VS-NfD: Requirements and Consulting for Companies
VS-NfD stands for “Verschlusssache – Nur für den Dienstgebrauch”, the German classification for restricted government information. If the VS-NfD guidance sheet (Merkblatt) is attached to your contract, its obligations apply from the moment you sign the commitment declaration – for roles, staff, documents and IT. We get your company to that point: with an ISMS under ISO 27001 or TISAX® we start from the gap, without an ISMS we build exactly what the guidance sheet requires.
What does VS-NfD mean?
VS-NfD is the lowest of four German classification levels for government information – and by far the most common one in industry. Above it are VS-VERTRAULICH, GEHEIM and STRENG GEHEIM. Unlike the higher levels, VS-NfD does not reach companies through a formal procedure but through the contract: the contracting authority attaches the guidance sheet, you sign the commitment declaration, and from then on the requirements apply to your company.
The basis is the VS-NfD guidance sheet (VS-NfD-Merkblatt) of the German Federal Ministry for Economic Affairs and Energy (BMWE), Annex 4 to the Security Manual (Geheimschutzhandbuch), in force since 1 September 2023. A security clearance of your staff or a classified-information procedure by the ministry is expressly not required for VS-NfD – the obligations lie with you as a company.
When you are affected
A contract with a commitment declaration
The contracting authority attaches the VS-NfD guidance sheet and requires you to sign the commitment declaration. From then on, all requirements of the guidance sheet apply to your company – without a transition period.
Supplier to a defense or public-sector project
Drawings, technical documents, project plans or tender documents carry the marking. Whoever receives them handles them under the same rules as the main contractor – the obligations are passed down the supply chain.
Entering from the automotive supply chain
TISAX® protects trade secrets between private partners. VS-NfD is state classified-information protection with its own legal basis – a different catalogue, different roles, different consequences in case of violations.
What the VS-NfD guidance sheet requires
| Obligation | What it means | Reference |
|---|---|---|
| Responsible person | You appoint a person responsible for VS-NfD and, where appropriate, a deputy. This person instructs and commits staff, approves IT systems, work areas and home-office workplaces, obtains consent for disclosures and monitors compliance – including at subcontractors. | Part 1a, no. 4.4 |
| Instruction and commitment | Before a person gets access to VS-NfD, they are instructed on Part 2 of the guidance sheet and committed to comply with it – with IT access additionally on Part 3. You keep the signed record and present it on request; it must be destroyed no later than five years after the person leaves. | Part 1a, no. 4.2 |
| Need to know | Only those who need access to perform their tasks get it. VS-NfD may only be passed to third parties with prior, documented consent of the issuer – obtained via your contracting authority. This also applies if third parties could gain access during maintenance or repair. | Part 2, nos. 1.2 and 6.3 |
| Marking and storage | The classification level, written out in full, appears at the top of every document. When not in use, VS-NfD is kept in locked containers or rooms – not on the desk, not in an open printer. | Part 4, no. 1; Part 2, no. 5 |
| Destruction and loss | Destruction must make the content unrecognizable and unrecoverable – using products, procedures or service providers that meet BSI requirements. Loss and violations are reported immediately to the responsible person and from there to the contracting authority. | Part 2, nos. 8 and 1.4 |
| IT processing | Two variants: a technically isolated IT system (single workstation or isolated network) or a VS-NfD network with physical or approved segment separation. Electronic transmission only encrypted with IT security products approved by the BSI, also on mobile devices. Approval before first use, no private IT, administration in principle by your own staff. | Part 3, nos. 2, 3.1, 3.4 and 3.7 |
| Self-accreditation | At least every three years, the responsible person confirms to management in writing that the IT requirements are implemented – including the declaration on the ISMS: via IT-Grundschutz, via ISO 27001 based on IT-Grundschutz or via an ISO 27001 certificate with a gap analysis against IT-Grundschutz. The first self-accreditation was due by 1 September 2025; on request you present it to the contracting authority or the BMWE. | Part 3, no. 5 |
| Mobile working | Purely electronic processing in a private home is permitted – with approved IT, consent of the responsible person, a home located in Germany, instruction on the risks and a signed agreement under Part 6. Paper documents in principle do not go home. | Part 3, no. 3.5; Part 2, no. 7 |
| Consequences | Violations can be prosecuted under Sections 93 to 99, 203(2) and 353b of the German Criminal Code (StGB) – even after employment has ended. For the company, the contract itself is also at stake. | Part 2, no. 1.3 |
For IT-Grundschutz users, the BSI module CON.11.1 “Geheimschutz VS-NfD” describes the technical side. The BSI lists approved products in its list of approved IT security products.
