Verschlusssache (VS)

Authorities, the German armed forces and many suppliers work with information classified as VS. When computers or data carriers with such content are retired, special rules apply. This entry explains what classified information is, which classification levels exist and what matters when decommissioning.

What is classified information?

The definition is found in § 4 of the Security Clearance Act (Sicherheitsüberprüfungsgesetz, SÜG). Information is classified as VS if its becoming known to unauthorized persons can harm the Federation or a state. This concerns, for example, security concepts, operational plans, parts of administrative IT or documents from defense projects. Classification is carried out by the body that creates or issues the information.

How to handle VS is regulated for federal authorities by the Classified Information Instruction (VSA), currently in the version of March 2023. The states have their own regulations. Companies that work with VS on behalf of the state are integrated via the Protection of classified information in industry.

The four classification levels

Level	Classification if its becoming known to unauthorized persons …
TOP SECRET	can endanger the existence or vital interests of the Federal Republic or a state
SECRET	can endanger the security of the Federal Republic or a state or cause serious harm to its interests
VS-VERTRAULICH	can be harmful to the interests of the Federal Republic or a state
VS-NUR FÜR DEN DIENSTGEBRAUCH (VS-NfD)	can be disadvantageous to the interests of the Federal Republic or a state

VS-NfD is the lowest and by far the most common level. Comparatively simple rules apply to it. From VS-VERTRAULICH upward, the requirements rise significantly, for example for personnel, rooms and approved products. Access is granted only to those who need the information for their task (Need-to-know principle).

Classified information on retired IT

Even after use has ended, a VS remains classified until it has been erased or destroyed. Anyone decommissioning IT devices must therefore know which level was on which data carriers. For the erasure and destruction of information requiring protection, the BSI guideline TL-03420 is authoritative. Seamless documentation is also important: which data carrier was treated when, how and by whom?

How authorities concretely decommission VS-NfD hardware, from inventory to the certificate of destruction, is described in our guide Decommissioning VS-NfD hardware.

VS-NfD at Second IT

Second IT processes data carriers in compliance with VS-NfD. All employees are bound to data secrecy, and the processing areas are access-controlled and under video surveillance. Pickup is carried out with our own secure logistics, sealed and without intermediate storage. Erasure is done with Blancco; data carriers that cannot be erased are destroyed in-house according to DIN 66399, certified for security level H-5. More on Data secrecy and confidentiality.

Frequently asked questions about classified information

What does VS-NfD mean?

VS-NfD stands for "VS-NUR FÜR DEN DIENSTGEBRAUCH" (classified, for official use only). It is the lowest of the four classification levels. It applies to information whose becoming known to unauthorized persons can be disadvantageous to the interests of the Federation or a state.

Who determines whether something is classified information?

The body that creates or issues the information classifies it. It also determines the classification level and can later change or lift the classification.

May data carriers with classified information be erased instead of destroyed?

That depends on the classification level and the requirements of the respective authority. The BSI guideline TL-03420 describes requirements for erasure and destruction. Clarify in advance with the responsible body which method is approved.

Which classification levels exist for classified information?

There are four levels: VS-NUR FÜR DEN DIENSTGEBRAUCH, VS-VERTRAULICH, GEHEIM and STRENG GEHEIM. The level depends on how severe the damage would be if unauthorized persons knew the information. From VS-VERTRAULICH upward, the requirements rise significantly.

What does the Verschlusssachenanweisung (VSA) regulate?

For federal authorities, the VSA regulates how to handle classified information. It currently applies in the version of March 2023. The states have their own regulations. Companies that work with VS on behalf of the state are integrated via the protection of classified information in industry.