Defense:
classification, mobile platforms, supply chain
Which rules apply to IT in German defense?
For the Bundeswehr, the German armed forces, classified-information protection matters more than NIS2. Under Section 29(3) of the German BSI Act (BSIG), the remit of the Federal Ministry of Defence is additionally exempt from Sections 30, 33 and 35, which include the risk management measures and the registration duty (BSIG as amended on 6 December 2025). What applies instead is classification under Section 4 of the German Security Clearance Act (SÜG) and the German classified-information directive (VSA): products that perform IT security functions to protect classified information must be approved (BSI, notes on the list of approved products).
Defense contractors are in a different position. They fall under the BSI Act if they themselves meet the criteria of an essential or important entity under Section 28 BSIG. In that case the minimum measures of Section 30 apply as well, down to secured voice, video and text communication. According to the BSI, companies under German industrial security oversight that handle classified information from public contracts take approval questions to the Federal Ministry for Economic Affairs.
How do you mark emails and documents to the NATO or BUND scheme?
With classification that works where people write. ISEC7 CLASSIFY runs as an add-in in Outlook, Outlook on the web, Word, Excel, PowerPoint and SharePoint Pages, and on iOS and Android in the ISEC7 MAIL app. Users apply the marking themselves while the rule set decides what is allowed: no email leaves without a classification, and untrusted recipient domains can be blocked.
ISEC7 ships standard schemes for BUND (German federal government), NATO and Traffic Light. Several schemes can be active at once, for example a corporate scheme alongside NATO. Custom schemes, configuration and reporting are managed centrally in ISEC7 SPHERE. The schemes reproduce marking rules; they do not carry any approval by the BSI or NATO. More on ISEC7 CLASSIFY
Which mobile platforms are approved for VS-NfD and NATO RESTRICTED?
On iPhone and iPad, that is indigo, which the German Federal Office for Information Security (BSI) lists as Apple's secure mobile solution. VS-NfD is the lowest German classification level. BSI approvals for Apple's indigo: up to VS-NfD (BSI-VSA-10900) and NATO RESTRICTED (BSI-VSA-11003), plus an operating permission up to VS-NfD (BSI-VSA-10901), all valid until 31 October 2027. The approvals are held by Apple Inc.; ISEC7 is the integrator. Apple lists the NATO RESTRICTED approval for iOS and iPadOS 26.
ISEC7 takes care of architecture, build, process definition and operation. We run BlackBerry UEM for this, optionally from the Sovereign Cloud in Germany, and monitor device compliance with ISEC7 SPHERE. The approval belongs to the platform, not to us. More on indigo
For encrypted calling in German companies under industrial security oversight, ISEC7 runs the ISEC7 MANAGED SECURE VOICE service. It is built on Secusmart's SecuVOICE app. The SecuVOICE app holds a BSI operating permission (Einsatzerlaubnis) up to VS-NfD, BSI-VSA-11057 (SecuVOICE for iOS and Android, version 6.x), valid until 31 August 2027. Secusmart makes the app, ISEC7 runs the service. Because the service uses German federal cryptographic material, we provide it only to German companies and public authorities. More on ISEC7 MANAGED SECURE VOICE
Register details per BSI list 7164, checked on 8 October 2026.
What does CMMC mean for European suppliers to US defense?
CMMC is the US Department of War's assessment scheme for protecting information in its supply chain. It also reaches European companies whose contracts come from US programs through flow-down clauses. The Department of War suspended the CMMC Phase 2 requirements on 13 July 2026. The obligation to undergo third-party assessment by a C3PAO is on hold; the requirements of DFARS 252.204-7012 and NIST SP 800-171 continue to apply unchanged. The self-assessment and the SPRS score remain mandatory.
ISEC7 is not a C3PAO and not an assessment body. We work through the requirements catalog with you, define the scope and support operations up to audit readiness. The assessment itself is the job of an accredited assessor.
Which documents contain CUI sets the assessment scope, so classification comes first. For exchanging those files with prime contractors, we work with our partner Kiteworks: ISEC7 handles procurement, integration and configuration, its own support, and operation as a managed service. More on CMMC 2.0
Frequently asked questions on IT security in defense
Does NIS2 apply to the German armed forces?
Only in part. Under Section 29(2) of the German BSI Act, federal administration bodies are treated as essential entities, except for Sections 38, 40(3), 61 and 65. Under Section 29(3), the remit of the Federal Ministry of Defence is additionally exempt from Sections 30, 33 and 35, which include the risk management measures and the registration duty. For classified information, the rules on classified-information protection remain decisive.
Does NIS2 apply to defense contractors in Germany?
Yes, if the company itself meets the criteria of Section 28 of the German BSI Act. What counts is whether it belongs to one of the entity types in Annex 1 or 2 of the Act and reaches the thresholds, for important entities for example at least 50 employees or annual turnover and balance sheet total each above 10 million euros. The exemption in Section 29(3) covers only the remit of the Ministry of Defence, not companies.
What does VS-NfD mean?
VS-NfD stands for “VS-NUR FÜR DEN DIENSTGEBRAUCH”, the lowest of the four German classification levels. Under Section 4(2)(4) of the German Security Clearance Act, information is classified at this level if unauthorized access could be detrimental to the interests of the Federal Republic of Germany or one of its states. In practice, products that protect such information with IT security functions need an approval or an operating permission from the BSI.
Can I process NATO RESTRICTED information on an iPhone?
With Apple's indigo, yes, under the conditions of use and operation set out in the approval. The BSI has granted indigo approval BSI-VSA-11003 for NATO RESTRICTED, valid until 31 October 2027; the approval holder is Apple Inc., and Apple lists it for iOS and iPadOS 26. ISEC7 integrates and runs indigo environments but holds no approval of its own.
Is ISEC7 CLASSIFY approved by the BSI or by NATO?
No. ISEC7 CLASSIFY reproduces marking rules, such as the standard BUND and NATO schemes, and enforces them in Outlook, Office and ISEC7 MAIL. It does not carry any approval by the BSI or NATO. Which products need an approval to protect classified information is decided by the BSI under the German classified-information directive.
Who applies for the approval of a product that protects classified information?
According to the BSI, the application comes from the federal authority that will use the product, not from a vendor or service provider. Companies under German industrial security oversight go through the Federal Ministry for Economic Affairs. Products that already hold an approval or operating permission are listed in BSI list 7164 of approved IT security products and systems.
Can ISEC7 certify us for CMMC?
No. ISEC7 is not a C3PAO and not an assessment body. We work through the requirements catalog with you, define the scope and support operations up to audit readiness. The assessment itself is the job of an accredited assessor.
Does CMMC still apply after the suspension of 13 July 2026?
Yes, in part. The Department of War suspended the CMMC Phase 2 requirements on 13 July 2026. The obligation to undergo third-party assessment by a C3PAO is on hold; the requirements of DFARS 252.204-7012 and NIST SP 800-171 continue to apply unchanged. C3PAO assessments had been scheduled to start on 10 November 2026. The self-assessment and the SPRS score remain mandatory.
Talk to us about your environment
Planning an indigo rollout, introducing BUND or NATO marking rules, or working out what CMMC means for your contracts? Tell us what you need through the form and we will get back to you.