What your ISMS already covers
A working ISO 27001 or TISAX® system is the right foundation. It does not replace the guidance sheet – which is why we start from the gap.
- Access and authorization concept, need-to-know as a principle
- Encryption, handling of mobile devices, deletion concept
- Awareness and training process
- Supplier management and confidentiality agreements
- Incident management and reporting channels
- Document control, internal audits, management review
What VS-NfD adds
Without an ISMS this list applies in full – plus, depending on the IT variant, IT-Grundschutz for the VS-NfD area.
- The responsible person, where appropriate with a deputy, and time for the role
- Instruction and commitment of every single person, with a record
- Marking, locked storage, controlled destruction
- Disclosure process with the issuer's consent, passing the obligations on to subcontractors
- An approved IT environment with BSI-approved products, administered by your own staff – common cloud and collaboration platforms are not intended for this in their standard configuration
- Home-office agreement under Part 6 and approval of devices
- The self-accreditation: written confirmation to management, at least every three years
The most common mistake: signing the guidance sheet, starting the contract and catching up on implementation later. The obligation applies from signature, and your contracting authority can check at any time. Our recommendation, not a requirement of the guidance sheet: a simple register of which documents are where and with whom. A formal classified registry is only required from VS-VERTRAULICH upwards.
VS-NfD self-check: 14 questions, fifteen minutes
The obligations of the guidance sheet as a checklist, each with its reference – to go through with the person responsible for the contract and your IT. At the end you know whether you can sign the commitment declaration or what needs to be done first. Select „VS-NfD-Selbstcheck“ in the form – you receive the download link by e-mail. The request form and the self-check are in German.
Our approach to VS-NfD consulting
Four steps, in this order. The result is a company that can sign the commitment declaration without promising anything it cannot keep.
1. Assessment and scope
Which contracts and documents carry the marking, which people, rooms and systems are involved. Comparison with your existing ISMS or, if there is none, defining the path there – half a day, remote or on site.
2. Gap analysis against the guidance sheet
Part by part, number by number: what is fulfilled, what is missing, what is only fulfilled on paper. We determine the right IT variant and prepare the gap analysis against IT-Grundschutz if your ISMS is evidenced by an ISO 27001 certificate. The result is a prioritized list of measures with effort and sequence.
3. Implementation
Role and mandate of the responsible person, commitments and records, the processes for marking, storage, disclosure, destruction and loss reporting, the home-office arrangement. For IT: architecture decision, selection of approved products and approval – together with your IT or your service provider.
4. Training, records, audit readiness
Training of the responsible person and their deputy, instruction and commitment of all affected staff, preparation of the self-accreditation for management and an evidence package for the contracting authority. On request, we accompany the first review by the contracting authority.
What you receive
- Gap report with an executive summary for management
- Prioritized list of measures and implementation plan
- Document set: role description, commitment and instruction documents, process descriptions, home-office agreement
- IT concept with architecture decision and product list for approval
- Training of the responsible person and their deputy – initial session on site, annual refresher
- Instruction of staff – in person or as e-learning
- Evidence package for the contracting authority, including the prepared self-accreditation
Optional: ongoing support of the responsible person by our external information security officer – preparing the self-accreditation, controls, support during incidents –, an annual internal review of the VS-NfD obligations, awareness training and phishing simulation for the affected group of people.
Training for the responsible person
The responsible person approves systems, receives loss reports and signs the self-accreditation. The guidance sheet does not prescribe a formal qualification for this – the role still needs confidence. Our training covers role and authority, instruction and commitment with record-keeping, marking, storage, disclosure, destruction and loss reporting, the IT side of the role (variants, approved products, external administration, approvals) and the self-accreditation. Format: one day on site for the responsible person and deputy together, followed by an annual refresher. You receive a certificate of attendance from 360DT; there is no official qualification for the role. Training uses only the public guidance sheet and fictitious examples.
Why 360DT
We build and support information security management systems under ISO 27001 and TISAX® – as consultants, as external information security officer and as auditors, including for corporate groups with several companies and sites. For VS-NfD this means: we work through the gap between your system and the guidance sheet, number by number, instead of setting up a second management system next to it. The result is an evidence package your contracting authority can review. We are ISO 27001 certified ourselves.
Frequently asked questions about VS-NfD
Do our employees need a security clearance?
