Skip to content 
Verschlusssachenanweisung (VSA)
Authorities and companies with public-sector contracts often work with information classified as VS. How to handle such information is regulated by the Verschlusssachenanweisung, VSA for short. It still applies when the devices on which classified information was stored are decommissioned.
In brief
The Verschlusssachenanweisung (VSA) is the administrative regulation of the Federal Ministry of the Interior on the material protection of classified information. It specifies how federal authorities mark, store, pass on, electronically process and destroy classified information. It is authoritative for IT retirement because data carriers with classified information must be erased or destroyed in such a way that unauthorized persons cannot reconstruct any content.
What does the VSA regulate?
The protection of classified information has two sides. Personnel protection checks who may be granted access to classified information. Material protection regulates how the classified information itself is protected. For the material part, the VSA applies at the federal level. It is a general administrative regulation based on the Security Clearance Act (SÜG) and exists in a version from 2023. The states have their own Verschlusssachenanweisungen, which are modeled on the federal one. Companies that work with classified information on behalf of the state generally receive the rules through their contract, for example as an information sheet.
The VSA recognizes four classification levels:
| Level of secrecy | Meaning (simplified) |
|---|---|
| VS – FOR SERVICE USE ONLY (VS-NfD) | Becoming known to unauthorized persons can be disadvantageous to the interests of the state |
| VS – CONFIDENTIAL | Becoming known to unauthorized persons can harm the interests of the state |
| SECRET | Becoming known can endanger the security or interests of the state or cause them serious harm |
| TOP SECRET | Becoming known can endanger the existence or vital interests of the state |
Among the principles of the VSA is the Need-to-know principle: only those who need classified information for their task are given knowledge of it. What a Classified information is exactly is explained in a separate entry.
What does the VSA mean for retired IT?
Classified information is often stored on work computers, servers, work phones and printers, mostly at level VS-NfD. When Aussonderung such devices, three questions arise:
- Recording: Which devices and data carriers have processed classified information? When in doubt, all data carriers in an area are treated this way.
- Transport and storage: How do data carriers remain protected against unauthorized access until erasure or destruction?
- Deletion or destruction: Which method is permitted, and how is it proven for each data carrier?
Which methods are permitted in a given case depends on the classification level and your internal requirements. For the erasure and destruction of classified information, the BSI has also published technical guidelines, such as the BSI guideline TL-03420. The decision is made by your security officer for classified information. The practical implementation for the most common level is described in our guide Decommissioning VS-NfD hardware.
Rule of thumb: With classified information, "erased" is not enough. It must be provable who treated which device, when and how.
Classified information at Second IT
Second IT processes and destroys data carriers with the classification level VS-NfD in accordance with the applicable guidelines. Destruction takes place in-house, according to DIN 66399, certified for security level H-5 and under video surveillance. The site is protected by access control and security zones. Employees are bound to data secrecy. Pickup is carried out with our own secure logistics: direct trip, GPS, sealing. For each device there is an erasure or destruction certificate. More on Data secrecy and VS-NfD.
The legal status of this entry corresponds to the status as of: 10/2026. This entry does not replace legal advice or coordination with your classified-information protection organization.
Frequently asked questions about the Verschlusssachenanweisung
Who does the Verschlusssachenanweisung apply to?
The federal VSA applies to federal authorities. The states have their own regulations. Companies that work with classified information on behalf of the state are bound to corresponding rules through their contract.
What does VSA mean in connection with IT?
In the protection of classified information, VSA stands for Verschlusssachenanweisung. Among other things, it regulates how classified information is processed electronically and how data carriers are erased or destroyed at the end of their use.
May devices with VS-NfD data be resold?
That depends on your requirements. If these permit verified erasure, functional devices can continue to be used after erasure. Otherwise, the data carriers are destroyed and only the remaining devices are recovered.
What is the difference between VS-NfD and VS-Vertraulich?
They are two of the four classification levels of the VSA. With VS-NfD, becoming known to unauthorized persons can be disadvantageous to the interests of the state. With VS-VERTRAULICH, it can harm the interests of the state. The level determines which methods are permitted.
Who decides how VS data carriers are decommissioned?
The decision is made by the security officer for classified information at your body. Which methods are permitted depends on the classification level and your internal requirements. What matters is that every step can be proven for each data carrier.
Securely decommission VS-NfD data carriers – destruction in-house, proof per serial number.
Send us your device list. You will receive your offer in 48 hours on average.