Mobile communication
for police and law enforcement
What goes on the work phone alongside BOS digital radio?
Calls, email, documents and messaging. Germany's BOS digital radio network is built and operated by the Federal Agency for Public Safety Digital Radio (BDBOS) and serves federal and state public safety agencies and the Bundeswehr (Section 2 BDBOSG). The smartphone does not replace it; it adds these tasks. Each of them raises the same question: up to which classification level may the app be used, and who is responsible for running it?
- Calls up to VS-NfD: ISEC7 MANAGED SECURE VOICE, based on Secusmart's SecuVOICE app (BSI operating permission BSI-VSA-11057 up to VS-NfD, valid until 31 August 2027; Secusmart makes the app, ISEC7 runs the service).
- iPhone and iPad for classified information: Apple's indigo with an approval up to VS-NfD (BSI-VSA-10900) and an operating permission up to VS-NfD (BSI-VSA-10901), valid until 31 October 2027. The approvals are held by Apple Inc.; ISEC7 is the integrator.
- Email, calendars, functional mailboxes: ISEC7 MAIL for Exchange and Microsoft 365 on iOS and Android.
- Messaging: ISEC7 provides a business messenger as a partner product and manages the environment (Endpoint Productivity). As with ISEC7 MAIL, no BSI instrument for VS-NfD has been issued for it.
How do officers make encrypted calls up to VS-NfD?
Through Secusmart's SecuVOICE app, which uses the BSI's SNS standard for secure cross-network voice and holds a BSI operating permission up to VS-NfD (BSI-VSA-11057, SecuVOICE for iOS and Android, version 6.x, valid until 31 August 2027). ISEC7 MANAGED SECURE VOICE delivers the app as a managed service on Apple and Samsung devices: ISEC7 handles onboarding, applies to the BSI for the key material and runs the service. Because the service uses German federal key material, we supply it only to German companies and public bodies.
The Breakout limit
Calls between two SecuVOICE users and Secure Landing calls to secured phone systems in public authorities reach VS-NfD. Breakout reaches any other number, but is only encrypted up to the federal infrastructure. Classified content therefore does not belong in a Breakout call.
Existing devices
The app goes onto iOS and Samsung devices through your own UEM, if its configuration meets the requirements for VS-NfD key material. Term of 24 months with an extension option.
Ready-made smartphone
Without a suitable UEM, we supply the device configured; management and support come from the Regulated Sovereign Cloud, operated by ISEC7 GmbH staff in Germany. Term of 24 or 36 months.
The operating permission belongs to the app, not to the service. Its conditions of use and operation apply to your agency as well, and the deploying agency weighs the residual risks itself.
How do functional mailboxes and S/MIME get onto the work phone?
With a mail client that brings in the additional mailboxes from Exchange and reads certificates from a token. ISEC7 MAIL connects delegate, functional and shared mailboxes, group calendars and public folders without anyone sharing a password. It signs and encrypts with S/MIME, including separate certificates and certificates on a YubiKey or smart card.
The client runs inside BlackBerry Dynamics, Ivanti AppConnect, Omnissa Workspace ONE or Microsoft Intune containers, and it reads and sets classification markings. ISEC7 CLASSIFY adds schemes, recipient checks and reporting, so an email without a classification does not go out. For VS-NfD email on the iPhone, the route is the mail function of the indigo platform, whose operating permission covers email including S/MIME.
What should agencies check when choosing and running mobile solutions?
Statements that can be verified. A word like “secure” says little on its own; what can be checked is the instrument, reference number, product and version, validity and holder, as the BSI lists them in BSI-Schrift 7164. If any of these is missing, so is the basis for a deployment decision. Procurement should also include a check of where a supplier comes from.
- Operations in Germany: in the Sovereign Cloud for BlackBerry UEM, ISEC7 hosts and operates the UEM in Germany, with no access for the manufacturer or third parties. The Regulated package is designed for public authorities, law enforcement, indigo and Samsung Knox Native.
- A view of all devices: ISEC7 SPHERE monitors device fleets across several UEM platforms from different vendors, with a dedicated indigo dashboard.
- A certified organization: ISEC7 Group AG, ISEC7 GmbH, ISEC7 Software GmbH and ISEC7 Inc. are certified to DIN EN ISO 27001:2022 and ISO 9001:2015, valid until 2 September 2027.
NIS2 for police authorities
Federal police authorities are part of the federal administration and are treated as particularly important entities under Section 29 BSIG, except for Sections 38, 40(3), 61 and 65. State police forces are state authorities, so Section 29 does not apply to them. How the BSI Act treats the rest of the federal administration is explained on our page for public authorities and administration.
Frequently asked questions about mobile communication for police and BOS
Does a smartphone or messenger replace BOS digital radio?
No. Under Section 2 BDBOSG, BOS digital radio is built and operated by the Federal Agency for Public Safety Digital Radio and serves federal and state public safety agencies and the Bundeswehr. Smartphones and messengers add calls, email, documents and chat. For a work messenger, what matters is whether, and up to which classification level, it may be used.
Can German police make calls up to VS-NfD on a smartphone?
Yes, with Secusmart's SecuVOICE app: for SecuVOICE for iOS and Android, version 6.x, the BSI has issued an operating permission up to VS-NfD, BSI-VSA-11057, valid until 31 August 2027. ISEC7 MANAGED SECURE VOICE runs the app as a service, either in your own UEM or on a fully configured smartphone. Because German federal key material is used, ISEC7 supplies the service only to German companies and public bodies.
Are calls to regular phone numbers protected up to VS-NfD?
No, not along the whole route. Only calls between two SecuVOICE users and Secure Landing calls to secured phone systems in public authorities reach VS-NfD. A Breakout call to the public network is only encrypted up to the federal infrastructure, so classified content does not belong in it.
What is indigo, and who is it for?
indigo is Apple's secure mobile solution for standard iPhones and iPads. The BSI lists it with Apple Inc. as manufacturer, with approvals up to VS-NfD (BSI-VSA-10900) and NATO RESTRICTED (BSI-VSA-11003) and an operating permission up to VS-NfD (BSI-VSA-10901), all valid until 31 October 2027. The platform is aimed at BOS, public administration, KRITIS operators and the defense industry. As integrator, ISEC7 delivers architecture, rollout and operations; the approval is Apple's.
How do officers get functional mailboxes and S/MIME on their work phones?
The permissions come from Exchange; on the phone you need a client that connects the additional mailboxes. ISEC7 MAIL connects delegate, functional and shared mailboxes without password sharing and signs and encrypts with S/MIME, including certificates on a YubiKey or smart card. No BSI instrument for VS-NfD has been issued for the client.
Does NIS2 apply to German police authorities?
For federal police authorities, yes: as federal administration bodies they are treated as particularly important entities under Section 29 BSIG, except for Sections 38, 40(3), 61 and 65. State police forces are state authorities and are not covered by Section 29 BSIG.
How can I tell whether a mobile product may be used for VS-NfD?
From its entry in the BSI's list of approved IT security products (BSI-Schrift 7164). Check the instrument (approval or operating permission), reference number, product version, classification level and validity there. A Common Criteria certificate or a vendor statement does not replace that entry.
Information as of 8 October 2026 · Register entries from BSI-Schrift 7164, checked on 8 October 2026 · Legal references from gesetze-im-internet.de
Talk to us about your agency's communication
Tell us which devices, which UEM and which classification levels are involved. We will show you which building blocks fit, where an operating permission has its limits and what ISEC7 takes on in operations.
You can also reach us directly at sales@isec7.com or +49 40 325076 0.