Restricted / EU Restricted- VS-Vertraulich = NATO Confidential / EU Confidential- Geheim = NATO Secret / EU Secret- Streng Geheim = Cosmic Top Secret / EU Top SecretThe Originator Principle applies: the issuing nation determines the classification. Downgrading or release may only be performed by the originator. EU classified documents are governed by Council Decision 2013/488/EU.

The Sicherheitsüberprüfungsgesetz (SÜG) governs personnel security clearance in Germany:- Section

4 SÜG defines the four classification levels and their criteria.- Sections 8–10 SÜG establish three clearance levels: Ü

1 (VS-Vertraulich), Ü

2 (Geheim), Ü

3 (Streng Geheim).- VS-NfD requires no formal SÜG security clearance.- The BfV (Federal Office for the Protection of the Constitution) and MAD (Military Counter-Intelligence Service) conduct clearance investigations.- Private companies need a security notice (Sicherheitsbescheid) from the BMWi to participate in classified contracts.