No. For VS-NfD, neither a classified-information procedure by the Federal Ministry for Economic Affairs and Energy nor security clearances are required (guidance sheet Part 1a, no. 3.1). What is required is the instruction and commitment of every person before they get access. A security clearance is only required from the VS-VERTRAULICH level upwards.
We are ISO 27001 certified. Is that enough for VS-NfD?
As a foundation yes, as evidence not on its own. In the self-accreditation, the company declares that an ISMS is established in one of three ways: IT-Grundschutz, an ISO 27001 certificate based on IT-Grundschutz, or an ISO 27001 certificate on another basis with a gap analysis against IT-Grundschutz (mapping table), provided at least an equivalent security level is ensured (Part 3, no. 5). Most certified companies are in the third case – and therefore have an analysis still to prepare. On top of that come the points ISO 27001 does not cover: the appointed responsible person, the personal commitment of every employee with a record, marking and locked storage, the issuer's consent before any disclosure to third parties and IT with BSI-approved products.
We do not have an ISMS yet. Is VS-NfD still possible?
Yes. The organizational obligations of the guidance sheet – responsible person, instruction, marking, storage, disclosure, destruction – apply regardless and do not need an ISMS. For IT, the guidance sheet sets the scope by variant: for a technically isolated single workstation, applying IT-Grundschutz is expressly not required (Part 3, no. 2.1.1); for an isolated network only if it is operated across sites; and for a VS-NfD network connected to the rest of the network with basic and standard requirements (no. 2.2). Keeping processing small keeps the setup small; we agree the depth the self-accreditation then requires with your contracting authority. If you expect further public contracts or NIS-2 obligations anyway, use the occasion for a full ISMS.
Can 360DT provide the responsible person?
We do not recommend it. The responsible person approves systems, receives loss reports and signs the self-accreditation – this needs authority within the company and presence on site. In addition, external consultants may only gain knowledge of VS-NfD with the issuer's consent (Part 2, no. 6.3). We therefore train your responsible person and their deputy and support them on an ongoing basis: the role and the signature stay with you, the work is shared.
May we process VS-NfD in Microsoft 365 or another cloud?
Not in the standard configuration. The guidance sheet only knows technically isolated systems or a VS-NfD network with physical or approved segment separation, and every transmission needs an IT security product approved by the BSI (Part 3, nos. 2 and 3.4.1). If the VS-NfD network is connected to the rest of the network, malware scanning must expressly not take place outside the VS-NfD network, for example in the cloud (no. 2.2). Administration in principle lies with your own staff (no. 3.7). In practice this means a separate, approved environment for the VS-NfD share, which is small at most companies.
Is working from home possible with VS-NfD?
For purely electronic processing, yes – if the IT used is approved, the responsible person has consented, the home is located in Germany, the person has been instructed on the risks of mobile working and the agreement under Part 6 has been signed (Part 3, no. 3.5). Paper documents may in principle not be taken home for processing; the public contracting authority can allow exceptions (Part 2, no. 7).
What happens in case of a violation of the guidance sheet?
Violations can be prosecuted under Sections 93 to 99, 203(2) and 353b of the German Criminal Code (Part 2, no. 1.3) – for the person acting, even after employment has ended. For the company, exclusion from the contract and the loss of the client come on top.
Who must be instructed – and how long do we keep the record?
Every person before they get access or a possibility of access to VS-NfD (Part 1a, no. 4.2) – including deputies, trainees and external staff. You keep the signed record and present it on request; it must be destroyed no later than five years after the person leaves.
How long does implementation take?
That depends on your starting point. With a working ISMS, the effort lies mainly in the VS-NfD-specific points – role, commitments, processes, records and the separate IT environment. The organizational part can usually be done within weeks; the IT environment takes longer. We tell you how long it will take for you after the initial consultation, not before.
Where do you stand?
In a free 45-minute initial consultation we clarify which of your contracts are affected, what your ISMS already covers and which points of the guidance sheet are open. Afterwards you know whether you can sign the commitment declaration – and what needs to be done by then. We advise in English and German.
Book a free initial consultation
Sources: VS-NfD guidance sheet (Merkblatt für die Behandlung von Verschlusssachen des Geheimhaltungsgrades VS-NUR FÜR DEN DIENSTGEBRAUCH), Federal Ministry for Economic Affairs and Energy, Annex 4 to the Security Manual, in force since 1 September 2023 · BMWE FAQ on the VS-NfD guidance sheet (as of 05/2026, in German) · BSI list of approved IT security products · BSI IT-Grundschutz Compendium, module CON.11.1.